Laravel Maintenance: Upgrades, Security and Hosting

A Laravel application that is not maintained does not stay still: it falls behind on security fixes, its PHP version reaches end of life, and each skipped upgrade makes the next one harder. This guide covers the routine we follow to keep Laravel applications healthy: upgrades, security, backups, hosting and monitoring. It is written for business owners and managers who own a Laravel system, and for developers who look after one.

1. Know which versions you are running

Start with three numbers: the Laravel version, the PHP version and the database version. Laravel releases a new major version every year, and each one receives bug fixes for a limited time and security fixes for a little longer. PHP versions also reach end of life on a fixed schedule. Once either is out of support, newly discovered vulnerabilities are no longer fixed.

Check them with php artisan --version and php -v, and compare them against the official support schedules for Laravel and PHP.

2. Upgrade one major version at a time

Jumping several versions at once is where upgrades go wrong. Our approach:

1. Make sure there are automated tests for the most important pages and workflows, even a handful.
2. Upgrade on a separate branch and a staging copy, never directly on the live site.
3. Follow the official upgrade guide for that version, then update packages such as the admin panel and Livewire to versions that support it.
4. Run the tests, click through the key workflows, then deploy.

Small, regular upgrades take hours. An application left four versions behind can take weeks.

3. Keep dependencies patched

Most security problems arrive through dependencies, not your own code. Run composer audit to list packages with known vulnerabilities, and update with composer update on a branch, reviewing what changed. Do the same for front-end packages with npm audit.

4. Production security checklist

• APP_DEBUG=false in production. Debug pages expose configuration and code paths.
• The .env file is outside the web root, or blocked from being served.
• HTTPS everywhere, with security headers such as Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy.
• Admin panels behind strong passwords and, ideally, two-factor authentication, with noindex so they do not appear in search results.
• File uploads validated by type and size, and never executed.
• Rate limiting on login and contact forms.

5. Backups you have actually restored

Back up both the database and uploaded files, automatically, at least daily, and keep copies off the server. A backup you have never restored is a hope, not a backup: test a restore to a staging copy every few months.

6. Hosting and performance

• Run a supported PHP version with OPcache enabled.
• On every deploy, run php artisan optimize to cache configuration, routes and views.
• Cache expensive pages and queries, and clear the cache when content changes.
• Serve fingerprinted assets (Vite's build output) with long cache lifetimes, and compress text responses.
• Use queues for slow work such as sending email, so visitors are not kept waiting.

7. Monitoring

Know about problems before your users do. At minimum: uptime monitoring that alerts you when the site is down, error logging you actually read, and alerts for failed scheduled jobs and full disks. Google Search Console is worth adding too: it reports indexing problems and Core Web Vitals from real visitors.

A simple maintenance calendar

Need help with a Laravel application?

We build and maintain Laravel and Livewire applications in Jaffna for clients in Sri Lanka and abroad, including upgrades of older systems. See our hosting and maintenance and custom software development services, or contact us about your application.