Updated June 2026. Tested on Laravel 13.

A Laravel project has one folder that is meant to face the web: public. Everything else, your code, your .env, your config, sits above it and must never be reachable from a browser. So the one rule when hosting Laravel is that your domain's document root must point at the public directory, not at the project root. Get this wrong and either the site does not load, or worse, your .env is exposed.

On a VPS or droplet (the right way)

If you run your own server, you set the web root in the server config. With Caddy it is one line.

techalyst.com {
    root * /var/www/techalyst.com/public
    php_fastcgi unix//run/php/php8.4-fpm.sock
    file_server
}

With Nginx it is the root directive in the site block.

server {
    server_name techalyst.com;
    root /var/www/techalyst.com/public;
    # ...
}

This is the clean approach, and the one the DigitalOcean deploy guide uses. The whole project lives outside the web root, and only public is served.

On shared cPanel hosting

Shared hosting is more awkward, because by default cPanel serves everything from public_html. You have two options.

The simplest, if you only host the one site, is to put the Laravel app one level above public_html and make public_html itself the public folder, by moving the contents of public into public_html and editing index.php to point its require paths up one directory. It works but it is fiddly.

The cleaner option, if you have root SSH access, is to change the document root for the domain so it points at the project's public folder. Edit the domain's userdata file.

nano /var/cpanel/userdata/USERNAME/DOMAIN.COM

Change the documentroot line to your project's public folder.

documentroot: /home/USERNAME/project/public

Do the same in the DOMAIN.COM_SSL file if you have a certificate, remove the cached copies, then rebuild and restart Apache.

rm /var/cpanel/userdata/USERNAME/DOMAIN.COM.cache
/scripts/updateuserdatacache
/scripts/restartsrv_httpd

A word of advice

If you are choosing where to host a Laravel app, a small VPS or droplet gives you a clean document root, real control, and usually costs about the same as decent shared hosting. The deploy guide on this blog walks through it end to end. Shared cPanel hosting can run Laravel, but you spend your time fighting its defaults. Questions welcome in the comments.