Publish a website on cPanel without exposing private files

A deployment checklist for static builds and PHP sites, with backup and real-form verification.

Check the hosting requirements first

Identify whether the project is a static website, a PHP application or an application needing a running server. Confirm that the hosting package supports it. For a frontend build, publish the output produced by the build command, not an entire development folder containing dependencies and private configuration.

Prepare a release

Run the production build and the checks appropriate to your project. Review environment settings and remove test-only content. Keep database passwords, mail credentials and server keys out of public files and frontend bundles. A frontend variable embedded during a build should be treated as public.

Back up the current site

Before replacing an existing website, keep a private copy of its files and database. Know how you would restore them. Do not overwrite another application or an existing business mailbox while assuming the hosting account is empty.

Upload to the correct location

Confirm which domain and document root you are deploying to.
Upload the required production files using the host's supported secure method.
Keep server configuration and private backups outside the public document root.
Create and configure a database only when the application needs one.
Set up route rewriting when a single-page application requires it.
Apply a reviewed database migration; do not re-run an installer over live data.

Verify the live site

Open the site in a fresh browser session. Test direct links to internal pages, not just navigation from the homepage. Check HTTPS, phone layouts, missing assets and useful error messages. Submit a clearly labelled form test to your own inbox rather than to a real customer.

Verify the business outcome

An email accepted by the server is not proof that it reached an inbox. Check delivery records and the actual test inbox. Payment and account actions need similar end-to-end checks. Keep rollback files until the release is verified.

Keep improving deployment

Use version control and a repeatable release process. Deploy the same build you tested, preserve live data and document how to undo a failed release.