Skip to the guide

Host Laravel and other frameworks

Laravel, Symfony, Statamic and most of what has been written since keep their code beside what they publish: the framework, its settings and its .env sit next to a public folder, and only that folder is meant to be reachable. This page points your website at it, says what the panel refuses and why, and covers the two things that catch people out.

Step 1

Upload the project into a folder of its own.

Put the whole project, public folder and all, inside one folder in your website. Anything will do for the name; this page uses myapp. Upload it over SFTP or through the file manager.

public_html/
  myapp/
    app/
    bootstrap/
    config/
    public/        <- this is what the web server should serve
    routes/
    storage/
    vendor/
    .env           <- never reachable once step 2 is done

Upload the files as they are. Nothing has to be renamed, and no file in the project needs editing.

Step 2

Point the website at the public folder.

Open the website, go to Website settings and choose Served folder. The panel lists the folders it recognises, so myapp/public is usually already there. Choose it and apply.

From that moment the web server is rooted at that folder. Your application answers at the website's address, and everything beside it, your .env included, returns 404 to anybody who asks for it.

What each field means

Field	What it means	Limits and refusals
Folder	The folder to serve, chosen from the ones the panel found. The whole website is the default and is what every website starts as.	Only folders that exist in this website. A folder an installed application is managing cannot be changed here.
Another folder	A path typed by hand, for a framework the panel does not recognise. Used only when Another folder is chosen above.	A path inside this website, such as `public` or `myapp/public`. At most 255 characters. A path containing `..`, a backslash or a drive letter is refused.

What it refuses, and what you will see

If you ask for	Dashmox says	Why
`../somewhere`	a served folder is a path inside this website	The served folder is what confines the website. A path leaving it would publish files that are not yours to publish.
A folder that is not there	this website has no folder called "x" to serve	A served folder that does not exist is a website answering 404 to everything, so it is checked before it is saved rather than after.
A folder the web server cannot enter	the web server cannot enter "x": its permissions are 0700	A folder your own code created carries that code's umask. Set it to 750 in the file manager and apply again.
A folder an application chose	an application installed on this website is choosing what it serves	An application reaches its own uploads relative to that folder, so moving it by hand would take the application off the air.

Step 3

Point the application at its database.

Create a database on the website's Databases page and copy the .env block the panel gives you straight into your project's .env. Databases covers the connection details, including the second string Symfony needs.

DB_CONNECTION=mysql
DB_HOST=localhost
DB_DATABASE=hpd_yourdatabase
DB_USERNAME=hpu_youraccount
DB_PASSWORD=the password the panel showed you

Laravel's scheduler is a scheduled task running artisan every minute, and runs as the website's own account like everything else.

Worth knowing

The two things that catch people out.

php artisan storage:link does not work here. It makes a symbolic link, and Dashmox never follows one inside a website: a link is the oldest way to talk a web server into serving something that belongs to somebody else. Write the files you want published into a real folder inside your served folder instead, or serve them through a route in your application.
Keep the project in public_html. The served folder is chosen from inside it, so that is where a PHP project goes. The app tree is for a Node.js application; a PHP website can read it from 0.97.276 onwards and could not before, so an arrangement that reaches into it needs that release or newer.

If you would rather not move anything

The arrangement without a served folder.

There is a second way, and it is the one shared hosting without this setting forces on people: put the contents of public at the top of the website, put the rest of the project in the private tree, and change two lines of index.php. It works, and the served folder is better, because nothing in your project has to be edited.

require __DIR__.'/../private/vendor/autoload.php';
$app = require_once __DIR__.'/../private/bootstrap/app.php';

Laravel's own documentation warns against moving index.php to the project root, and it is right: doing that publishes .env and every configuration file. The arrangement above is not that. The project stays out of the served tree, in private, which the web server never serves whatever happens.