A Basic Security Checklist for Laravel Applications

Laravel provides many protections out of the box, but security remains the developer's responsibility. The good news is that most gaps in small apps come from basics that are easy to check. Use this list before anyone else touches your app.

1. Turn Off Debug in Production

Laravel's detailed error page is very helpful while developing, but dangerous in production because it can leak paths, queries, and even credentials. Make sure:

APP_ENV=production
APP_DEBUG=false

2. Use Strong Credentials

Do not let a production database use the root user with no password. Create a dedicated user with only the privileges it needs and a long random password. Also confirm APP_KEY has been generated so encryption works.

3. Always Validate Input

Every piece of user data must be validated before processing. Laravel makes this easy:

$request->validate([
    'email' => 'required|email',
    'price' => 'required|numeric|min:0',
]);

Validation prevents corrupt data and closes part of the attack surface.

4. Do Not Disable CSRF Protection

Laravel automatically protects forms from Cross-Site Request Forgery. As long as you include @csrf in every form, this protection works. Avoid excluding routes from the CSRF middleware unless truly necessary (for example webhooks, which have their own verification).

5. Beware of Mass Assignment

Define which columns may be mass-filled via $fillable. Without it, a malicious user could submit unexpected fields (e.g. is_admin) through a form:

protected $fillable = ['name', 'email', 'price'];

6. Prevent Leaks Through Queries

Eloquent and the Query Builder already use prepared statements, so they are safe from SQL injection — as long as you do not splice raw input into DB::raw(). If you must use a raw query, use parameter binding, not string concatenation.

7. Enable HTTPS and Secure Cookies

Install an SSL certificate and force all traffic to HTTPS. This protects credentials and session cookies from being intercepted on the network.

8. Update Dependencies Regularly

composer update
composer audit

The audit command checks whether any library has known vulnerabilities. Schedule regular checks, especially after an app has been running for a while.

9. Limit Login Attempts

Apply rate limiting to the login form to avoid password-guessing attacks. Laravel provides throttling you can attach to a route or controller.

This checklist is not an absolute guarantee, but it closes the majority of the gaps most often exploited in small to medium apps. Make these checks a routine part of every release.

Browse Apps Read Blog All Guides