Blog

Slow queries are the most common reason a Laravel app feels sluggish under real traffic. Here are five habits that consistently help:

1. Eager load relationships. Replace $order->items inside a loop with Order::with('items')->get() to avoid N+1 queries.
2. Index what you filter and sort by. If a column shows up in a WHERE or ORDER BY clause often, it probably needs an index.
3. Select only what you need. select('id','name') instead of select('*') reduces memory and transfer time on wide tables.
4. Chunk large exports. Use chunk() or cursor() when processing thousands of rows so you don't exhaust memory.
5. Cache expensive, rarely-changing queries. Laravel's cache layer (Redis or file) can turn a 400ms report query into a 2ms cache hit.

None of these require exotic tooling — just discipline applied consistently across the codebase.

For most single-page apps and mobile clients talking to a Laravel backend, full OAuth2 is overkill. Laravel Sanctum offers a lighter path:

• Issue personal access tokens per device, scoped to specific abilities.
• Use SPA "cookie" authentication when your frontend and API share the same top-level domain, avoiding token storage in JavaScript entirely.
• Protect routes with the auth:sanctum middleware and check abilities with $request->user()->tokenCan('orders:read').
• Revoke tokens individually on logout or device removal — useful for "log out of all devices" flows.

The result: production-grade token authentication without wiring up a full OAuth server.

A POS system's schema has to handle rapid writes (sales) and rich reads (reports) at the same time. A few lessons from building one:

• Keep products and inventory in separate tables — stock levels change far more often than product details.
• Store each sale as a sales header plus a sale_items line-item table, mirroring how an invoice actually looks.
• Never delete a completed sale; use a status column and reversal records instead, so the audit trail stays intact.
• Denormalize the unit price onto sale_items at the time of sale — product prices change, but historical invoices shouldn't.

Small decisions like these save painful migrations six months into production.

Taking over someone else's Laravel project is common freelance work. Before writing any code, I check:

1. Environment parity — can I run it locally with the same PHP/MySQL versions as production?
2. Test coverage — are there any automated tests I can lean on, even partial ones?
3. Queued jobs and scheduled tasks — what's running in the background that isn't obvious from the routes file?
4. Third-party API keys — which external services does this app depend on, and are the credentials still valid?
5. Migration history — does the schema in the database actually match what the migration files say?

A day spent mapping the terrain saves a week of surprises later.

Payment webhooks look simple until money starts disappearing or doubling. A few non-negotiables:

• Verify the signature on every incoming webhook before trusting the payload.
• Make handlers idempotent — store the provider's event ID and skip processing if you've already seen it.
• Log the raw payload before doing anything else, so you can replay or debug later.
• Respond fast, process async — acknowledge the webhook immediately and queue the actual business logic.

These four habits prevent the vast majority of payment-related support tickets.

Not every client needs a Forge-managed VPS. Shared hosting with cPanel still works well for smaller Laravel apps:

1. Point the domain's document root at public/, not the project root — this is the step people miss most often.
2. Set environment variables through cPanel's PHP settings or a carefully permissioned .env file.
3. Run composer install --no-dev --optimize-autoloader before uploading, since Composer often isn't available on the host itself.
4. Cache config and routes (artisan config:cache, route:cache) to offset the lack of OPcache tuning access.
5. Use a cron job pointed at artisan schedule:run for anything that needs to run on a timer.

It's not glamorous, but it's reliable — and often exactly what a budget-conscious client needs.