Project structure · Backend
Laravel project structure
Opens with creditsA Laravel 13 web app for booking clinic appointments, laid out the way laravel new creates it and the Laravel docs describe it: models, controllers and providers in app, migrations and factories in database, Blade and Vite assets in resources, Pest tests in tests. For students who have built a first CRUD app and want to know where actions, jobs, policies, API resources and deploy files go as it grows.
Curated by Tauseef FayyazIntermediate190 files and foldersPHP 8.5 (8.3 minimum), Laravel 13, Pest 5Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you82 files and folders
- 2GrowingWhat a real app with features and tests adds+68 files and folders
- ProductionWhat running it for real users adds+22 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+18 files and foldersOpens with credits
How it is organised
- Follow the skeleton. Laravel developers know where `app/Models`, `routes/web.php` and `database/migrations` are; inventing your own layout costs every new teammate a week.
- Let Artisan create files (`php artisan make:*`). You get the right namespace, the right folder and a class Laravel discovers automatically.
- Thin controllers: validate with a form request, authorise with a policy, call an action, return a view or resource. Business rules live in `app/Actions` and models.
- Configuration comes from `.env` through `config/*.php`. Only config files call `env()`; everything else calls `config()`, because `config:cache` makes `env()` return null.
- The database is built from code: migrations for the schema, factories for test data, seeders for demo data. Never edit a migration that already ran somewhere shared.
- Slow or retryable work (email, webhooks, PDFs) goes to a queued job or listener, and every job is safe to run twice.
- Most tests are Pest feature tests through HTTP with a fresh database; a few browser tests cover the flows that matter most; arch tests guard team rules.
- Pint formats, Larastan checks types, Pest tests, and CI runs exactly the same commands you run locally.
At the top of the project
Open one in the explorer for the full story
- clinic-app/
- .git/Git history, created by the installer.
- app/Your application code: controllers, models, providers and everything you add later.14 inside
- bootstrap/Boots the framework: routing, middleware, exceptions and the provider list.3 inside
- config/One PHP file per area of configuration, each reading values from the environment.11 inside
- database/Migrations, factories, seeders and, for SQLite, the database file itself.5 inside
- lang/Translation files, published with `php artisan lang:publish`.1 inside
- node_modules/npm packages for Vite and Tailwind.
- public/The web root: the only folder the web server exposes.6 inside
- resources/Source files that are compiled or rendered: CSS, JavaScript, Blade views, and language files if you add them.3 inside
- routes/Route files: web pages, Artisan commands and schedules, and later the API.3 inside
- storage/Files the app writes at runtime: uploads, compiled views, sessions, caches and logs.3 inside
- tests/Pest tests: Feature tests through HTTP, Unit tests for plain classes, later Browser and Arch tests.4 inside
- vendor/Composer packages, including Laravel itself.
- .editorconfigIndentation and line ending rules every editor understands.
- .envYour local environment values: APP_KEY, database, mail and service keys.
- .env.exampleA committed template of every environment variable, with safe placeholder values.
- .gitattributesLine endings and diff drivers for Git.
- .gitignoreIgnores .env, vendor, node_modules, public/build, public/storage and editor folders.
- artisanThe command line entry point: `php artisan <command>`.
- boost.jsonLaravel Boost settings: which AI coding agents and guidelines it set up.
- composer.jsonPHP dependencies, PSR-4 autoload mapping and Composer scripts (setup, dev, test).
- composer.lockThe exact version of every PHP package installed.
- compose.yamlDocker services for local development: the app, MySQL or PostgreSQL, Redis, Mailpit.
- package.jsonnpm scripts and dev dependencies: Vite, laravel-vite-plugin, Tailwind CSS.
- package-lock.jsonThe exact npm package versions, written by `npm install`.
- phpstan.neonLarastan settings: level, paths and a baseline of known errors.
- phpunit.xmlTest suites and test-only environment values (SQLite in memory, array mail and cache).
