The summary.
WHAT THE FRAMEWORK BUYS YOU
Routing, database access, templating, authentication, validation, queues and scheduling — plus security defaults.
Escaping, request protection and password hashing are on by default, which beats protection by discipline.
ONLY ONE DIRECTORY IS MEANT TO BE PUBLIC
Everything else — configuration, code, data — sits outside it. That arrangement must be adapted for cPanel hosting.
READ CONFIGURATION, NOT THE ENVIRONMENT, IN YOUR CODE
Cached configuration does not read the environment file. Reading it directly outside configuration files makes values mysteriously empty in production.
KEEP CONTROLLERS SHORT
Validate in a dedicated request class, put the work in dedicated classes, and return a view, a redirect or data.
A few lines per action is normal in well-structured applications.
VALIDATION IS NOT AUTHORISATION
Always also check the signed-in user is entitled to act on the record they named.
DEVELOP LOCALLY, NOT ON THE LIVE SERVER
Debug mode on locally, off everywhere else. Always.
WHEN SOMETHING IS WRONG
Look in the log directory first.
