You’ve built your Laravel app. Features are done. Tests are passing.
It’s time to hit Deploy.
But before you ship to production, take a deep breath—and make sure you’ve locked the doors.
Because once your app is live, it becomes a public target.
And trust me—bots, scrapers, and hackers are already waiting.
Here’s a practical, battle-tested Laravel security checklist to review before you deploy.
<hr>
<h2>🔒 1. Turn Off Debug Mode</h2>
The #1 Laravel mistake in production.
Check your <code>.env</code>:
<pre><code class="language-env">APP_ENV=production
APP_DEBUG=false
</code></pre>
When <code>APP_DEBUG=true</code>, Laravel will expose:
<ul>
<li>Stack traces</li>
<li>File paths</li>
<li>Environment variables</li>
<li>Even API keys</li>
</ul>
<h3>✅ Must-do:</h3>
<ul>
<li>Triple-check <code>APP_DEBUG</code> before every deployment</li>
<li>Automate this check in CI/CD</li>
</ul>
<hr>
<h2>🔐 2. Set File &amp; Directory Permissions Correctly</h2>
Don’t chmod everything to <code>777</code> and walk away.
<h3>✅ Recommended:</h3>
<pre><code class="language-bash">sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 storage
sudo chmod -R 755 bootstrap/cache
</code></pre>
Make sure:
<ul>
<li><code>.env</code> isn’t publicly accessible</li>
<li><code>storage/</code> and <code>bootstrap/cache/</code> are writable (but not executable)</li>
<li>Your app can’t write to random directories</li>
</ul>
<hr>
<h2>🧾 3. Sanitize &amp; Validate Every Input</h2>
Even if it “worked fine in dev”, dirty inputs cause:
<ul>
<li>XSS</li>
<li>SQL injection</li>
<li>Broken logic</li>
</ul>
Use Form Request classes:
<pre><code class="language-php">public function rules()
{
 return [
 &#x27;name&#x27; =&gt; &#x27;required|string|max:255&#x27;,
 &#x27;email&#x27; =&gt; &#x27;required|email&#x27;,
 ];
}
</code></pre>
For user-generated content, sanitize HTML using:
<ul>
<li><a href="https://github.com/mewebstudio/Purifier" target="_blank" rel="noopener nofollow"><code>mewebstudio/purifier</code></a></li>
<li>Or allow only plaintext</li>
</ul>
<hr>
<h2>🚧 4. Restrict Access to Debug Tools</h2>
Telescope, Horizon, Nova—amazing tools, but dangerous if public.
Protect them:
<pre><code class="language-php">Gate::define(&#x27;viewTelescope&#x27;, fn ($user) =&gt; $user-&gt;isAdmin());
</code></pre>
Or better:
<ul>
<li>Hide in production using <code>APP_ENV</code></li>
<li>Restrict by IP or auth middleware</li>
</ul>
<hr>
<h2>🔑 5. Secure Your <code>.env</code> &amp; Secrets</h2>
Never commit <code>.env</code> to Git.
Never leave API keys in config files.
Use:
<ul>
<li><code>.gitignore</code> for <code>.env</code></li>
<li>Environment-specific secrets via CI/CD</li>
<li>Secret managers like AWS SSM, Laravel Vault, or 1Password</li>
</ul>
<hr>
<h2>📁 6. Harden File Uploads</h2>
Don’t:
<ul>
<li>Allow public access to <code>/uploads</code></li>
<li>Trust extensions or filenames</li>
<li>Accept arbitrary files</li>
</ul>
Do:
<ul>
<li>Validate MIME type + file extension</li>
<li>Store files in <code>storage/app</code> (not <code>public/</code>)</li>
<li>Rename uploads with <code>Str::uuid()</code></li>
<li>Disable PHP execution in upload paths</li>
</ul>
<hr>
<h2>🔗 7. Force HTTPS &amp; Add Security Headers</h2>
HTTPS isn’t optional anymore.
In your middleware:
<pre><code class="language-php">\Illuminate\Routing\Middleware\RequireHttps::class
</code></pre>
Or in <code>AppServiceProvider</code>:
<pre><code class="language-php">URL::forceScheme(&#x27;https&#x27;);
</code></pre>
Set headers:
