<p>So the way I'd recommend doing it is that you use <code>.gitignore</code> to exclude your <code>/vendor</code> directory from the repo; a good starter <code>.gitignore</code> file can be found here: <a href="https://github.com/nystudio107/craft-scripts/blob/master/example.gitignore" rel="noreferrer">https://github.com/nystudio107/craft-scripts/blob/master/example.gitignore</a></p>

<p>Then you'll work on it in local dev, update Craft/plugins in local dev, and on deploy to production have it do <code>composer install</code> to update your <code>/vendor</code> dir to match what is is your <code>composer.lock</code> file.</p>

<p>The article <a href="https://nystudio107.com/blog/setting-up-a-craft-cms-3-project" rel="noreferrer">Setting up a New Craft CMS 3 Project</a> covers this in the <strong>DEPLOYING CRAFT CMS</strong> section.</p>

<p>You also might want to get a workflow set up for syncing the database and assets as per the <a href="https://nystudio107.com/blog/database-asset-syncing-between-environments-in-craft-cms" rel="noreferrer">Database &amp; Asset Syncing Between Environments in Craft CMS</a> article.</p>

CC BY-SA 3.0
2018-01-23T13:07:17.067Z
Hi Andrew thanks for your detailed answer. Yes, I read this article carefully and I am already aware how to use gitignore. Since I can't push the repro to the production server I just want to get sure that this is the right way: Working on local dev (using gitignore with git to store a save copy) and then during production use composer install and upload the entire local folder (with vendors, env.file etc. etc.) to my shared server where the domain points to the /web folder avoiding to grant access to the sensitive files (env.file, db.php etc.)?
Pascal G.
CC BY-SA 3.0
2018-01-23T23:52:47.587Z
Yep, that's correct!
andrew.welch
CC BY-SA 3.0
2018-01-23T12:57:04.247Z
2018-01-23T12:57:04.247Z
andrew.welch
<p>I am new to Craft 3 and never set up a local environment with composer, bitbucket and gulp. So I dived into all these things to get my hands on Craft 3. At the moment I am using a shared hosting without a ssh access so I have to deploy my site by using FTP Upload. Is it correct that I just need to upload the entire Craft folder with all its subcategories (/vendors, /config, /modules etc. etc.) after development to the production server and then just to adapt the .env file?</p>

<p>I am a little bit curious about this, since it is recommended not to upload some of the sensitive folders with access to a repo. I know that this due to the fact that nobody should see your logins public. This does not apply for the production server? If I point my subdomain to the /web folder with its index.php on the production server everything should be fine? Just want to be sure.</p>

<craft3><installation><deployment>
Development – deployment environment
# Development – deployment environment

(Asked by: username_0 on 2018-01-23)

I am new to Craft 3 and never set up a local environment with composer, bitbucket and gulp. So I dived into all these things to get my hands on Craft 3. At the moment I am using a shared hosting without a ssh access so I have to deploy my site by using FTP Upload. Is it correct that I just need to upload the entire Craft folder with all its subcategories (/vendors, /config, /modules etc. etc.) after development to the production server and then just to adapt the .env file?

I am a little bit curious about this, since it is recommended not to upload some of the sensitive folders with access to a repo. I know that this due to the fact that nobody should see your logins public. This does not apply for the production server? If I point my subdomain to the /web folder with its index.php on the production server everything should be fine? Just want to be sure.

**Tags:** craft3, installation, deployment


---

## 1 answers

### Answer by username_1 on 2018-01-23. Score: 5 | Accepted answer

So the way I'd recommend doing it is that you use `.gitignore` to exclude your `/vendor` directory from the repo; a good starter `.gitignore` file can be found here: <https://github.com/nystudio107/craft-scripts/blob/master/example.gitignore>

Then you'll work on it in local dev, update Craft/plugins in local dev, and on deploy to production have it do `composer install` to update your `/vendor` dir to match what is is your `composer.lock` file.

The article [Setting up a New Craft CMS 3 Project](https://nystudio107.com/blog/setting-up-a-craft-cms-3-project) covers this in the **DEPLOYING CRAFT CMS** section.

You also might want to get a workflow set up for syncing the database and assets as per the [Database & Asset Syncing Between Environments in Craft CMS](https://nystudio107.com/blog/database-asset-syncing-between-environments-in-craft-cms) article.

> **Comments:**
> **username_0**: Hi Andrew thanks for your detailed answer. Yes, I read this article carefully and I am already aware how to use gitignore. Since I can't push the repro to the production server I just want to get sure that this is the right way: Working on local dev (using gitignore with git to store a save copy) and then during production use composer install and upload the entire local folder (with vendors, env.file etc. etc.) to my shared server where the domain points to the /web folder avoiding to grant access to the sensitive files (env.file, db.php etc.)?  
> **username_1**: Yep, that's correct!  

---

