diff --git a/gulpfile.babel.js b/gulpfile.babel.js
index 15be521a51c..08b53d17148 100644
--- a/gulpfile.babel.js
+++ b/gulpfile.babel.js
@@ -5,7 +5,7 @@ import yargs from 'yargs';
 const { argv } = yargs
   .options({
     rootPath: {
-      description: '<path> path to web assets directory',
+      description: '<path> path to public assets directory',
       type: 'string',
       requiresArg: true,
       required: false,
@@ -20,7 +20,7 @@ const { argv } = yargs
 
 const config = [
   '--rootPath',
-  argv.rootPath || '../../../../web/assets',
+  argv.rootPath || '../../../../public/assets',
   '--nodeModulesPath',
   argv.nodeModulesPath || '../../../../node_modules',
 ];
diff --git a/web/.htaccess b/public/.htaccess
similarity index 75%
rename from web/.htaccess
rename to public/.htaccess
index b52c3ef6928..99ed00df8d5 100644
--- a/web/.htaccess
+++ b/public/.htaccess
@@ -2,7 +2,7 @@ DirectoryIndex app.php
 
 <IfModule mod_rewrite.c>
     RewriteEngine On
-    
+
     RewriteCond %{HTTP:Authorization} ^(.*)
     RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
 
@@ -10,16 +10,16 @@ DirectoryIndex app.php
     RewriteRule ^(.*) - [E=BASE:%1]
 
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
-    RewriteRule ^app\.php(/(.*)|$) %{ENV:BASE}/$2 [R=301,L]
+    RewriteRule ^index\.php(/(.*)|$) %{ENV:BASE}/$2 [R=301,L]
 
     RewriteCond %{REQUEST_FILENAME} -f
     RewriteRule .? - [L]
 
-    RewriteRule .? %{ENV:BASE}/app.php [L]
+    RewriteRule .? %{ENV:BASE}/index.php [L]
 </IfModule>
 