<ul>
<li><code>Strict-Transport-Security</code></li>
<li><code>Content-Security-Policy</code></li>
<li><code>Referrer-Policy</code></li>
<li><code>X-Frame-Options</code></li>
</ul>
Use packages like <a href="https://github.com/spatie/laravel-csp" target="_blank" rel="noopener nofollow"><code>spatie/laravel-csp</code></a> or write your own middleware.
<hr>
<h2>🔒 8. Protect Your Routes &amp; APIs</h2>
Don’t leave sensitive routes unguarded.
<ul>
<li>Use <code>auth</code>, <code>throttle</code>, and <code>verified</code> middleware</li>
<li>Restrict admin APIs with role checks</li>
<li>Use policies or gates for critical actions</li>
</ul>
Example:
<pre><code class="language-php">$this-&gt;authorize(&#x27;delete&#x27;, $post);
</code></pre>
<hr>
<h2>📊 9. Configure Logging Safely</h2>
Don’t log sensitive data:
<ul>
<li>Passwords</li>
<li>Tokens</li>
<li>Full request bodies</li>
</ul>
In <code>config/logging.php</code>:
<ul>
<li>Use <code>daily</code> logs</li>
<li>Limit retention</li>
<li>Store logs outside public folders</li>
</ul>
Consider redacting inputs in <code>App\Exceptions\Handler</code>.
<hr>
<h2>📤 10. Secure Queue Workers &amp; Schedulers</h2>
Queues and scheduled commands run in the background—but they still need protection.
Tips:
<ul>
<li>Validate all job data, even if already validated earlier</li>
<li>Limit which users can trigger queued jobs</li>
<li>Monitor for failed jobs or abuse</li>
<li>Use <code>php artisan queue:monitor</code> or Laravel Pulse</li>
</ul>
<hr>
<h2>📈 Bonus: Enable Monitoring &amp; Alerts</h2>
You can’t stop every attack—but you can detect early signs.
Tools to consider:
<ul>
<li>Laravel Pulse (for built-in monitoring)</li>
<li>Telescope (for request &amp; exception auditing)</li>
<li>Sentry, Bugsnag, or Rollbar (for alerts)</li>
<li>Slack or Email notifications on unusual activity</li>
</ul>
<hr>
<h2>📘 Want a Deeper Dive?</h2>
This checklist is just the surface.
In my eBook Bulletproof Laravel: Write Code That Hackers Hate, I walk through:
✅ Secure authentication, 2FA, email verification
✅ File uploads, XSS, CSRF, SQLi
✅ API &amp; mobile security
✅ Queues, scheduled tasks, and production hardening
✅ Case studies from real-world attacks
👉 Get it here: <a href="https://www.amazon.com/dp/B0FFNT7BMQ" target="_blank" rel="noopener nofollow">https://www.amazon.com/dp/B0FFNT7BMQ</a>
Start deploying with confidence—not with crossed fingers.
<hr>
<h2>🧠 Final Tip</h2>
Laravel gives you the tools.
Security comes down to how you use them.
So next time you go to deploy your Laravel app—
use this checklist, and ship it like a pro.

Kamruzzaman Kamrul

A comprehensive security checklist for Laravel applications before production deployment, covering essential practices like disabling debug mode, setting proper file permissions, input validation, securing debug tools, protecting environment variables, hardening file uploads, enforcing HTTPS with security headers, route protection, safe logging configuration, and queue security. Includes practical code examples and recommendations for monitoring tools to detect potential security threats.

A Security Checklist for Your Laravel App Before You Hit Deploy

<a href="https://github.com/MantraIdeas/LaravelEnvDoctor" target="_blank" rel="noopener nofollow">https://github.com/MantraIdeas/LaravelEnvDoctor</a>
This package is a diagnostic tool that checks your Laravel application’s environment configuration and directory permissions to prevent common deployment issues.