Start with the application dependency contract
Use composer.json and the lock file to identify required PHP versions and extensions. Do not assume the PHP executable on a developer machine matches the IIS FastCGI runtime. The deployment package needs production dependencies and built frontend assets.
Consult the deployment documentation for the Laravel version in use. Test packages that depend on Linux-specific processes, paths or system tools on Windows. A control panel setting cannot compensate for an incompatible application dependency.
Separate published and writable directories
| Location | Expected treatment |
|---|---|
| public | Published entry point and static assets. |
| .env and application source | Outside the directly served web root; production values survive updates. |
| storage and bootstrap/cache | Required write access for the application identity. |
| User uploads | An explicit access policy and protection against script execution. |
Verify routing and effective configuration
Test a real Laravel route and a nonexistent path in addition to the homepage. An Apache .htaccess file is not an IIS routing configuration; the IIS rules must match the application entry point.
Keep detailed error display disabled in production. Preserve the existing application key and environment file during updates; arbitrary key replacement can affect encrypted data. Refresh cached configuration as part of deployment and verify effective settings without exposing secrets.
Treat workers as independently operated processes
- List operations that run outside HTTP requests, including notifications, reports and media processing.
- Record the PHP executable, working directory, account and environment for each job.
- Identify any existing Windows service or scheduled task. Choose one process owner rather than starting the same worker from competing managers.
- Submit a harmless test job and confirm completion and visible failure handling. A working website does not prove that its worker is healthy.
Check the entire publishing boundary
Exercise login, sessions, a database write, file upload and a background job. Confirm that .env and private storage are not downloadable through public URLs. A missing route should return a real 404 status as well as a suitable error page.
Plan database recovery before a release that changes schema. Prevent staging from sending real mail, charging payments or firing production webhooks. Record the tested package and date so the next deployment can repeat the same acceptance checks.
Frequently asked questions
Should the IIS site point at the Laravel project root?
Use public as the web root. Keep source code and .env outside the directly published directory instead of relying on an accidental file-serving restriction.
Is .htaccess enough for IIS?
No. IIS does not automatically apply Apache rules. Verify the IIS routing configuration using actual application routes.
Why can the site work while queued jobs fail?
The HTTP application and queue worker are separate processes. Check the worker account, PHP executable, environment and error log independently.
Should an update replace .env?
Preserve the current production configuration. Add required new settings deliberately instead of copying a sample file over the live environment file.