diff --git a/recipes/symfony/framework-bundle/web/index.php b/recipes/symfony/framework-bundle/web/index.php
new file mode 100644
index 00000000..d7f79d0d
--- /dev/null
+++ b/recipes/symfony/framework-bundle/web/index.php
@@ -0,0 +1,44 @@
+<?php
+
+use Symfony\Component\Dotenv\Dotenv;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Debug\Debug;
+use Doctrine\Common\Annotations\AnnotationRegistry;
+
+$loader = require __DIR__.'/../vendor/autoload.php';
+if (class_exists(AnnotationRegistry::class)) {
+    AnnotationRegistry::registerLoader([$loader, 'loadClass']);
+}
+
+// The check is to ensure we don't use .env in production
+if (!getenv('APP_ENV')) {
+    (new Dotenv())->load(__DIR__.'/../.env');
+}
+
+if (getenv('APP_DEBUG')) {
+    // WARNING: You should setup permissions the proper way!
+    // REMOVE the following PHP line and read
+    // http://symfony.com/doc/current/book/installation.html#checking-symfony-application-configuration-and-setup
+    umask(0000);
+
+    // This check prevents access to debug front controllers that are deployed by accident to production servers.
+    // Feel free to remove this, extend it, or make something more sophisticated.
+    if (isset($_SERVER['HTTP_CLIENT_IP'])
+        || isset($_SERVER['HTTP_X_FORWARDED_FOR'])
+        || !(in_array(@$_SERVER['REMOTE_ADDR'], ['127.0.0.1', '::1']) || php_sapi_name() === 'cli-server')
+    ) {
+        header('HTTP/1.0 403 Forbidden');
+        exit('You are not allowed to access this file. Check '.basename(__FILE__).' for more information.');
+    }
+
+    Debug::enable();
+}
+
+// Request::setTrustedProxiestTrustedHeaderName(Request::HEADER_FORWARDED, null);
+// Request::setTrustedProxies(['0.0.0.0/0']);
+
+$kernel = new AppKernel(getenv('APP_ENV'), getenv('APP_DEBUG'));
+$request = Request::createFromGlobals();
+$response = $kernel->handle($request);
+$response->send();
+$kernel->terminate($request, $response);