Step 1 • Before You Start
PHP Fundamentals — Syntax, OOP, and Composer beginner Laravel is a PHP framework — you need PHP fundamentals first. Modern PHP (8.0+): typed properties, union types, match expressions, named arguments, attributes (PHP's decorators), fibers, and null-safe operator (?>). OOP: classes, constructors, abstract classes, interfaces, traits (PHP's mixins — used heavily in Laravel), visibility modifiers, static methods, and magic methods (__construct, __get, __set, __toString). Namespaces and autoloading (PSR-4). Composer is PHP's package manager — composer require, composer.json, autoloading. Understand that PHP runs per-request (traditional) vs persistent (Laravel Octane with Swoole). arrow functions, array functions (array_map, array_filter, array_reduce, collect()).
8h Step 2 • Setup
Laravel Setup — Artisan, Structure, and .env beginner Install with Composer: composer create-project laravel/laravel app-name, or Laravel Herd (macOS — includes PHP, Nginx, MySQL). Laravel Sail (Docker) for cross-platform dev environments. Artisan is Laravel's CLI — php artisan make:controller, make:model, make:migration, make:middleware, make:command, tinker (REPL). Project structure: app/ (Models, Controllers, Middleware, Providers), routes/ (web.php, api.php), resources/ (views, lang, css, js), database/ (migrations, seeders, factories), config/ (all config files), storage/, bootstrap/. .env for environment-specific config — APP_KEY, DB_CONNECTION, QUEUE_CONNECTION, MAIL_MAILER. php artisan config:cache in production.
3h Step 3 • Foundations
Routing — Web Routes, API Routes, and Parameters beginner Routes map HTTP requests to handlers. routes/web.php for browser routes (CSRF protected, sessions), routes/api.php for stateless API routes (auto-prefixed with /api). Route methods: Route::get(), post(), put(), patch(), delete(), any(), match(). Route parameters: Route::get('/posts/{id}', ...) — optional: {id?}. Route model binding — type-hint a model in the controller method and Laravel auto-queries by the route parameter (Route::get('/posts/{post}', fn(Post $post) => $post)). Named routes (->name('posts.index')) for URL generation (route('posts.index')). Route groups for shared middleware/prefix/namespace. Route::resource() generates all 7 RESTful routes at once.
5h Step 4 • intermediate
Middleware intermediate Create HTTP middleware with php artisan make:middleware. Register global middleware (runs on every request), route middleware (alias-based), and middleware groups (web, api). Use terminable middleware to perform actions after the response is sent. Implement rate limiting (ThrottleRequests), locale detection, request logging, and IP allow-listing. Understand middleware stack execution order — outer middleware wraps inner.
4h Step 5 • Foundations
Controllers — Handling Requests beginner Controllers organize request handling into classes. php artisan make:controller PostController --resource generates all 7 RESTful methods (index, create, store, show, edit, update, destroy). Single-action invokable controllers — one controller, one action (__invoke method), useful for complex standalone operations. Dependency injection in controller constructors — Laravel resolves from the service container. Request injection — type-hint Illuminate\Http\Request (or a custom Form Request) as a method parameter. Response helpers: return view(), return response()->json(), return redirect()->route(), return back(). return response()->download() for file downloads. HTMX-friendly: return partial views on XHR requests.
5h Step 6 • Templating
Blade Templating — Views and Components beginner Blade is Laravel's templating engine — compiled to PHP and cached. Syntax: {{ $variable }} (escaped output — XSS safe), {!! $html !!} (unescaped — only for trusted content), @if/@elseif/@else/@endif, @foreach/@endforeach, @forelse (handles empty), @for, @while. Template inheritance: @extends('layouts.app'), @section('content')...@endsection, @yield('content') in layout. @include for partial views. Components: php artisan make:component Button — a Blade component class + template (resources/views/components/button.blade.php), use as <x-button label='Submit' />. Anonymous components (just a template file, no class). Slots for flexible layouts (@slot or {{ $slot }}). Livewire extends Blade with reactive components.
6h Step 7 • Database
Eloquent ORM — Models and Relationships intermediate Eloquent is Laravel's Active Record ORM — each model corresponds to a table, each instance to a row. php artisan make:model Post -m (creates model + migration). Query methods: Post::all(), Post::find(1), Post::where('published', true)->orderBy('created_at', 'desc')->paginate(15). Mass assignment: $fillable or $guarded. Accessors and mutators (casts: protected $casts = ['published_at' => 'datetime', 'metadata' => 'array']). Relationships: hasOne, hasMany, belongsTo, belongsToMany (with pivot table), morphTo/morphMany for polymorphic. Eager loading: Post::with('author', 'tags')->get() — prevents N+1. Scopes (local: public function scopePublished($query), global). Soft deletes (SoftDeletes trait — deletes add deleted_at, not DELETE).
8h Step 8 • Database
Migrations, Seeders, and Factories beginner Migrations version-control your database schema — committed to git, run in order. php artisan make:migration create_posts_table — generates a migration file with up() and down() methods. Schema builder: Schema::create(), table(), $table->id(), ->string(), ->text(), ->unsignedBigInteger(), ->foreignId('user_id')->constrained()->cascadeOnDelete(), ->timestamps(), ->softDeletes(). php artisan migrate, migrate:rollback, migrate:fresh (drop all + re-run — dev only), migrate:status. Seeders populate test data — php artisan make:seeder PostSeeder, call($seeder) in DatabaseSeeder. Factories generate fake model instances — php artisan make:factory PostFactory, uses Faker. Use in tests: Post::factory()->count(50)->create().
