Serve Laravel from the public directory

Point your domain at Laravel's /public folder using .htaccess, so visitors reach example.com rather than example.com/public.

Make example.com serve your Laravel application without /public in the URL. Applies to shared, reseller and Premium hosting.

Laravel expects only its public directory to be web-accessible. On shared hosting you usually cannot change the document root, so a rewrite rule does the same job.

This matters for security, not just tidiness. If the whole Laravel directory is web-accessible, .env — which holds your database password and application key — can be requested directly over HTTP.

Add the rewrite

In cPanel, open File Manager and go to public_html.
Enable Settings → Show Hidden Files (dotfiles), since .htaccess is hidden by default.
Open .htaccess, or create it if it does not exist.

Add this at the top of the file:

<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

Save.

Check it worked

Visit https://example.com. Your application should load, without /public in the address.

Then confirm the file that matters is not reachable:

curl -sI https://example.com/.env | head -n 1

You want 403 or 404. A 200 means .env is being served — stop and fix that before going further.

A better option if you have it

On a VPS or dedicated server, set the document root to the public directory directly in WHM rather than rewriting. It is one less moving part, and nothing above public is exposed at all.

If it does not work

A redirect loop — there is another RewriteRule above this one. The Laravel rule must come first.
The old URL is cached — clear your browser cache, or test in a private window.
A 500 error — check error_log in public_html. See Find your error log.

Serve Laravel from the public directory

Add the rewrite

Check it worked

A better option if you have it

If it does not work

Related

On this page