Deploy a PHP + MySQL site safely

Before you upload

Confirm the host's PHP version, pdo_mysql availability, mbstring extension, Apache rewrite support and HTTPS configuration. Back up existing files and database before replacing a live installation.

Keep secrets out of the public tree

Store DB credentials in a local configuration file blocked from direct web access. Never commit passwords, API tokens or .env files to public repositories. If hosting restrictions force configuration inside the document root, add explicit server access-deny rules and test them.

Use parameterized queries

Do not concatenate visitor input into SQL. A minimal PDO example:

$pdo = new PDO($dsn, $user, $password, [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false,
]);
$stmt = $pdo->prepare('SELECT id, name FROM products WHERE slug = ?');
$stmt->execute([$slug]);
$product = $stmt->fetch(PDO::FETCH_ASSOC);

Launch checklist

• Point the domain document root to the intended folder.
• Import SQL after selecting the correct database.
• Enable HTTPS; redirect HTTP to HTTPS at the host/proxy layer.
• Confirm direct requests to configuration and backup files are denied.
• Verify form CSRF checks, output escaping, uploads and login rate limits.
• Open /robots.txt and /sitemap.xml after deployment.

Operational notes

Set appropriate file permissions and inspect PHP error logs rather than displaying stack traces to visitors. Test backup restoration, not only backup creation. Follow your hosting provider's documentation for available extensions and cron support.