---
title: "A Security Checklist for Your Laravel App Before You Hit Deploy"
url: https://daily.dev/posts/a-security-checklist-for-your-laravel-app-before-you-hit-deploy-balfwtns3
source_url: https://daily.dev/posts/a-security-checklist-for-your-laravel-app-before-you-hit-deploy-balfwtns3
type: freeform
source: "Kamruzzaman Kamrul"
author: "Kamruzzaman Kamrul"
published: 2025-07-08T19:13:58.342Z
updated: 2025-07-08T19:14:22.212Z
tags: ["security", "webdev", "cicd", "php", "laravel"]
reading_time: 4
upvotes: 15
comments: 4
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# A Security Checklist for Your Laravel App Before You Hit Deploy

**[Kamruzzaman Kamrul](https://daily.dev/sources/rlrvdkloq2zk9twhblolg)** · [@kamruzzamankamrul](https://daily.dev/kamruzzamankamrul) · 4 min read · 15 upvotes · 4 comments

## Summary

A comprehensive security checklist for Laravel applications before production deployment, covering essential practices like disabling debug mode, setting proper file permissions, input validation, securing debug tools, protecting environment variables, hardening file uploads, enforcing HTTPS with security headers, route protection, safe logging configuration, and queue security. Includes practical code examples and recommendations for monitoring tools to detect potential security threats.

## Content

You've built your Laravel app. Features are done. Tests are passing.
It’s time to hit **Deploy**.

But before you ship to production, take a deep breath—and make sure you’ve locked the doors.

Because once your app is live, it becomes a public target.
And trust me—**bots, scrapers, and hackers are already waiting**.

Here’s a practical, battle-tested **Laravel security checklist** to review before you deploy.

---

## 🔒 1. Turn Off Debug Mode

The #1 Laravel mistake in production.

**Check your `.env`:**

```env
APP_ENV=production
APP_DEBUG=false
```

When `APP_DEBUG=true`, Laravel will expose:

* Stack traces
* File paths
* Environment variables
* Even API keys

### ✅ Must-do:

* Triple-check `APP_DEBUG` before every deployment
* Automate this check in CI/CD

---

## 🔐 2. Set File & Directory Permissions Correctly

Don’t chmod everything to `777` and walk away.

### ✅ Recommended:

```bash
sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 storage
sudo chmod -R 755 bootstrap/cache
```

Make sure:

* `.env` isn’t publicly accessible
* `storage/` and `bootstrap/cache/` are writable (but not executable)
* Your app can't write to random directories

---

## 🧾 3. Sanitize & Validate Every Input

Even if it “worked fine in dev”, dirty inputs cause:

* XSS
* SQL injection
* Broken logic

Use **Form Request** classes:

```php
public function rules()
{
    return [
        'name' => 'required|string|max:255',
        'email' => 'required|email',
    ];
}
```

For user-generated content, **sanitize HTML** using:

* [`mewebstudio/purifier`](https://github.com/mewebstudio/Purifier)
* Or allow only plaintext

---

## 🚧 4. Restrict Access to Debug Tools

Telescope, Horizon, Nova—amazing tools, but dangerous if public.

**Protect them:**

```php
Gate::define('viewTelescope', fn ($user) => $user->isAdmin());
```

Or better:

* Hide in production using `APP_ENV`
* Restrict by IP or auth middleware

---

## 🔑 5. Secure Your `.env` & Secrets

Never commit `.env` to Git.
Never leave API keys in config files.

**Use:**

* `.gitignore` for `.env`
* Environment-specific secrets via CI/CD
* Secret managers like AWS SSM, Laravel Vault, or 1Password

---

## 📁 6. Harden File Uploads

**Don’t:**

* Allow public access to `/uploads`
* Trust extensions or filenames
* Accept arbitrary files

**Do:**

* Validate MIME type + file extension
* Store files in `storage/app` (not `public/`)
* Rename uploads with `Str::uuid()`
* Disable PHP execution in upload paths

---

## 🔗 7. Force HTTPS & Add Security Headers

HTTPS isn’t optional anymore.

**In your middleware:**

```php
\Illuminate\Routing\Middleware\RequireHttps::class
```

Or in `AppServiceProvider`:

```php
URL::forceScheme('https');
```

Set headers:

* `Strict-Transport-Security`
* `Content-Security-Policy`
* `Referrer-Policy`
* `X-Frame-Options`

Use packages like [`spatie/laravel-csp`](https://github.com/spatie/laravel-csp) or write your own middleware.

---

## 🔒 8. Protect Your Routes & APIs

Don’t leave sensitive routes unguarded.

* Use `auth`, `throttle`, and `verified` middleware
* Restrict admin APIs with role checks
* Use policies or gates for critical actions

Example:

```php
$this->authorize('delete', $post);
```

---

## 📊 9. Configure Logging Safely

Don’t log sensitive data:

* Passwords
* Tokens
* Full request bodies

**In `config/logging.php`:**

* Use `daily` logs
* Limit retention
* Store logs outside public folders

Consider redacting inputs in `App\Exceptions\Handler`.

---

## 📤 10. Secure Queue Workers & Schedulers

Queues and scheduled commands run in the background—but they still need protection.

**Tips:**

* Validate all job data, even if already validated earlier
* Limit which users can trigger queued jobs
* Monitor for failed jobs or abuse
* Use `php artisan queue:monitor` or Laravel Pulse

---

## 📈 Bonus: Enable Monitoring & Alerts

You can’t stop every attack—but you can detect early signs.

Tools to consider:

* **Laravel Pulse** (for built-in monitoring)
* **Telescope** (for request & exception auditing)
* **Sentry, Bugsnag, or Rollbar** (for alerts)
* **Slack or Email** notifications on unusual activity

---

## 📘 Want a Deeper Dive?

This checklist is just the surface.

In my eBook **Bulletproof Laravel: Write Code That Hackers Hate**, I walk through:

✅ Secure authentication, 2FA, email verification
✅ File uploads, XSS, CSRF, SQLi
✅ API & mobile security
✅ Queues, scheduled tasks, and production hardening
✅ Case studies from real-world attacks

👉 Get it here: https://www.amazon.com/dp/B0FFNT7BMQ

Start deploying with confidence—not with crossed fingers.

---

## 🧠 Final Tip

Laravel gives you the tools.
Security comes down to how **you** use them.

So next time you go to deploy your Laravel app—
**use this checklist, and ship it like a pro.**

## Community discussion

Top comments from developers on daily.dev.

**@dipesh79** · 2 upvotes

> https://github.com/MantraIdeas/LaravelEnvDoctor
>
> This package is a diagnostic tool that checks your Laravel application's environment configuration and directory permissions to prevent common deployment issues.

**@jayeshpurohit** · 1 upvotes

> Very helpful content

## Similar posts on daily.dev

- [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 0 upvotes · 0 comments
- [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments
- [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments
- [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments
- [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#cicd](https://daily.dev/tags/cicd), [#php](https://daily.dev/tags/php), [#laravel](https://daily.dev/tags/laravel)

[View this post on daily.dev](https://daily.dev/posts/a-security-checklist-for-your-laravel-app-before-you-hit-deploy-balfwtns3)