What are the recommended steps for deploying a CakePHP application to a production server?

Deploy a CakePHP application to production by preparing the server, transferring code, hardening configuration, running migrations, and verifying the public document root.

Preparation and file transfer

Confirm PHP and extensions match your CakePHP version. Transfer the project to the server and install production dependencies only.

composer install --no-dev --optimize-autoloader

This removes development tools and builds an optimized classmap for autoloading.

Configuration and security

Set production mode and keep secrets out of version control.

• Set APP_ENV to production in config/app.php and ensure debug is false. Debug true exposes stack traces and environment variables.
• Create config/app.local.php from a distribution template. Store production database credentials, Security.salt and Security.cipherSeed here. Exclude app.local.php from version control.
• Ensure the .git directory is not web accessible to avoid leaking source and configuration.

Web server document root

Point the web server to the /web directory, not the project root, to prevent direct access to config and src.

Nginx example

server {
    root /var/www/my_app/web;
    index index.php;
    location / { try_files $uri $uri/ /index.php?$query_string; }
    location ~ \.php$ { include fastcgi_params; fastcgi_pass unix:/var/run/php/php-fpm.sock; }
}

Verify the root mapping by attempting to access a file outside /web, such as config/app.php, via the browser. It must be blocked.

Database and file permissions

Apply schema changes for the deployed code version.

bin/cake migrations migrate

Set strict permissions. Web server user needs write access only to writable paths.

chown -R www-data:www-data /var/www/my_app
chmod -R 755 /var/www/my_app
chmod -R 775 /var/www/my_app/tmp /var/www/my_app/logs

Verification

• Confirm APP_ENV is production by checking application behavior on a forced error, no debug output should appear.
• Check logs/error.log for permission issues after first request.
• Confirm migration status via CLI: bin/cake migrations status.