How to Deploy Shopware 6 to Production

Deploying Shopware 6 to a production environment is fundamentally different from setting up a local development instance. While development prioritizes convenience and hot-reloading, production demands security, performance, and reliability. With Shopware 6.7, the platform introduces stricter environment validation, an upgraded asset compilation pipeline, and refined CLI tools that streamline deployment but require precise configuration. This guide walks you through a production-ready deployment process tailored for Shopware 6.7 and beyond, focusing on architectural best practices rather than rote commands.

Prerequisites & Server Hardening#

Before touching the codebase, your infrastructure must meet modern e-commerce demands. Shopware 6.7 officially supports PHP 8.1 through 8.3, with 8.2+ strongly recommended for optimal JIT compilation and extended type safety. Pair this with MySQL 8.0+ or MariaDB 10.5+, Nginx 1.24+, Composer 2.x, Node.js 18+, and Yarn 4.x. Disable SELinux or AppArmor overrides that might block PHP-FPM execution, and ensure fileinfo, intl, mbstring, pdo_mysql, zip, and opcache extensions are active. Create a dedicated non-root user (e.g., shopware) for process ownership, and establish a structured directory layout where only files/, var/cache/, and var/log/ require write permissions.

Step 1: Extract & Install Dependencies#

Upload your Shopware 6.7 archive to the target directory and extract it. Avoid cloning directly from GitHub unless you intend to maintain a custom fork; use official release archives or private Composer repositories for enterprise deployments. Run the following command to install production dependencies:

composer install --optimize-autoloader --no-dev --classmap-authoritative

The --optimize-autoloader flag builds a class map, drastically reducing autoloading overhead during request handling. --classmap-authoritative skips runtime filesystem checks entirely, while --no-dev strips testing and debugging packages that would otherwise bloat memory usage. After installation, verify the vendor/ directory contains only required packages by listing its contents.

Step 2: Environment Configuration#

Shopware 6.7 enforces strict environment separation. Copy .env to .env.prod and explicitly set production flags:

APP_ENV=prod
APP_DEBUG=0
APP_SECRET=<generate-secure-string>
DATABASE_URL="mysql://user:password@localhost/shopware_db?serverVersion=8.0"
APP_TRUSTED_PROXIES="127.0.0.1,REMOTE_ADDR"
APP_DEFAULT_LOCALE=en-GB

Never hardcode secrets in version control. In production, inject values via server environment variables, Docker secrets, or a dedicated secret manager. Shopware 6.7’s bootstrap process validates these variables during bootstrapping; missing or malformed entries will trigger early exceptions. Set APP_TRUSTED_PROXIES to match your load balancer or reverse proxy IP ranges to ensure correct client IP detection for analytics and fraud prevention.

Step 3: Database Migration & Cache Warmup#

Create a clean database with strict SQL mode enabled. Run migrations using the CLI:

bin/console database:migrate --all

Shopware 6.7 introduces stricter schema validation during migration execution. If your MySQL server lacks STRICT_TRANS_TABLES, add it to my.cnf and restart the service. After successful migration, clear and warm caches:

bin/console cache:warmup --env=prod
bin/console http-cache:invalidate-path /

Cache warming precompiles configuration arrays, routing definitions, and dependency injection containers into serialized files. This shifts computation from request time to deployment time, reducing cold-start latency by up to 40% on large catalogs. Invalidate the HTTP cache afterward to ensure frontend edge layers fetch fresh data.

Step 4: Asset Compilation#

Modern storefronts in Shopware 6.7 leverage a Vite-based compilation pipeline. Execute:

composer run build:assets --env=prod

This command minifies JavaScript, optimizes CSS, generates versioned file hashes, and outputs production-ready bundles to public/build/. Source maps are intentionally omitted in production mode to prevent exposure of internal module paths. Verify the output directory contains .map files only if you enable debugging temporarily for troubleshooting. Never commit compiled assets to version control; generate them fresh per deployment to match your current codebase state.

Step 5: Permissions & Security Hardening#

File permissions dictate system stability and security posture. Set ownership to your web server user (typically www-data or nginx):

chown -R www-data:www-data /path/to/shopware
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 775 files/ var/cache/ var/log/

Remove .git, tests/, doc/, and any vendor symlinks. Disable directory listing in your web server configuration and restrict access to sensitive endpoints. Enable HTTPS with HSTS, configure Content-Security-Policy headers, and disable debug mode completely. Shopware 6.7 includes built-in rate limiting and CSRF protection that only function when APP_DEBUG=0 and proper trusted proxies are configured.

Web Server Configuration & Performance Tuning#

Nginx is the recommended web server for Shopware 6.7. Point your virtual host root to public/ and route all requests through the front controller:

location / {
    try_files $uri /index.php$is_args$args;
}

location ~ ^/index\.php {
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    include fastcgi_params;
    fastcgi_param DOCUMENT_ROOT /path/to/shopware/public;
    fastcgi_param SCRIPT_FILENAME /path/to/shopware/public/index.php;
}

Enable OPcache with opcache.memory_consumption=256, opcache.interned_strings_buffer=8, and opcache.validate_timestamps=0 in production. Tune PHP-FPM to use pm.dynamic with appropriate max_children based on available RAM. Store sessions in Redis or Memcached instead of files, and configure Shopware’s framework.session.save_path accordingly.

Production Verification & Ongoing Maintenance#

Before exposing the store to traffic, run:

bin/console production:check

This diagnostic tool validates environment variables, file permissions, PHP extensions, database connectivity, and SSL configuration. Fix all warnings before proceeding. Set up cron jobs for scheduled tasks:

* * * * * cd /path/to/shopware && bin/console core:system-config:get > /dev/null 2>&1
*/5 * * * * cd /path/to/shopware && bin/console taskrunner --env=prod

Monitor with APM tools like New Relic or Datadog, enable CDN offloading for media assets, and implement automated backups for both database and files/ directory. Update Shopware core monthly, run dependency audits quarterly, and always test upgrades in staging first.

Conclusion#

Deploying Shopware 6 to production is less about following a rigid checklist and more about understanding how the framework processes requests, manages state, and compiles assets under load. Shopware 6.7’s refined CLI ecosystem, stricter environment validation, and modern asset pipeline reward precise configuration with exceptional performance and resilience. By prioritizing secure permissions, optimized caching, proper web server routing, and continuous monitoring, you lay a foundation that scales gracefully with traffic and catalog growth. Double-check your configuration, validate SSL termination, and launch with confidence—your e-commerce infrastructure is now production-ready.