Publish from a folder other than public_html

By default a domain publishes public_html in your home directory. Modern PHP frameworks are built the other way round: the application lives in one folder and only a public/ subfolder inside it is meant to be reachable from the web. The .env file — database password, application key, payment credentials — sits one level above, deliberately.

If you publish the whole project instead, /.env is a URL anyone can request. Choosing the document root is how you avoid that.

Set it

Domains → the domain's row → Document root.

You are asked for a folder inside your home directory, written relative to it:

app/public

not /home/you/app/public. Leave it empty to go back to public_html.

The panel creates the folder if it does not exist yet, rewrites the web server configuration and reloads it. When it has finished it tells you the full path it is now publishing, and says so explicitly if it had to create the folder.

A typical layout afterwards:

/home/you/
├── app/            <- the whole project: composer.json, .env, vendor/
│   └── public/     <- the only part served to the web
└── public_html/    <- the default, no longer used

Check that it worked

Load the site. Then ask for the file you were protecting:

curl -sI https://yourdomain.com/.env

403 is the answer you want. A 200 means the document root is still above .env and the change did not take effect — reload the Domains page and confirm the row shows the folder you typed.

Which domains have this

• Primary domain, addon domains and subdomains each have their own document root and their own Document root button.
• Parked (alias) domains do not. An alias always serves your primary website, which is what makes it an alias. The panel says so: "A parked domain always serves your primary website. Change the primary document root instead, or convert this to an addon domain."
• Redirects do not. A redirect serves nothing of its own.

What the panel refuses, and why

The value is checked before it reaches anything privileged, and checked again on the other side. Refusals come back as a message on the page, and nothing is changed.

One more check happens on the server itself: the folder is resolved through any symbolic links and re-checked. A symlink pointing out of your home is refused rather than followed, so ln -s / ~/app does not turn into a served filesystem.

Certificates

Nothing to do. A certificate is issued for the domain, not the folder, and the document root you set is re-read at the moment a certificate is written — so changing it while HTTPS is being set up is safe. An addon domain that already has HTTPS keeps it.

When something looks wrong

The site shows a directory listing or "index of /". The new folder has no index.php or index.html in it yet. Upload the application, or point the document root at the folder that does have one.

403 on every page, not only on .env. The folder exists but the web server cannot read into it. Check with the File Manager that the folder and its parents belong to your account, especially if you placed the files there over SSH as another user.

404 on every page and the site was working a minute ago. Reload the Domains page and read the folder shown in the row. A typo is published exactly as typed — the panel creates the folder rather than guessing, so an empty new folder is the usual cause. Set it back to public_html, or to the right folder.

Every page returns 500 with a framework error about a missing key. That is the application, not the document root — the framework is being reached. For Laravel this is usually an empty APP_KEY.