Security

Most compromised installations are not sophisticated attacks. They are a weak admin password, an exposed installer, debug mode on production or an outdated dependency.

Baseline

HTTPS everywhere, with HSTS once the certificate is stable.
Strong, unique admin passwords stored in a password manager.
Two-factor authentication if your build or an edge proxy supports it.
No public installer, /debug route or database admin tool.
APP_DEBUG=false and APP_ENV=production.
File permissions that do not use 777.
Firewall open only on 80/443 (and your SSH port, restricted by IP).

Secrets

Keep .env, gateway keys, SMTP passwords and app signing keys out of the repository, screenshots and chat. Rotate any key that has been exposed. Use separate sandbox and live credentials, and remove sandbox keys from production.

Sessions and passwords

After a password change, other sessions should be revoked. Confirm your build uses Laravel's AuthenticateSession middleware or calls logoutOtherDevices(). If it does not, a stolen session remains valid after the victim changes the password. For API tokens, revoke existing tokens on password reset and set a short expiry.

Access control

Separate roles for admin, finance, dispatch and support.
Least privilege: support should not see payout keys or change commissions.
Remove departed staff immediately and rotate shared credentials.
Log admin actions where your build supports it.
Restrict the admin panel by IP or an edge access rule where practical.

Dependencies and monitoring

Track PHP, Laravel, Composer and npm advisories. Test updates on staging before production. Monitor the application log, failed logins, payment callback failures and disk usage. A security fix that sits unapplied is not a fix.

Incident basics

Take the site offline or block the entry point.
Preserve logs and take a forensic snapshot before cleaning.
Rotate database, gateway, SMTP and app keys.
Restore from a known-good backup if the code or database was modified.
Notify affected customers and the regulator if required by local law.

Edge protection. A WAF or CDN can block common attacks, but it does not replace patching or strong credentials. Configure it to pass payment webhooks and app API traffic without challenge.