For security, only the public folder should be reachable from the web. In cPanel, set the domain's document root to /home/user/yourapp/public. In Plesk, change Document root in Hosting Settings. If your host does not allow changing it, upload the product as supplied: the root .htaccess file forwards requests to public and blocks access to everything else.