Deployment

    You are encouraged to create a git commit and pull or clone that commit orrepository on your server and run .While this requires some knowledge about git and an existing install of gitand composer this process will take care about library dependencies and fileand folder permissions.

    Be aware that when deploying via FTP you will at least have to fix file andfolder permissions.

    You can also use this deployment technique to setup a staging- or demo-server(pre-production) and keep it in sync with your dev box.

    Adjust config/app.php

    Adjusting app.php, specifically the value of debug is extremely important.Turning debug = false disables a number of development features that shouldnever be exposed to the Internet at large. Disabling debug changes the followingtypes of things:

    • Debug messages, created with , and aredisabled.
    • Core CakePHP caches are by default flushed every year (about 365 days), instead of every10 seconds as in development.
    • Error views are less informative, and give generic error messages instead.
    • Exception stack traces are disabled.
      In addition to the above, many plugins and application extensions use debugto modify their behavior.

    For example, you can set an environment variable in your Apache configuration:

    And then you can set the debug level dynamically in app.php:

    If you’re throwing your application out into the wild, it’s a good idea to makesure it doesn’t have any obvious leaks:

    • Ensure you are using the Cross Site Request Forgery component or middleware.
    • You may want to enable the component.It can help prevent several types of form tampering and reduce the possibilityof mass-assignment issues.
    • Ensure your models have the correct Validation rulesenabled.

    Set Document Root

    Setting the document root correctly on your application is an important step tokeeping your code secure and your application safer. CakePHP applicationsshould have the document root set to the application’s webroot. Thismakes the application and configuration files inaccessible through a URL.Setting the document root is different for different webservers. See theURL Rewriting documentation for webserver specificinformation.

    Class loading can take a big share of your application’s processing time.In order to avoid this problem, it is recommended that you run this command inyour production server once the application is deployed:

    Since handling static assets, such as images, JavaScript and CSS files ofplugins, through the Dispatcher is incredibly inefficient, it is stronglyrecommended to symlink them for production. This can be done by usingthe plugin shell:

    The above command will symlink the webroot directory of all loaded pluginsto appropriate path in the app’s webroot directory.

    If your filesystem doesn’t allow creating symlinks the directories will becopied instead of being symlinked. You can also explicitly copy the directoriesusing:

    Deploying an update