Malicious files found in Laravel public folder - how can I disable it ?

Hello all,

I have a website which was written in Laravel 5. I found malicious files in folders: public_html and mylaravelproject\public. I'm not sure how this happened because I don't use upload file functionality anywere. Anyway, I restored this folders from backup and now website is running fine. To avoid future issues, I deleted all contact forms and auth paths from source code so webpage is now more or less just showing static pages like About Me, etc... But that's fine because in the future I have plan to rebuild everything.

But until rebuilding, I want to run current website as it is.

Based on last modified date my conclusion is that the entry point was mylaravelproject\public folder. So, to keep the website safe until rebuilding, I want to completely disable this folder.

Please suggest how can I disable Laravel public folder (mylaravelproject\public)

If this helps, I provide some config details:

• laravel project folder is outside of public_html
• .htaccess config is like this:

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews
    </IfModule>

    RewriteEngine On

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Handle Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</IfModule>

• here is filesystems.php:

<?php
return [
    'default' => env('FILESYSTEM_DRIVER', 'local'),
// ...
    'disks' => [
        'local' => [
            'driver' => 'local',
            'root' => storage_path('app'),
        ],
        'public' => [
            'driver' => 'local',
            'root' => storage_path('app/public'),
            'url' => env('APP_URL').'/storage',
            'visibility' => 'public',
        ],
    // ...