Web development · 5 stages · about 44 weeks
Backend developer (PHP: Laravel) roadmap
0/27 tasks done (ticks are kept on this device)
- 1
Beginner · about 8 weeks
PHP basics, HTML forms and MySQL
What to learn
How a PHP website works: You need to know where PHP runs and what it sends back.
When someone opens a page, the web server runs your PHP code, which builds HTML and sends it to the browser. The browser never sees the PHP itself. For practice, run PHP on your own computer with the built-in server (php -S localhost:8000) or a package like XAMPP or Laragon.
PHP language basics: Laravel and WordPress are both written in PHP.
Learn variables (they start with $), strings, numbers, if/else, loops and functions. Learn arrays well, because PHP uses them as both lists and key-value maps. Turn on strict types and error reporting from day one so mistakes show up early.
HTML forms and request data: Forms are how users send data to your PHP code.
A form sends data with GET (in the URL) or POST (in the request body). PHP reads it from $_GET and $_POST. Always check and clean this data, because users can send anything.
MySQL and SQL: Most PHP apps store their data in MySQL.
A SQL database keeps data in tables with rows and columns. Learn SELECT, INSERT, UPDATE, DELETE, WHERE, JOIN and ORDER BY. Use a tool like phpMyAdmin, TablePlus or DBeaver to see your tables.
PDO and prepared statements: This is how you talk to the database safely from PHP.
PDO is PHP's built-in way to connect to databases. Prepared statements send the SQL and the user's values separately. This blocks SQL injection, one of the most common ways websites get hacked.
Sessions and cookies: They let a site remember who is logged in.
A cookie is a small piece of data saved in the browser. A session stores data on the server and links it to the browser with a cookie. Use password_hash and password_verify for passwords, never plain text.
Objects and namespaces: Modern PHP and Laravel are built with classes.
A class is a blueprint, like Invoice, and an object is one real invoice. Namespaces keep class names from clashing in big projects. Learn interfaces and type declarations, since Laravel uses them everywhere.
Git and GitHub: Teams and clients expect your code in Git.
Git saves versions of your code as commits so you can undo mistakes. Push every project to GitHub with a README. Clients and employers will often ask to see it.
Tasks
Project
A simple billing app for a local shop in plain PHP and MySQL: add products, create a bill with GST in rupees, list past bills, and log in as the shop owner.
📘 Learn it here, free: Backend Development course
Free resources
- 2
Beginner · about 10 weeks
Composer and Laravel fundamentals
What to learn
Composer: Composer installs PHP packages and is used by every modern PHP project.
Composer reads composer.json, downloads the packages your project needs, and sets up autoloading so classes load automatically. Packages come from Packagist. You will create a new Laravel project with a Composer or Laravel installer command.
Laravel routing and controllers: Routes decide which code runs for each URL.
In routes/web.php you connect a URL like /products to a controller method. Controllers group related actions, like listing, showing and saving products. Artisan, Laravel's command line tool, can create controllers for you.
Blade templates: Blade builds the HTML pages users see.
Blade is HTML with simple extras like {{ $name }} to print values safely and @foreach for loops. Layouts and components let you reuse the header, footer and buttons. Blade escapes output by default, which helps block XSS attacks.
Eloquent ORM: Eloquent lets you work with database rows as PHP objects.
Each table has a model, like Product, and you can write Product::where('price', '<', 500)->get(). Relationships like hasMany and belongsTo link models, for example a customer has many orders. Learn eager loading with with() to avoid many small slow queries.
Migrations and seeders: They keep the database structure in code, so every computer matches.
A migration is a PHP file that creates or changes a table. Seeders and factories fill the database with test data. Run php artisan migrate on your own machine to apply them.
Validation and form requests: Every form and API must reject bad data.
Laravel validation rules like required, email and numeric check input in one line. Form Request classes keep these rules out of your controllers. Errors are shown back to the user next to the right field.
Authentication: Most apps need sign-up, login and password reset.
Laravel starter kits give you login, registration and password reset screens quickly. Middleware like auth protects pages so only logged-in users can see them. Gates and policies decide what each user is allowed to do.
Tasks
Project
A Laravel order management app for a small bakery or tiffin service: products, customers, daily orders, totals in rupees, login for staff and owner, and a printable daily summary.
📘 Learn it here, free: Backend Development course
Free resources
- 3
Intermediate · about 10 weeks
REST APIs, queues, testing and WordPress
What to learn
REST APIs in Laravel: Mobile apps and React frontends need a JSON API.
In REST, each thing has its own URL, like /api/orders/15, and you use GET, POST, PUT and DELETE to work with it. Laravel API resources turn models into clean JSON. Return the right status codes, like 201 when something is created and 422 when data is invalid.
API authentication with Sanctum: APIs need a safe way to know who is calling.
Laravel Sanctum gives each user or app a token to send with every request. It also handles login for single-page apps using cookies. Use abilities (permissions) on tokens so a token can only do what it needs.
Queues and jobs: Slow work like emails, SMS and PDFs should not make users wait.
