Install SixPreflight
Installing SixPreflight means copying one folder onto your server and opening it in a browser. There is nothing to configure before you start, and nothing to install alongside it — no Composer, no npm, no database migration. Five minutes after you upload it, you have a verdict on whether your server is ready.
Where the folder goes
Two locations work, and SixPreflight finds your application by walking up from itself to whichever folder holds artisan. The result is identical either way.
| Location | When to use it |
|---|---|
<laravel-root>/public/preflight/ | The straightforward choice. On a correctly configured server the document root is public/, so a folder here is reachable by URL with no web-server changes at all. |
<laravel-root>/preflight/ | Beside artisan and .env. Only reachable by URL if the document root points at the application root — which is itself the most serious thing SixPreflight looks for. |
| Any web folder, on its own | Standalone mode. No application, no .env; every server-level check still runs. |
If you are unsure, use public/
It is the location that works without touching the web server. Do not move your document root up to the application root just to make the other location reachable — that publishes your .env file, and with it your database password, APP_KEY and every payment secret. SixPreflight will flag exactly that as a finding you must fix.
If .env cannot be read, SixPreflight says so at the top of the page and tells you which situation you are in: a Laravel root where the file is unreadable, or a folder that is not inside an application at all.
Set a password on the first screen
There is nothing to edit before you start. The folder ships with no password set; the first time you load the page, it asks you to choose one. Setting it signs you in.
- Upload the folder — see where the folder goes, above. Nothing to configure.
- Open it in a browser —
https://your-domain.com/preflight/. - Choose a password — minimum eight characters. That is the whole setup. It works from a phone, and from an account with FTP but no shell.
Whoever loads that page first claims the tool
Until a password is set, the setup screen is open to anyone who reaches the URL. Set it as soon as the folder is uploaded, and delete the folder once you are done with it — see Troubleshooting.
If the folder is not writable
If the web server cannot write to the folder, the password cannot be saved from the browser — and SixPreflight tells you that rather than accepting a password it would then lose. Either make the folder writable, or set the password by hand as a fallback:
php -r 'echo password_hash("your-password", PASSWORD_DEFAULT), "\n";'Paste the result into config.php as password_hash and reload the page.
Your first scan
Two buttons, once you are signed in:
| Button | What it does | Takes |
|---|---|---|
| Check now | The local checks — reads configuration on this machine and looks up the server's public IP. Nothing leaves the machine except that one lookup. | a second or two |
| Deeper check | Adds the checks that make outbound calls: real HTTP requests to your own public URL to see what the internet can reach, and a live test of each credential — Maps, SMTP, Firebase, reCAPTCHA, storage, SMS. | about ten seconds |
Run Deeper check before you launch, and again after any change to DNS, certificates or credentials. Run Check now any time you change a setting and want to see whether it took.
The page itself runs no checks — it opens instantly, then asks for one step at a time. So it loads fast even on a server that is struggling, and one slow step cannot take the whole page down. A scan interrupted halfway is still readable afterwards.
Restrict access by IP (optional)
Add an allow-list in config.php if you want to limit who can even reach the sign-in screen:
'allow_ips' => ['203.0.113.4', '198.51.100.0/24'],Behind Cloudflare or a load balancer, this can lock you out
The address SixPreflight sees is the proxy's, not yours, so a list holding your own IP matches nothing. Leave allow_ips empty and rely on the password, or restrict at the proxy instead. If you are already locked out, the 403 page prints the address that actually arrived.
For the full picture on how SixPreflight protects itself, see Security and privacy.
Next: run it, then read the result
Once your first scan finishes, the page you land on explains what happened and what to do about it — see Reading the report.