> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Protect Your .env File! - URL: https://securinglaravel.com/security-tip-protect-your-env-file/ - Published: 2023-11-12T04:23:47.000Z - Updated: 2025-08-03T11:28:12.000Z - Description: [Tip#62] Search engines like to snoop on all of your files, so be careful what you leave lying around. - Author: Stephen Rees-Carter - Tags: Security Tips, .env, Environment, Secrets I stumbled upon an interesting tweet this morning from [@AshboDev](https://twitter.com/AshboDev?ref=securinglaravel.com) on Twitter: [![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fsubstack-post-media.s3.amazonaws.com-2fpublic-2fimages-2f2a1a549c-2075-4d58-a7e6-61c6a3c5977a_606x223.png)](https://twitter.com/AshboDev/status/1723067564631241015?ref=securinglaravel.com) “I've found a few #Laravel sites this evening with an exposed .env, giving me full access to the DB their site is connected to. It's shocking how many are out there, is it lack of education, or just people being complacent?” @AshboDev It sparked some interesting questions and recommendations, which we’ll get to shortly, as well as this reply/quote from [@akshitarora0907](https://twitter.com/akshitarora0907?ref=securinglaravel.com) that demonstrates the issue nicely: ![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fsubstack-post-media.s3.amazonaws.com-2fpublic-2fimages-2f034b63b3-eeec-422f-983b-4b7c7557286b_605x802.jpg) Quote tweet showing a screenshot of an exposed .env file. It’s very clearly an issue on some sites, one which you can easily exploit using a technique called [Google Dorking](https://en.wikipedia.org/wiki/Google%5Fhacking?ref=securinglaravel.com), which makes it trivial to find exposed `.env` files. ## How secure is your app? Sign up for ****Securing Laravel** to learn the essential security skills you need to keep your Laravel apps secure! You'll receive [weekly security tips](https://securinglaravel.com/tag/tips/) (like this one!), and upgrade to receive [monthly In Depth articles](https://securinglaravel.com/tag/in-depth/) that teach you so much more. You'll also be supporting Stephen's security work within the Laravel & PHP Community! Subscribe Email sent! Check your inbox to complete your signup. No spam. Unsubscribe anytime. I just performed a quick dork, which revealed 20+ sites on the first page of results - exactly what I expected to find. These are just the ones Google is aware of - there would be significantly more that haven’t been detected yet, which you could find manually or over time as Google picks them up. Many of these will contain APP encryption keys, database credentials, API keys, etc, many of which are usable for further exploitation of the app or the associated accounts. For example, finding Stripe keys would allow access to the payment systems… ### How Does This Happen? By design, Laravel keeps all but the essential files outside the `public/` directory, and you’re supposed to configure your apps so only the `public/` is accessible on the web. This means that files like `.env` aren’t accessible at all, and you’re safe from this issue entirely. However, some environments don’t support putting files outside the web root - shared hosting is a common scenario where this happens, or if you’re managing your own server and you’re unaware of the purpose of the `public/` directory. In these instances, your files outside `public/` are web accessible and sensitive information, such as your `.env` can be exposed. It’s not just the `.env` which is an issue, but any other file in your directory - such as `auth.json`, or cache files, config files, etc… the options are plentiful. ### How Do You Prevent It? 1. **Install your apps so** `public/` **is the only web accessible directory.** This is super important, so always try this first! If you use a service like [Laravel Forge](https://forge.laravel.com/?ref=securinglaravel.com), this is done automatically for you. 2. **Add specific rules into Nginx/Apache to block accessing your sensitive files.** Laravel forge does this as an extra layer of protection by blanket blocking all `` `.*` `` files. This also blocks access to `.git`, which is another huge security risk. `location ~ /.(?!well-known).* { deny all; }` 3. **Set environment variables in the server environment or use XYZ secure config storage solution.** I’ve included these as they are legitimate solutions, but only at #3 as you only really want to mess around with these options when you’re managing a large app across multiple servers. It adds a lot of complexity you really don’t want to deal with on a simple app, and I’d personally recommend just sticking with a `` `.env` `` file and installing Laravel properly. *(If you want me to go into more detail, or you disagree, please jump in the comments and I’ll happily continue the conversation!)* We’ll finish up here, since this is a security Tip, not an In Depth, but the key takeaway is to install and configure your Laravel apps so the sensitive files are not web accessible. If you’re not comfortable configuring your site securely and getting the web config right, then I highly recommend checking out a service like [Laravel Forge](https://forge.laravel.com/?ref=securinglaravel.com), which will handle it all for you. --- ***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.* *When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* *You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*