Skip to content
ZajLibrary
prod e051e98
Browse

Web server & git

Three files that protect the app at the edges: two .htaccess files that tell Apache how to route, secure, and cache requests, and a .gitignore that keeps secrets and installed dependencies out of git history. They are stack-specific to Apache (shared hosting, Hostinger and similar) — skip the htaccess files if you run Nginx.

The two .htaccess files

Section titled “The two .htaccess files”

Laravel wants its document root at /public. On hosting where you can set that, only the public file matters. On shared hosting where the web root is the project root, you also need the root file to forward traffic into /public and block .env from the web.

FileLands atDoes what
Root .htaccessproject rootRoutes traffic into /public, blocks .env, allows vendor/asset paths
Public .htaccess/public/.htaccessFront controller, HTTPS + HSTS, security headers, caching, gzip
.htaccess (project root)
# ============================================================================
# 📋 ROOT .HTACCESS TEMPLATE (Laravel)
# ============================================================================
# Purpose: Route requests to public folder for Laravel apps
# Location: Project root (same level as /public, /app, /vendor)
# Use when: Shared hosting where public_html points to project root and the
#           server cannot set document root to /public.
# ============================================================================


<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>


    # ----------------------------------------
    # SECURITY: Block .env access
    # ----------------------------------------
    <Files .env>
        Order Allow,Deny
        Deny from all
    </Files>


    RewriteEngine On


    # Handle Authorization Header (API tokens)
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]


    # Remove trailing slashes (SEO/consistency)
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]


    # Front Controller: route to index.php, skip static assets for performance
    # CUSTOMIZE: add/remove extensions to match your project
    RewriteCond %{REQUEST_URI} !(\.css|\.js|\.png|\.jpg|\.jpeg|\.gif|robots\.txt|\.ico|\.woff|\.woff2|\.ttf|\.svg|\.webp)$ [NC]
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]


    # Vendor Package Assets (CodeCanyon)
    # CUSTOMIZE: change "workdo" to your vendor name (e.g. infinitietech, Modules)
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_URI} ^/packages/workdo/
    RewriteRule ^packages/workdo/(.*)$ packages/workdo/$1 [L,NC]


    # Public Folder Asset Routing
    # CUSTOMIZE: add folders like landing/, market_assets/, installer/, uploads/
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(css|assets|market_assets|images|landing|uploads|storage|installer|js|vendor)/(.*)$ public/$1/$2 [L,NC]
</IfModule>


# ============================================================================
# 📝 PROJECT-SPECIFIC ADDITIONS — add rules below this line
# ============================================================================
# --- Custom Domain Redirects ---
# RewriteCond %{HTTP_HOST} ^old-domain\.com$ [NC]
# RewriteRule ^(.*)$ https://new-domain.com/$1 [L,R=301]
#
# --- Additional Vendor Packages ---
# RewriteCond %{REQUEST_FILENAME} !-d
# RewriteCond %{REQUEST_FILENAME} !-f
# RewriteCond %{REQUEST_URI} ^/packages/othervendor/
# RewriteRule ^packages/othervendor/(.*)$ packages/othervendor/$1 [L,NC]


# ============================================================================
# 📝 USAGE: 1. Back up existing .htaccess  2. Copy here as ".htaccess"
#          3. Merge project rules  4. Test: yoursite.com/.env should 403
# ============================================================================

The .gitignore

Section titled “The .gitignore”

Write this before git init so the very first git status is clean — secrets and installed dependencies never enter history. Once a secret or a 200 MB vendor/ tree is committed, removing it is a rewrite-and-force-push ordeal.

.gitignore (CodeCanyon Laravel)
# Dependencies
/vendor/
/node_modules/


# Secrets (never commit)
.env
.env.*
!.env.example


# Laravel generated
/storage/*.key
/bootstrap/cache/*.php


# OS & IDE
.DS_Store
/.idea/
/.vscode/


# Logs & testing
*.log
.phpunit.result.cache


# CodeCanyon ZIPs
*.zip


# Build — comment out the next line if you use the Build-Locally strategy
# /public/build/


# Project vault (credentials)
/Admin-Local/1-Project/2-ProjectVault/

Ignoring vendor/ keeps it out of history, but you do not delete the shipped tree — a CodeCanyon author’s patched packages stay on disk until the app is verified running. Ignored is not the same as deletable.