 <IfModule !mod_rewrite.c>
     <IfModule mod_alias.c>
-        RedirectMatch 302 ^/$ /app.php/
+        RedirectMatch 302 ^/$ /index.php/
     </IfModule>
 </IfModule>
diff --git a/web/favicon.ico b/public/favicon.ico
similarity index 100%
rename from web/favicon.ico
rename to public/favicon.ico
diff --git a/public/index.php b/public/index.php
new file mode 100644
index 00000000000..10878ce556f
--- /dev/null
+++ b/public/index.php
@@ -0,0 +1,39 @@
+<?php
+
+use App\Kernel;
+use Symfony\Component\Debug\Debug;
+use Symfony\Component\Dotenv\Dotenv;
+use Symfony\Component\HttpFoundation\Request;
+
+require __DIR__.'/../vendor/autoload.php';
+
+// The check is to ensure we don't use .env in production
+if (!isset($_SERVER['APP_ENV'])) {
+    if (!class_exists(Dotenv::class)) {
+        throw new \RuntimeException('APP_ENV environment variable is not defined. You need to define environment variables for configuration or add "symfony/dotenv" as a Composer dependency to load variables from a .env file.');
+    }
+    (new Dotenv())->load(__DIR__.'/../.env');
+}
+
+$env = $_SERVER['APP_ENV'] ?? 'dev';
+$debug = (bool) ($_SERVER['APP_DEBUG'] ?? ('prod' !== $env));
+
+if ($debug) {
+    umask(0000);
+
+    Debug::enable();
+}
+
+if ($trustedProxies = $_SERVER['TRUSTED_PROXIES'] ?? false) {
+    Request::setTrustedProxies(explode(',', $trustedProxies), Request::HEADER_X_FORWARDED_ALL ^ Request::HEADER_X_FORWARDED_HOST);
+}
+
+if ($trustedHosts = $_SERVER['TRUSTED_HOSTS'] ?? false) {
+    Request::setTrustedHosts(explode(',', $trustedHosts));
+}
+
+$kernel = new Kernel($env, $debug);
+$request = Request::createFromGlobals();
+$response = $kernel->handle($request);
+$response->send();
+$kernel->terminate($request, $response);
diff --git a/web/robots.txt b/public/robots.txt
similarity index 100%
rename from web/robots.txt
rename to public/robots.txt
diff --git a/web/app.php b/web/app.php
deleted file mode 100644
index f63bb7bda8e..00000000000
--- a/web/app.php
+++ /dev/null
@@ -1,30 +0,0 @@
-<?php
-
-/*
- * This file is part of the Sylius package.
- *
- * (c) Paweł Jędrzejewski
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-declare(strict_types=1);
-
-use Symfony\Component\HttpFoundation\Request;
-
-/*
- * Sylius front controller.
- * Live (production) environment.
- */
-
-require __DIR__.'/../vendor/autoload.php';
-
-$kernel = new AppKernel('prod', false);
-
-$request = Request::createFromGlobals();
-
-$response = $kernel->handle($request);
-$response->send();
-
-$kernel->terminate($request, $response);
diff --git a/web/app_dev.php b/web/app_dev.php
deleted file mode 100644
index ec4c8458a29..00000000000
--- a/web/app_dev.php
+++ /dev/null
@@ -1,46 +0,0 @@
-<?php
-
-/*
- * This file is part of the Sylius package.
- *
- * (c) Paweł Jędrzejewski
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-declare(strict_types=1);
-
-use Symfony\Component\Debug\Debug;
-use Symfony\Component\HttpFoundation\Request;
-
-/*
- * Sylius front controller.
- * Dev environment.
- *
- * To develop on Sylius in Vagrant set the SYLIUS_APP_DEV_PERMITTED to a non zero value.
- * e.g. in apache, through your vhost configuration file:
- *
- *   SetEnv SYLIUS_APP_DEV_PERMITTED 1
- */
-if (!getenv("SYLIUS_APP_DEV_PERMITTED") && (
-    isset($_SERVER['HTTP_CLIENT_IP'])
-    || isset($_SERVER['HTTP_X_FORWARDED_FOR'])
-    || !(in_array(@$_SERVER['REMOTE_ADDR'], ['127.0.0.1', 'fe80::1', '::1', '113.0.0.1', '10.0.0.1'], true) || php_sapi_name() === 'cli-server')
-)) {
-    header('HTTP/1.0 403 Forbidden');
-    exit('You are not allowed to access this file. Check '.basename(__FILE__).' for more information.');
-}
-
-require __DIR__.'/../vendor/autoload.php';
-
-Debug::enable();
-
-$kernel = new AppKernel('dev', true);
-
-$request = Request::createFromGlobals();
-
-$response = $kernel->handle($request);
-$response->send();
-
-$kernel->terminate($request, $response);
diff --git a/web/app_staging.php b/web/app_staging.php
deleted file mode 100644
index 812810fb3c3..00000000000
--- a/web/app_staging.php
+++ /dev/null
@@ -1,30 +0,0 @@
-<?php
-
-/*
- * This file is part of the Sylius package.
- *
- * (c) Paweł Jędrzejewski
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-declare(strict_types=1);
-
-use Symfony\Component\HttpFoundation\Request;
-
-/*
- * Sylius front controller.
- * Staging environment.
- */
-
-require __DIR__.'/../vendor/autoload.php';
-
-$kernel = new AppKernel('staging', false);
-
-$request = Request::createFromGlobals();
-
-$response = $kernel->handle($request);
-$response->send();
-
-$kernel->terminate($request, $response);
diff --git a/web/app_test.php b/web/app_test.php
deleted file mode 100644
index 296ff2cd919..00000000000
--- a/web/app_test.php
+++ /dev/null
@@ -1,41 +0,0 @@
-<?php
-
-/*
- * This file is part of the Sylius package.
- *
- * (c) Paweł Jędrzejewski
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-declare(strict_types=1);
-
-use Symfony\Component\Debug\Debug;
-use Symfony\Component\HttpFoundation\Request;
-
-/*
- * Sylius front controller.
- * Testing dev-like environment.
- */
-
-if (isset($_SERVER['HTTP_CLIENT_IP'])
-    || isset($_SERVER['HTTP_X_FORWARDED_FOR'])
-    || !(in_array(@$_SERVER['REMOTE_ADDR'], ['127.0.0.1', 'fe80::1', '::1', '113.0.0.1', '10.0.0.1'], true) || php_sapi_name() === 'cli-server')
-) {
-    header('HTTP/1.0 403 Forbidden');
-    exit('You are not allowed to access this file. Check '.basename(__FILE__).' for more information.');
-}
-
-require __DIR__.'/../vendor/autoload.php';
-
-Debug::enable();
-
-$kernel = new AppKernel('test', true);
-
-$request = Request::createFromGlobals();
-
-$response = $kernel->handle($request);
-$response->send();
-
-$kernel->terminate($request, $response);
diff --git a/web/app_test_cached.php b/web/app_test_cached.php
deleted file mode 100644
index 05cc0cafd20..00000000000
--- a/web/app_test_cached.php
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php
-
-/*
- * This file is part of the Sylius package.
- *
- * (c) Paweł Jędrzejewski
- *
- * For the full copyright and license information, please view the LICENSE
- * file that was distributed with this source code.
- */
-
-declare(strict_types=1);
-
-use Symfony\Component\HttpFoundation\Request;
-
-/*
- * Sylius front controller.
- * Testing prod-like environment.
- */
-
-if (isset($_SERVER['HTTP_CLIENT_IP'])
-    || isset($_SERVER['HTTP_X_FORWARDED_FOR'])
-    || !(in_array(@$_SERVER['REMOTE_ADDR'], ['127.0.0.1', 'fe80::1', '::1', '113.0.0.1', '10.0.0.1'], true) || php_sapi_name() === 'cli-server')
-) {
-    header('HTTP/1.0 403 Forbidden');
-    exit('You are not allowed to access this file. Check '.basename(__FILE__).' for more information.');
-}
-
-require __DIR__.'/../vendor/autoload.php';
-
-$kernel = new AppKernel('test_cached', false);
-
-$request = Request::createFromGlobals();
-
-$response = $kernel->handle($request);
-$response->send();
-
-$kernel->terminate($request, $response);