should we use the .env file in production as well, and how to protect it

many users suggest to move the files from the public to the root folder where .env lives

Do not do that, setup like @taylorotwell has in documentation for shared, or one alternative is have main laravel out of public_html, see:

http://novate.co.uk/deploy-laravel-5-on-shared-hosting-from-heart-internet/

If something like digitalocean, they have guides.

@halim

The correct, secured Laravel folder structure should be:

└── blogapp             <- 1. Laravel root folder, DocumentRoot CANNOT point here
    ├── public          <- 2. DocumentRoot MUST point here, i.e. https://yourdomain.com
    │   └── robots.txt  <- 3. MUST be able to load https://yourdomain.com/robots.txt
    ├── .env
    ├── storage
    ...
    └── vendor

If for whatever reason you must follow the tutorial found here http://novate.co.uk/deploy-laravel-5-on-shared-hosting-from-heart-internet/

Then please structure the this way

├── public_html         <- 2. DocumentRoot MUST point here
│   └── blog            <- 3. move and rename `public` as `blog`, https://yourdomain.com/blog
│       ├── robots.txt  <- 4. MUST be able to load https://yourdomain.com/blog/robots.txt
│       └── index.php   <- 5. Must modify this index.php
└── blogapp             <- 1. Laravel root folder, DocumentRoot CANNOT point here
    ├── .env
    ├── storage
    ...
    └── vendor

I always use .env

I always make sure that only the public folder can be accessed from the outside.