> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Prohibiting Destructive Commands on Production
- URL: https://securinglaravel.com/security-tip-prohibiting-destructive-commands-on-production/
- Published: 2024-06-14T20:00:00.000Z
- Updated: 2025-09-10T11:29:52.000Z
- Description: [Tip #83] It's important to be paranoid when it comes to production environments - because if you forget you're logged into prod, you may end up dropping a database... or worse! 😱
- Author: Stephen Rees-Carter
- Tags: Security Tips, Debug, Environment, Laravel 11, Workflow, Dev Tools, Artisan

Way back in [Security Tip #6](https://securinglaravel.com/security-tip-disable-dev-and-test/) I wrote about manually disabling debug and testing Artisan commands from running in production (or staging) using something like this:

```php
public function handle()
{
    if (! app()->isLocal()) {
        $this->error('This command can only be used in dev!');
        return Command::INVALID;
    }

    // ...
}
```

As a refresher, you should disable any Artisan commands that shouldn't be run in production (or staging!) from working in those environments. This ensures they cannot be accidently triggered (*i.e. if a dev forgets they've SSH'ed into a prod server!*) and have some destructive effect. Such as dropping a database, resetting user passwords, etc.

As of [Laravel 11.9](https://laravel-news.com/laravel-11-9-0?ref=securinglaravel.com#content-prevent-destructive-commands) (released in May 2024), there is a new option we can use to prevent destructive Artisan commands from being run - without needing a custom `if` inside each `handle` method! It's done through a new `Illuminate\Console\Prohibitable` trait, which allows you to toggle when the command can be run on each command.

To start using it, first add the `Prohibitable` trait onto your Artisan command:

## The essential security resource for Laravel developers.

Sign up now to receive the [****weekly Laravel Security tips**](https://securinglaravel.com/tag/tips/) and [****monthly In Depth articles**](https://securinglaravel.com/tag/in-depth/) you need to keep your Laravel applications safe!

Subscribe 

Email sent! Check your inbox to complete your signup. 

No spam. Unsubscribe anytime.

```php
use Illuminate\Console\Command;
use Illuminate\Console\Prohibitable;
 
class ResetUserPasswordsCommand extends Command
{
    use Prohibitable;

    // ...
}
```

And then toggle the command in a Service Provider:

```php
public function boot(): void
{
    // Prevent from running in production.
    ResetUserPasswordsCommand::prohibit($this->app->isProduction());
}
```

This new trait has already been added to Laravel's `db:wipe`, `migrate:fresh`, `migrate:refresh`, and `migrate:reset` commands. Allowing you to prevent them from accidently being run in production - *which I would suggest is a really good idea!*

```php
public function boot(): void
{
    FreshCommand::prohibit($this->app->isProduction());
    RefreshCommand::prohibit($this->app->isProduction());
    ResetCommand::prohibit($this->app->isProduction());
    WipeCommand::prohibit($this->app->isProduction());

    // OR prohibt them all in one go
    DB::prohibitDestructiveCommands($this->app->isProduction());
}
```

Btw, the `::prohibit()` method defaults to `true` when nothing is specified, allowing you to completely lock out a command if you need to.

You can check out the trait [on GitHub](https://github.com/laravel/framework/blob/11.x/src/Illuminate/Console/Prohibitable.php?ref=securinglaravel.com) and find more details in the [Laravel News article](https://laravel-news.com/prevent-destructive-commands-from-running-in-laravel-11?ref=securinglaravel.com). Also, a huge thanks to [Jason McCreary](https://github.com/jasonmccreary?ref=securinglaravel.com) and [Joel Clermont](https://github.com/joelclermont?ref=securinglaravel.com) for adding this awesome feature to the framework. 🙂

---

***If you found this security tip useful?* 👍**  
[*Subscribe now*](#/portal/signup) *to get weekly* [***Security Tips***](https://securinglaravel.com/tag/tips/) *straight to your inbox, filled with practical, actionable advice to help you build safer apps.*

***Want to learn more?* 🤓**  
*Upgrade to a* [*Premium Subscription*](#/portal/signup) *for exclusive monthly* [**In Depth* articles*](https://securinglaravel.com/tag/in-depth/)*, or support my work with a* [*one-off tip*](#/portal/support)*! Your support directly funds my security work in the Laravel community.* 🥰

**Need a second set of eyes on your code?** 
*Book in a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *today! I also offer budget-friendly* [*Security Reviews*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com) *too.*

*Finally, connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*