Step 2 of 10

Upload Laravel to cPanel the safe way

Never put a whole Laravel project in public_html. Your .env file would sit in a web-accessible folder, one mistake away from being downloaded. Keep the code beside the web root and put only the public files inside it.

The folder layout

/home/cpaneluser/
├── laravel-app/          ← your project, without public/
│   ├── app/
│   ├── bootstrap/
│   ├── config/
│   ├── storage/
│   ├── vendor/
│   └── .env
└── public_html/          ← the contents of public/
    ├── build/
    ├── index.php
    └── .htaccess

Addon domains and subdomains are simpler: in cPanel → Domains, set the document root to laravel-app/public. Then you can skip the index.php change.

Prepare the files on your computer

composer install --no-dev --optimize-autoloader
npm run build

Then zip the project, leaving out node_modules, .git and your local .env. Hosts rarely run Node, so always upload the finished public/build folder.

Upload and point index.php at your code

1
In cPanel → File Manager, upload the zip to your home folder and extract it into laravel-app.
2
Move the contents of laravel-app/public into public_html.
3
Edit public_html/index.php so its three paths point to ../laravel-app/ instead of ../.
4
Add $app->usePublicPath(__DIR__); so Laravel treats public_html as its public folder.

require __DIR__.'/../laravel-app/vendor/autoload.php';

$app = require_once __DIR__.'/../laravel-app/bootstrap/app.php';

// The web root is public_html, not the project's public/ folder.
$app->usePublicPath(__DIR__);

$app->handleRequest(Request::capture());

The config generator writes this file with your folder names.

If you see "Vite manifest not found"

Laravel is looking for build/manifest.json in the wrong place. Check that public_html/build/manifest.json exists and that usePublicPath() is in index.php.

Commands run from the Terminal or cron do not read index.php, so public_path() still means laravel-app/public there. Anything that writes public files from a command, such as a sitemap, must use the full public_html path.

Frequently asked questions

Why not just move everything into public_html?

Because then .env, with your database password and app key, is inside the web root. A .htaccess rule can block it, but keeping it out of the web root means nothing can go wrong.

Do I need to run composer on the server?

No. Upload vendor/ from your computer, built with the same PHP version as your host.