Confirm the intended HTTPS hostname, any subdirectory and the application configuration mechanism. Keep the previous configuration for recovery without exposing secrets.

1. Create the environment configuration from the project template and set the application to production using the supported CodeIgniter environment setting.

2. Set the base URL to the canonical site address, including the required path when the application is deliberately installed below a subdirectory.

3. Configure database and other service values privately. Check quoting and special characters according to the framework configuration format.

4. If TLS terminates at a trusted proxy, configure the framework and web server to recognise that deployment correctly. Avoid accepting arbitrary client-supplied proxy information.

5. Restart or refresh the relevant runtime through the supported hosting controls, then clear only application caches affected by the change.

For a CodeIgniter application intentionally published at https://example.com/portal/, these non-secret entries belong in its protected project .env. Keep the existing database values separate and preserve a copy of the previous configuration before editing.

CI_ENVIRONMENT = production
app.baseURL = 'https://example.com/portal/'

The trailing slash and subdirectory describe the public location used to generate links. They do not move files or configure the web server by themselves. Confirm the domain or alias maps the public directory to this same path. If configuration caching is enabled, refresh it through the method supported by the installed CodeIgniter version.

Expected result: A generated link, login redirect and CSS request all retain HTTPS and the /portal/ prefix. An intentionally missing route returns a controlled production error without a development traceback.

Test a generated link, redirect, form submission and login cookie from the public HTTPS address. Verify an unknown route returns a controlled error without a development stack trace.

Redirect loops can come from conflicting HTTPS rules or a proxy scheme mismatch. Incorrect asset URLs may instead indicate a wrong base path. Inspect the actual redirect chain before adding more rules.

• Setting a safe document root for CodeIgniter 4
• Troubleshooting CodeIgniter 4 writable paths and logs
• Using environment variables consistently across web and CLI
• Testing an API integration in a separate environment

• CodeIgniter configuration: Configuration
• CodeIgniter deployment

• CodeIgniter configuration: Configuration
• CodeIgniter environment selection