.How do I set the document root to `/public` for Shopware 6 correctly?
Quick Answer
Shopware 6 must point the web server document root to the /public directory, not the project root. This protects sensitive files like
.env, composer.json, and internal application directories from direct browser access. The
setup changes slightly depending on whether you’re using Apache, Nginx, Plesk, cPanel, or Docker.
Before You Start
- ✦ SSH or hosting access — you need access to your server, hosting panel, or container config.
- ✦ A working Shopware 6 installation — confirm the project already exists on the server.
- ✦ Web server restart permissions — Apache and Nginx changes do not apply until reload or restart.
Locate the project root
First confirm where Shopware is installed on the server. Most setups use a structure like
/var/www/shopware or
/home/account/public_html/shopware. Inside that directory you should see folders like
bin, config, custom, and the critical
public directory.
- Open your Shopware installation folder
- Verify the public directory exists
- Note the full server path for later
Point the server to /public
Change the web server root so it ends with
/public. This is the most missed part of many Shopware deployments. If the root points one level
too high, assets may load incorrectly and private files become publicly accessible.
- Update Apache VirtualHost DocumentRoot
- Update Nginx root directive
- Save the configuration file
# Apache
DocumentRoot /var/www/shopware/public
Nginx
root /var/www/shopware/public;Update hosting panel paths
On cPanel, Plesk, or managed hosting, the document root is usually changed from the domain settings screen. Many
hosts default to
public_html or the application root automatically. You need to override that and point directly to
the Shopware public directory.
- Open the domain or vhost settings
- Replace the default root path with /public
- Save and reload the web service
Restart and verify
After changing the root path, restart or reload the web server and test the storefront. Then confirm static assets, media, and the admin panel all load correctly. If you see 403 errors, blank pages, or missing CSS, the server path is usually wrong.
- Reload Apache or Nginx
- Open the storefront homepage
- Confirm admin and media URLs work
Shopware Document Root Checklist
0 of 6 completeMistakes Most Developers Make
! Forgetting the public folder
What happens: Sensitive project files become publicly reachable.
Fix: Always end the server root path with /public.
! Editing the wrong vhost
What happens: Changes appear saved but the live domain still uses the old root path.
Fix: Verify which Apache VirtualHost or Nginx server block handles the domain.
! Skipping the web server reload
What happens: The old configuration stays active even after editing the config file.
Fix: Reload or restart Apache, Nginx, Docker containers, or your hosting stack.
Key Takeaway
The short version: your Shopware 6 web server must point directly to the /public directory or the installation is not secure. Most deployment issues come from wrong vhost paths, missing server reloads, or hosting panels silently using the wrong root. Check both storefront and admin URLs after the change, then confirm sensitive files cannot be accessed publicly. Start with Step 2—that one alone handles most of it.
Related Answers
Was this answer helpful?
Your feedback helps us improve our answers.
Still need help?
Talk to our Shopware experts
We've handled GDPR/CCPA compliance for dozens of EU & US Shopware stores.