Laravel is a popular framework developers use to build websites. If a Laravel website sends email through your Titan account and is accidentally left in "debug mode" after launch, anyone online can view its stored passwords — including your Titan email password. This article shows you how to check for this issue and fix it.
This applies to you if you (or a developer you work with) manage a Laravel-based website that sends email using your Titan SMTP credentials — the username and password Titan gives you to send email through your website.
Check if debug mode is exposing your data
Debug mode is a setting developers turn on while building a website, so they can see detailed error information. It's meant to be turned off before the website goes live. If it's left on, a file containing your website's passwords and other private settings becomes publicly visible.
| alert-warning | If the check below shows your data is exposed, anyone who finds the URL can see your passwords immediately. Move on to the fix as soon as you confirm the issue. |
- In your browser's address bar, type your website's address followed by
/.env(for example,https://yourdomain.com/.env). - Press Enter to load the page.
If debug mode is off, you'll see an error page, such as "404 Not Found." If debug mode is on, you'll see a plain text page listing sensitive details like passwords and database information, similar to the example below.
Turn off debug mode
- Open your Laravel project's
.envfile. You'll find it in your project's root folder. - Find the line that starts with
APP_DEBUG. - Change the value on that line to
APP_DEBUG=false. - Save the file, then re-deploy your website if your hosting setup requires it.
The next time you load yourdomain.com/.env in your browser, you'll see an error page instead of your data. This confirms debug mode is off.
| alert-success | If your website is hosted on cPanel, also change the .env file's permissions from 0644 to 0640. This stops other accounts on the same server from reading the file directly. |
For more detail on managing this setting, see Laravel's official documentation on debug mode.
Troubleshooting
Problem: The /.env page is still visible after I set APP_DEBUG=false.
Cause: Your website may be showing a cached version of your settings, or your update hasn't been deployed yet. Fix: Clear your Laravel configuration cache (developers can run php artisan config:cache), or check with your hosting provider that the update has gone live. Then reload the /.env URL to test again.
Problem: I can't find the .env file in my project.
Cause: Files that start with a dot are hidden by default in most file managers and FTP clients.
Fix: Turn on the "show hidden files" option in your file manager or FTP client to see it.
Problem: My website's debug mode was on before I found this article.
Cause: If your .env file was publicly visible, anyone could have copied your Titan email password during that time.
Fix: Reset your Titan email password right away, then update it in your website's settings so email sending keeps working.