Securing Your Laravel App: A 20-Point Checklist

Laravel is one of the most secure PHP frameworks out of the box. But security is a practice, not a feature. Every production Laravel application should pass this 20-point checklist.

Environment & configuration

1. APP_DEBUG=false in production. Non-negotiable. Debug mode exposes stack traces, queries, environment variables and sometimes credentials to anyone who triggers an error.

2. APP_ENV=production. This controls logging behaviour, cache drivers and error handling. Never run production on local or staging environment settings.

3. Generate a unique APP_KEY. Run php artisan key:generate. This key encrypts sessions, cookies and encrypted data. Never use the default key and never commit it to version control.

4. Use secure session config. SESSION_SECURE_COOKIE=true, SESSION_HTTP_ONLY=true, SESSION_SAME_SITE=lax, SESSION_DRIVER=redis (or database, never file in production).

HTTPS & headers

1. Force HTTPS. Set APP_URL=https://yoursite.com. Use middleware or .htaccess to redirect HTTP → HTTPS. Implement HSTS headers.

2. Set security headers. Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy. Laravel's TrustProxies middleware must be configured if behind a load balancer.

Authentication & authorisation

1. Rate limit login. Use Laravel's built-in RateLimiter on login routes. After 5 failed attempts, lock for 15 minutes.

2. Implement 2FA for admin accounts. Laravel Fortify makes this straightforward. Require it for any account with elevated privileges.

3. Use Policies and Gates. Every controller action that modifies data should check authorisation. Never rely on hiding UI elements.

Database & queries

1. Never use raw SQL with user input. Always use Eloquent, query builder bindings or prepared statements. SQL injection through raw queries is still the #1 Laravel vulnerability.

2. Encrypt sensitive columns. Use Laravel's Crypt facade or the Encrypted cast for data like API keys, ID numbers and financial details stored in the database.

3. Run migrations with --force in production only in maintenance mode.

File uploads

1. Validate uploaded files aggressively. Check MIME type (not just extension), limit file size and scan for malware if possible.

2. Store uploads outside the web root. Use Laravel's filesystem with public disk for public assets and local or s3 for anything sensitive. Never let users directly access uploaded PHP files.

Dependencies & updates

1. Run composer audit weekly. Check for known vulnerabilities in your dependencies. Subscribe to Laravel security announcements.

2. Keep Laravel and packages updated. Security fixes are released regularly. A 6-month-old Laravel installation has known vulnerabilities.

Monitoring & response

1. Log authentication events. Track logins, failures, password changes and permission escalations.

2. Monitor for anomalies. Unusual patterns (50 failed logins, admin actions at 3am, unexpected data exports) should trigger alerts.

3. Have a backup and recovery plan. Automated daily database backups stored off-site. Test restoration monthly. A backup you have never tested is just hope.

4. Have an incident response plan. Who gets called? How do you take the site offline? How do you notify affected users? Write it down before you need it.

TFast Digital Agency builds Laravel applications that pass every item on this checklist, security is how we engineer from day one, not something we add before launch.

<!-- SEO keyword optimization: secure laravel application checklist -->

Focusing on secure laravel application checklist is essential for modern business success.