Put your website online
Upload the complete application into your website directory, including hidden files such as .htaccess. Visit your domain (or its installation subdirectory), then choose Open installer. The entry file takes you to the existing public application automatically.
Preferred: serve only public/
In CloudPanel, FastPanel or shared hosting, set the site document root to the application’s public directory. Keep PHP and TLS configured. Private application directories then live outside the served tree. Apache still needs public/.htaccess; Nginx needs hidden-file, direct-upload and private-looking path denials before fallback routing. Send docs/nginx-public-root.conf.example to your host.
Apache hosting
The included root .htaccess permits only the entry file and public directory. Ask your host to enable mod_rewrite and AllowOverride All for the application directory. A 500 error after upload usually means the host must enable these directives. Do not delete protection files to bypass it.
Nginx, including FastPanel in front of Apache
Nginx ignores .htaccess. Before installing, your host must configure it to allow only the root index.php and public directory, deny private/hidden files and deny direct public/uploads access. The required configuration is in the uploaded docs/hosting.md file, which you can read locally or send to your host. A correctly protected site deliberately does not serve that private documentation file.
Do not install if the protection check fails. The check identifies the document-root layout and verifies a public control before requesting harmless shipped probe files. Marker exposure is a confirmed security failure; redirects, generic 200/error pages, timeouts or unknown mappings are inconclusive. Read each path/status diagnostic, correct the indicated rule or mapping, then select Retry verification. Private probes need direct 403/404 denials, without redirects. It is a sample check, not proof of every server rule. Confirm the rules and verify private URLs are denied before continuing. It never needs to download your actual .env, database or customer files.
Application URL
Use this public directory’s address, without the filename: https://example.com/public, or https://example.com/shop/public inside a subdirectory. Keep that public prefix for media and Stripe callbacks. If your host already exposes only public/, use https://example.com. The recommended public-only setup continues working unchanged.
Existing installations need only the new entry/protection files; keep the same APP_URL, application key, sessions, Stripe secrets and database. No migration or reinstall is required.