We took a Laravel API from 300 to 4,000 requests per second without rewriting it. The wins came from four layers: Octane workers, a layered cache, Horizon queues with separate supervisors, and read replicas with sticky writes. Here is the setup and the traps.
After saving their profile, some users saw the old values on the next page and saved again. Laravel's sticky option only covers a single request, and the redirect read from a replica that was seconds behind. We fixed it with a WAL position check.
Our subscription platform had grown into a Laravel app with 400 models in one namespace, and every change risked breaking billing. We restructured it into modules with nwidart/laravel-modules: what a module owns, how modules talk through contracts and events, and where a module is the wrong tool.
We published an internal package to our private Packagist and every app failed to require it: could not find a version matching your minimum-stability (stable). The package had no tags, only a main branch, so Composer saw only dev-main. How stability flags, tags and branch aliases work.
A new module built with nwidart/laravel-modules worked on every laptop, then production threw Class not found for its service provider right after deploy. The module's composer.json was never merged into the root autoloader in the image build, and an authoritative classmap froze the result.
Our Laravel export workers started at 70 MB and reached 1 GB after six hours, getting slower until Kubernetes killed them mid-job. An always-on query log, a static memo cache and whole-table loads were to blame. We fixed each and added worker limits.
Running the test suite inside our app container dropped every table in the development database. Docker Compose injected DB_DATABASE as a real environment variable, and phpunit.xml's env entries do not override existing variables. Here is the full precedence chain and three layers of defence.
A small share of users reported that their authenticator codes were rejected, but only sometimes. One application server's clock ran 70 seconds behind, so codes failed whenever a login reached it. How we found it, fixed time sync, and kept a tight verification window with replay protection.
We extracted a webhook signature verifier from three Laravel apps into a public package. The steps from a folder of classes to an installable Composer package: structure, composer.json, service provider and auto-discovery, Testbench tests, a CI matrix across Laravel versions, tags and Packagist.
Our orders export worked for every customer until one crossed 500,000 rows and PHP died with Allowed memory size exhausted. The endpoint loaded everything with get(), then built the CSV in memory. Streaming keyset chunks straight to the response fixed it at a flat 40 MB.
A slow accounting API pushed our PayPal webhook handler past the nginx timeout. PayPal saw a 504 and retried, while the first request was still running, and 41 wallets were topped up twice. Postmortem plus the idempotent design we moved to.
Uploading a PDF larger than 1 MB failed with a vague error in our claims portal. Nginx returned 413, then PHP silently dropped files, then Laravel rejected them. Four layers each had their own size limit. Here is how we aligned them and tested every boundary.
Login and checkout forms started failing with 419 Page Expired the day we put two Laravel nodes behind a TLS-terminating load balancer. Untrusted proxy headers, secure cookies and file sessions on each node combined into one confusing error.
Our job board listing took 1.8 seconds and ran 312 queries per page. Blade was lazy loading company, tags and application counts for every row. We fixed it with with(), withCount() and made lazy loading throw in development.
Product reviews containing emoji failed with error 1366 after we upgraded MySQL to 8.0, while a nightly job quietly turned them into question marks. Legacy utf8mb3 tables, a wrong connection charset and an index length limit were all involved.