Once your application is complete, or even before that you’ll want to deploy it. There are a few things you should do when deploying a CakePHP application.
You are encouraged to create a git commit and pull or clone that commit or
repository on your server and run
While this requires some knowledge about git and an existing install of
composer this process will take care about library dependencies and file
and folder permissions.
Be aware that when deploying via FTP you will at least have to fix file and folder permissions.
You can also use this deployment technique to setup a staging- or demo-server (pre-production) and keep it in sync with your dev box.
Adjusting app.php, specifically the value of
debug is extremely important.
Turning debug =
false disables a number of development features that should
never be exposed to the Internet at large. Disabling debug changes the following
types of things:
In addition to the above, many plugins and application extensions use
to modify their behavior.
You can check against an environment variable to set the debug level dynamically
between environments. This will avoid deploying an application with debug
true and also save yourself from having to change the debug level each time
before deploying to a production environment.
For example, you can set an environment variable in your Apache configuration:
SetEnv CAKEPHP_DEBUG 1
And then you can set the debug level dynamically in app.php:
$debug = (bool)getenv('CAKEPHP_DEBUG'); return [ 'debug' => $debug, ..... ];
If you’re throwing your application out into the wild, it’s a good idea to make sure it doesn’t have any obvious leaks:
webrootdirectory is publicly visible, and that your secrets (such as your app salt, and any security keys) are private and unique as well.
Setting the document root correctly on your application is an important step to
keeping your code secure and your application safer. CakePHP applications
should have the document root set to the application’s
makes the application and configuration files inaccessible through a URL.
Setting the document root is different for different webservers. See the
URL Rewriting documentation for webserver specific
In all cases you will want to set the virtual host/domain’s document to be
webroot/. This removes the possibility of files outside of the webroot
directory being executed.
Class loading can take a big share of your application’s processing time. In order to avoid this problem, it is recommended that you run this command in your production server once the application is deployed:
php composer.phar dumpautoload -o
plugins, through the
Dispatcher is incredibly inefficient, it is strongly
recommended to symlink them for production. This can be done by using
bin/cake plugin assets symlink
The above command will symlink the
webroot directory of all loaded plugins
to appropriate path in the app’s
If your filesystem doesn’t allow creating symlinks the directories will be copied instead of being symlinked. You can also explicitly copy the directories using:
bin/cake plugin assets copy