We have git installed on our webserver (via cpanel), but unfortunately no CI- / Deployment-Tools.

Would it be good practice just initialise our repository in /public_html/ and push our local Dev-branches into the Master-Branch there instead of having an extra repository-directory on the server and 'deploy' the project manually?

Thank you in advance for your replies.

  • 1
    So, can I just git clone http://yoursite.com/path/to/.git and download your whole site? If so, that's bad. Really bad. Anyone can get the entire source code history, including names and email addresses of your developers. For this reason alone I would separate code repository from deployment. Feb 8, 2019 at 0:28
  • This is a good point, I wasn't aware of. I tried to clone the repositiory, but it seems that .git is protected by .htaccess.
    – Hendrik
    Feb 8, 2019 at 8:03

3 Answers 3


It is not enough to push the changes, you also need to check them out of the repository. For that, you need a script. And then that script already becomes a "deployment tool".

If that is really all you need, then go for it.

Most projects need something more, e.g. database migrations, lock-step changes to services the web app depends on, etc. In that case, it makes sense to use deployment / orchestration tools to ensure that all services are on the correct version.


In simple scenarios this can be totally fine. But there are a couple of caveats:

  • Make sure that the .git folder and other configuration files cannot be accessed through the web server.
  • Deploying your source code becomes insufficient as soon as your web project requires a build process prior to deployment, e.g. a CSS preprocessor, JS minifier, …. Some projects might also need to restart services upon deployment.

It is therefore usually better to figure out a proper deployment solution up front. A good solution to get started is to have a separate build server for testing, and write a script that automatically SSHs into the production server to perform the deployment. You could also create specific artifacts that created by your build process and then deployed, for example a ZIP archive or Docker image.

  • Thank you for your reply. Our project containts front- and backend parts, but I haven't thought about preprocessors or minifiers.
    – Hendrik
    Feb 7, 2019 at 15:27
  • 1
    Another good thing to note is developer specific documentation is often kept in source code repositories, and that documentation (which would be seen as "internal" information to your organization) would then be publically available. Feb 8, 2019 at 12:26

Can I perform deployments with my version control system?


If the repository contains things that can safely live in public_html, go for it. I follow this practice with my personal sites (except I don't use cpanel). I keep them up-to-date with cron. As you said, it's incredibly easy to set up and maintain. CI/CD servers add complexity. If you don't need the complexity, don't introduce it.

I've also done this on small professional teams. Though, I don't recommend this long term on growing teams or projects. Things get more complex over time, and you'll likely outgrow this as a viable solution.

  • Thanks for your reply. What are youre experience with managing (third-party-)libraries or frameworks? Would this be speak for a more advanced deployment strategy?
    – Hendrik
    Feb 7, 2019 at 15:31
  • On my personal projects, I just minimize my dependencies. I don't even use package managers. My very few dependencies are copied locally and manually updated. (This has advantages, IMO.) As soon as you need to deploy "artifacts" instead of code, you need a build system. You can do that manually with a separate "builds" repo/branch, if you want. Or introduce a build system. Or roll your own: A cron job that pulls, builds, and copies artifacts to the docroot. etc. Do what works. Don't over-engineer. Just get over it and take a CI/CD tool off the shelf if you need to ...
    – svidgen
    Feb 7, 2019 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.