A queue is a waiting list of jobs that a worker process runs in the background. In Laravel you create a job class and dispatch it, and a worker started with php artisan queue:work runs it. Redis or the database can store the queue.
Scheduling, mail and notifications: Business apps send reminders and reports automatically.
The Laravel scheduler runs tasks at set times, like a daily sales report at 9 pm, from one cron entry. Mailables build emails, and notifications can go by email, SMS or other channels. Test emails with a local mail catcher before sending to real people.
Testing with Pest or PHPUnit: Tests let you change code without breaking what works.
PHPUnit is the classic PHP test tool, and Pest is a simpler style built on top of it. Laravel feature tests can call your routes and check the response and database. Use a separate test database and factories for test data.
WordPress awareness: A lot of freelance work in India is building and fixing WordPress sites.
WordPress is a PHP content system used by many small business sites and blogs. Learn how themes control the look, how plugins add features, and how hooks (actions and filters) let you change behaviour safely. Even as a Laravel developer, this knowledge often wins small client jobs.
Payments and webhooks: Online shops and booking sites take payments.
Payment gateways used in India, such as Razorpay, support UPI, cards and net banking. After payment they call your webhook, a URL on your server, to confirm it. Always check the webhook signature and handle the same event twice safely.
Tasks
Project
A table booking system for a restaurant: Laravel web app plus JSON API, Sanctum login, test-mode payments with webhooks, booking reminders sent from a queue, a daily report from the scheduler, and Pest tests.
📘 Learn it here, free: Backend Development course
Free resources
- 4
Intermediate · about 6 weeks
Deploying on a Linux VPS
What to learn
Linux server basics: Many PHP apps in India run on a low-cost VPS.
A VPS (virtual private server) is your own small Linux computer in a data centre. Learn to log in with SSH keys, move around folders, edit files, and install packages. Turn off password login and keep the system updated.
Nginx and PHP-FPM: This is the common way to serve PHP fast.
Nginx is the web server that receives requests and serves files. PHP-FPM runs your PHP code when Nginx passes a request to it. Point Nginx at Laravel's public folder, never at the project root.
HTTPS and domains: Browsers warn users about sites without HTTPS.
Point your domain to the server with a DNS A record. Use Let's Encrypt with Certbot to get a free HTTPS certificate that renews itself. Redirect all HTTP traffic to HTTPS.
Running Laravel in production: Production needs different settings from your laptop.
Set APP_DEBUG to false and keep secrets in the .env file on the server, never in Git. Run migrations carefully, cache config and routes, and keep queue workers running with Supervisor or systemd. Set up a cron entry for the scheduler.
Backups and monitoring: Servers fail, and data loss can end a small business.
Back up the database every day and store copies somewhere else, then practise restoring one. Watch disk space, memory and error logs. A simple uptime checker can email you when the site goes down.
Automated deploys: Manual deploys cause mistakes and downtime.
Use GitHub Actions to run tests on every push and deploy when the main branch passes. A deploy script pulls the code, runs composer install, migrations and cache commands, then restarts workers. Keep the previous version ready to roll back.
Tasks
Project
Your restaurant booking app running on your own VPS with a real domain, HTTPS, queue workers, scheduler, daily backups, uptime alerts and one-click deploys, with a short runbook in the README.
Free resources
- 5
Expert · about 10 weeks
Performance, security and larger Laravel systems
What to learn
Database and query performance: The database is usually what makes a Laravel app slow.
Find the "N+1" problem, where one page makes hundreds of small queries, and fix it with eager loading. Use EXPLAIN in MySQL to check indexes. Use database transactions where money or stock changes.
Caching and Redis: Caching makes busy pages fast and cheap to serve.
Store slow query results in Redis with Laravel's Cache, and clear them when data changes. Use OPcache so PHP does not re-read code on every request. Measure before and after every change.
Security: PHP sites are frequent targets for attackers.
Study the OWASP Top 10, such as injection, broken access control and file upload attacks. Laravel protects you from many attacks by default, including CSRF and SQL injection, if you use its tools properly. Keep PHP, Laravel and all packages updated, and run composer audit.
Clean architecture in Laravel: Big apps become hard to change without good structure.
Keep controllers thin and move business rules into service or action classes. Use events and listeners to keep features loosely connected. Write tests around the rules that matter most, like prices and taxes.
Scaling and containers: Growing apps need more than one server.
Keep the app stateless: sessions, cache and queues in Redis, and files in object storage. Then you can run several app servers behind a load balancer. Docker and Laravel Sail help keep every machine the same.
Working with clients and teams: Senior PHP developers often handle clients directly.
Write clear estimates, break work into small milestones, and show progress often. Document how to run and deploy each project. Review others' code kindly and explain the reasons for your comments.
Tasks
Project
A multi-branch billing and inventory system for a small chain of shops: stock per branch, GST invoices as PDFs from queued jobs, roles per branch, Redis cache, strong tests, security review, and deployment with backups and monitoring.
Free resources