Laravel developers and students hosting applications on shared cPanel hosting commonly purchased in Nepal (Himalayan Host, Prabhu Host, Nest Nepal, etc.).
- ✓A working Laravel 10 or 11 project
- ✓Access to a cPanel hosting account with File Manager and MySQL Database Wizard
- ✓PHP 8.2 or 8.3 enabled on cPanel
🚀 What You Will Learn & Build
- ▸The critical security risks of incorrect cPanel directory structure
- ▸Separating core application code from public document root
- ▸Configuring the index.php entry point and storage symlink
- ▸Creating MySQL databases and setting up the production .env file
- ▸Fixing common 500 errors and permission problems
1. The Critical cPanel Security Trap: Never Dump Everything into public_html
In standard Laravel, only the public/ directory is meant to be web-accessible. Your app/, config/, storage/, and .env files must remain outside public_html.
2. Step-by-Step Secure Deployment Process
3. Updating index.php Paths
<?php
use Illuminate\Http\Request;
define('LARAVEL_START', microtime(true));
// Determine if the application is in maintenance mode...
if (file_exists($maintenance = __DIR__.'/../laravel_app/storage/framework/maintenance.php')) {
require $maintenance;
}
// Register the Composer autoloader...
require __DIR__.'/../laravel_app/vendor/autoload.php';
// Bootstrap Laravel and handle the request...
(require_once __DIR__.'/../laravel_app/bootstrap/app.php')
->handleRequest(Request::capture());4. Database Creation & Production .env Setup
APP_NAME="My App"
APP_ENV=production
APP_KEY=base64:yourGeneratedKeyHere...
APP_DEBUG=false
APP_URL=https://yourdomain.com
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=username_laraveldb
DB_USERNAME=username_dbuser
DB_PASSWORD=YourStrongDatabasePassword123!5. Creating the Storage Symlink on cPanel
// Visit https://yourdomain.com/create-storage-link once, then remove this route!
Route::get('/create-storage-link', function () {
Artisan::call('storage:link');
return 'Storage symbolic link created successfully!';
});✨ Expected Output & Verification
Visiting https://yourdomain.com loads your Laravel home page smoothly with all CSS, images, and database queries executing without any 500 error. Visiting https://yourdomain.com/.env returns an HTTP 404 (file does not exist in public_html).
🧪 How to Test the Implementation
- 1Open https://yourdomain.com in browser and check homepage rendering
- 2Test database operations like login or registration
- 3Verify https://yourdomain.com/.env returns 404 Not Found to ensure sensitive keys are protected
- 4Check storage/logs/laravel.log in File Manager if any error occurs
⚠️ Common Errors & How to Fix Them
Root Cause: Permissions on storage or bootstrap/cache folders are not writable (need 775 or 755), or PHP version mismatch.
Fix: Set permissions on storage and bootstrap/cache to 755 (or 775). In cPanel 'Select PHP Version', ensure PHP 8.2+ with required extensions (pdo_mysql, mbstring, openssl, xml) is active.
Root Cause: Forgot to run 'npm run build' before uploading to cPanel.
Fix: Run npm run build locally, then upload the resulting public/build directory into public_html/build.
🛡️ Security Considerations & Best Practices
- !Never leave APP_DEBUG=true in production; it reveals stack traces and environment variables on error.
- !Delete any temporary setup routes (like /create-storage-link or migration routes) immediately after use.
❓ Frequently Asked Questions (FAQ)
Yes, you can either export your database schema locally with phpMyAdmin and import the .sql file into cPanel phpMyAdmin, or temporarily add Route::get('/run-migrations', fn() => Artisan::call('migrate')) and delete it immediately.
📌 Summary of Key Takeaways
- ✓Keep core Laravel code outside public_html.
- ✓Point public_html/index.php to ../laravel_app/vendor/autoload.php.
- ✓Set APP_DEBUG=false and secure file permissions.
Official References & Further Reading
- 🔗Official Laravel Deployment Guide— Official production deployment recommendations and optimization commands.
Written by Manoj Neupane
AuthorSoftware developer and programming instructor, Nepal
Building software systems and SaaS platforms with Laravel, Next.js, and Node.js. Passionate about helping students and developers in Nepal master practical, real-world development skills.