5h Step 9 • Security
Authentication — Breeze, Sanctum, and Policies intermediate Laravel provides multiple auth scaffolding options. Laravel Breeze — minimal, simple auth (login, register, password reset, email verification) with Blade or Vue/React via Inertia. Jetstream — full-featured (2FA, teams, API tokens) via Livewire or Inertia. The Auth facade: Auth::user(), Auth::id(), Auth::check(). auth() helper. Middleware: auth (require login), guest (redirect if logged in). Laravel Sanctum — SPA authentication (cookie-based sessions for first-party apps) and API token authentication. Authorization: Gates (closures — Gate::define('update-post', fn(User $user, Post $post) => $user->id === $post->user_id)), Policies (classes — php artisan make:policy PostPolicy --model=Post), @can directive in Blade.
7h Step 10 • Input Handling
Validation and Form Requests intermediate Laravel validation is extensive. In-controller: $request->validate(['title' => 'required|string|max:255|unique:posts,title']) — automatically redirects back with errors on failure. $errors bag in Blade: @error('title') <p>{{ $message }}</p> @enderror. Form Requests (php artisan make:request StorePostRequest) — separate class with authorize() (gates check) and rules() method — inject in controller method for automatic validation + authorization. Custom validation rules (php artisan make:rule NoSpam). Conditionally required fields (required_if, required_unless, sometimes). Rule objects vs closures vs inline rules. Available rules: email, url, image, mimes, max (file size), exists (DB), unique. $request->validated() returns only validated fields.
5h Step 11 • API
API Development — Resources and Sanctum intermediate Laravel API Resources transform Eloquent models into JSON responses — php artisan make:resource PostResource. Define toArray() to control which fields are exposed and how they're renamed. ResourceCollection for lists. Conditional attributes ($this->when($condition, value)) for optional fields. Relationship includes ($this->whenLoaded('author')). routes/api.php routes are auto-prefixed /api and stateless (no sessions — use Sanctum token auth). Sanctum API tokens: hasApiTokens trait on User, $user->createToken('app-token')->plainTextToken, attach as Bearer token. Rate limiting: RateLimiter::for('api', ...) in RouteServiceProvider. API versioning with route groups (api/v1/, api/v2/).
6h Step 12 • Async
Queues, Jobs, and Laravel Horizon intermediate Queues defer slow tasks — SendWelcomeEmail, ProcessUpload, GenerateReport — to background workers. php artisan make:job SendWelcomeEmail — implement handle() method. Dispatch: SendWelcomeEmail::dispatch($user) or dispatch_sync() for testing. Queue drivers: sync (immediate, for testing), database (jobs table), Redis (recommended for production), Amazon SQS. Queue workers: php artisan queue:work (process jobs from the queue), queue:listen (re-reads config on every job — dev only). Failed jobs: jobs_failed table, php artisan queue:retry all. Job chaining (dispatch one after another), job batching (know when all complete). Laravel Horizon — real-time Redis queue monitoring dashboard with metrics, job throughput, and failure alerts.
6h Step 13 • intermediate
Task Scheduling intermediate Define recurring tasks using the Laravel Scheduler in routes/console.php (Laravel 11+). Schedule Artisan commands, closures, and shell commands with fluent frequency methods: ->everyFiveMinutes(), ->daily(), ->weeklyOn(), ->cron('...'). Use ->withoutOverlapping() to prevent concurrent runs, ->runInBackground() for non-blocking execution, and ->onOneServer() for multi-server deployments. Configure the server cron: * * * * * php artisan schedule:run.
4h Step 14 • Advanced Features
Events, Listeners, and Notifications intermediate Events decouple application logic. Define an event class (UserRegistered), register listeners in EventServiceProvider (or use the #[ListensTo] attribute), call event(new UserRegistered($user)). Listeners can be queued — implement ShouldQueue for async processing. Observers — listen to Eloquent model events (created, updated, deleted) without polluting the model. Notifications provide a unified API for sending messages across channels: mail, SMS (Vonage), Slack, database, broadcast. Define a Notification class with via(), toMail(), toSlack() methods. Use the Notifiable trait on models. Queue notifications: implement ShouldQueue. Notification::send($users, new OrderShipped($order)) or $user->notify(new OrderShipped($order)).
5h Step 15 • Testing
Testing — PHPUnit, Feature Tests, and Factories intermediate Laravel ships with PHPUnit. Feature tests (tests/Feature) test full HTTP requests — $this->post('/api/posts', $data)->assertStatus(201)->assertJsonStructure([...]). Unit tests (tests/Unit) test classes in isolation. test helpers: actingAs($user), withoutMiddleware(), RefreshDatabase (wraps each test in a transaction and rolls back — fast), DatabaseTruncation. Assertions: assertDatabaseHas, assertDatabaseMissing, assertSoftDeleted, assertQueuedJob, assertMailable. Mock with $this->mock(ServiceClass::class, fn($mock) => $mock->shouldReceive(...)). HTTP test helpers: assertRedirect, assertSessionHasErrors, assertJsonValidationErrors. Pest PHP is a modern alternative test syntax — expressive, cleaner, recommended for new projects.
7h Step 16 • Production
Production — Performance, Security, and Deployment advanced Production Laravel: php artisan config:cache (flatten config files to single file), route:cache (pre-compile routes), view:cache (pre-compile Blade). Use queues for everything slow. Caching: Cache::remember('key', $ttl, fn() => ...) with Redis. N+1 prevention with strict mode (Model::preventLazyLoading()) in development. Security: CSRF protection (built-in), force HTTPS, configure trusted proxies for load balancers. Deployment: Laravel Forge (manages servers on AWS/DigitalOcean — provision, deploy, SSL, queues, cron), Laravel Vapor (serverless on AWS Lambda), Ploi, or manual on a VPS. Zero-downtime deployments with Envoyer. Octane (Swoole/RoadRunner) for persistent application — 10x faster than traditional PHP-FPM.
6h 