Identify the configured filesystem disks, the hosting account symlink policy and the classification of existing files. Back up user uploads separately from the application release.

1. Choose which uploads are public. Store private documents on a private disk and serve them through an authorised application route or another controlled delivery mechanism.

2. Configure the public disk and its URL for the production site. Review the actual paths rather than assuming every application uses the default storage arrangement.

3. Create the framework storage link using the deployment method allowed by the server. If symlinks are restricted, ask for a supported storage arrangement instead of linking the whole storage directory.

4. Keep persistent uploads outside disposable release directories or attach the same approved storage to each release. A code rollback must not delete files uploaded since deployment.

5. Restrict accepted file types and prevent uploaded content from being treated as executable application code. Apply appropriate ownership and upload limits.

For Laravel's default local public disk, review config/filesystems.php first: public/storage should link to storage/app/public, not to the entire storage directory. The command also creates additional links configured in that file, so inspect all of them before running it.

php artisan storage:link

Run this from the intended release as its hosting user only when the server permits the required symlinks. Test a harmless image stored on the public disk through its expected /storage/ URL. A private test document must remain inaccessible through a raw public URL and should require the application's authorization flow.

If a link already exists or is wrong, inspect its target and preserve any real directory contents before correcting it through the approved deployment process. Do not recursively delete an existing directory simply to make the command succeed.

Upload a harmless public image and verify its URL as a visitor. Upload a private test document and confirm its raw storage location cannot be fetched without the required authorization.

A broken image can result from a wrong disk URL, missing link, incorrect permissions or absent persistent files. Compare those layers before changing all storage permissions.

• Fixing Laravel log and cache write permissions
• Planning a Laravel release rollback
• Keeping temporary uploads from filling application storage
• Checking Laravel health without exposing private data

• Laravel filesystem storage