How to Clean a Hacked Laravel Application and Remove Backdoors

A compromised Laravel application calls for a developer's eye, because the framework's structure and your custom code both need checking. The goal is to find injected code and backdoors, rotate your secrets, and patch the vulnerability — whether it came in through a dependency, a file upload, or exposed credentials.

Step 1: Secure secrets and access

Change your cPanel, database and FTP passwords, and rotate the application's secrets: generate a new APP_KEY, and change any API keys and database credentials in your .env. Take a full backup first.

Step 2: Confirm .env is not exposed

A publicly accessible .env file is a serious leak. Ensure it sits outside the web root and cannot be reached in a browser — the app should serve only from the public folder, as covered in installing Laravel on cPanel.

Step 3: Find injected code and backdoors

Scan the account — see scanning with Imunify360 — and review recently modified files, unexpected routes or controllers, and the storage and public folders for uploaded PHP. Hunt specifically for webshells and backdoors.

Step 4: Verify dependencies and code

Compare your codebase against version control to spot unauthorised changes. Review composer.json and installed packages, and reinstall dependencies from trusted sources. Check the database for injected data.

Step 5: Patch and redeploy cleanly

Update Laravel and all packages, fix the flaw (an unvalidated upload, an outdated dependency, exposed credentials), and redeploy from clean code via Git. Finish with the hardening checklist.

Frequently asked questions

How do attackers usually get into Laravel apps?

Common routes include exposed .env files, outdated dependencies with known vulnerabilities, unvalidated file uploads, and debug mode left on in production. Address these and you close most gaps.

Should I have debug mode on?

Never in production — APP_DEBUG should be false live, as debug output can leak sensitive details. Set the environment to production and keep debug off.

Version control makes this easier — why?

With Git you can diff your live files against known-good code to instantly spot injected changes, then redeploy a clean version. It turns a guessing game into a precise cleanup.