- pint.jsonLaravel Pint code style settings.
- README.mdHow to set up, run, test and deploy the app.
- vite.config.jsVite config: the Laravel plugin with your entry points, Tailwind and fonts.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with Laravel.
- Roadmap· PHPBackend development roadmapAPIs, databases, auth, deploys
- RoadmapSQL and databases roadmapQueries, design, indexes, transactions
- RoadmapDevOps and cloud roadmapLinux, Docker, Kubernetes, AWS
- RoadmapQA and test automation roadmapManual testing to automated suites
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetSQL and databases cheat sheetQueries, design, indexes, transactions.
- FYP idea· BeginnerTuition Centre Fee and Attendance Manager with Parent RemindersA web app for small tuition centres and academies to manage batches, take attendance from a phone, generate monthly fee vouchers and send parents reminders. A beginner-friendly final year project with a real paying customer in almost every neighbourhood.
- FYP idea· BeginnerRent Ledger and Tenant Portal for Small LandlordsA web app for small landlords and property caretakers with a few houses, flats or shops to track agreements, monthly rent with yearly increments, utility bills, security deposits and repair requests, with a simple tenant portal. A beginner-friendly final year project in real estate and property management.
- FYP idea· IntermediateSchool Report Card System with Configurable Grading Rules and Batch PDFsA web system for private schools to enter marks, apply their own grading and promotion rules, moderate results and generate hundreds of printable report cards in one batch. An intermediate final year project in education software with a real rules engine and a document generation pipeline.
See 9 moreShow fewer
- QuestionI understand tutorials but cannot build anything myself. Why does coding feel so different when I am alone?Tutorials train recognition, not production. When you follow along, someone else makes every decision. Building alone requires you to break a problem down and make choices, which is a separate skill. Build it with small projects, planning on paper first, and a rule to struggle before you look anything up.
- QuestionWhat should I learn to become a web developer, and in what order?Learn the web platform first (HTML, CSS, JavaScript, how HTTP works), then one frontend framework, then a backend with a database, and build a real project at each stage. If you already know WordPress, you are not starting over: your HTML, CSS and PHP experience transfers.
- QuestionHow do I learn to read a large codebase when I can handle small projects but get lost in real ones?Nobody reads a large codebase from top to bottom. You follow one real path through it, such as a single request or button click, from entry point to database and back. Map what you find, ignore everything off that path for now, and repeat with a different path. Understanding builds in layers, and a first small change teaches more than a week of reading.
- QuestionHow do I learn Git and GitHub properly instead of just copying commands?Learn the model first: commits are snapshots, branches are pointers, and remotes are copies. Then use Git daily on your own projects, practise a team workflow with branches and pull requests, and break things on purpose, such as merge conflicts, so you learn to recover calmly.
- Resource· GuideLaravel DocumentationThe official Laravel documentation covers the whole framework: routing, controllers, Blade templates, validation, the Eloquent ORM, migrations, queues, events, authentication, authorisation, testing and first-party packages. It is known for being readable enough to learn from, not only look things up in. It suits anyone building with Laravel, from a first project to production, as long as you match the documentation version to the Laravel version your project uses.
- Resource· VideoLaravel Learn (formerly Laravel Bootcamp)Laravel Learn is Laravel's official free video learning hub, which replaced the older Laravel Bootcamp. It offers a short PHP Fundamentals course and a Getting Started with Laravel course that builds a full-stack app with Eloquent models, Blade components, forms, validation, CRUD and authentication. It suits developers new to Laravel who want the most direct, officially maintained route to a first working application.
- Resource· GuidePHP: The Right WayPHP: The Right Way is a free, community-maintained guide to current PHP practice, started by Josh Lockhart. It covers Composer, PSR coding and autoloading standards, PDO and SQL injection prevention, dependency injection, error handling, security, testing and deployment, pointing to authoritative sources for each. It suits developers who know basic PHP syntax and want to avoid the outdated or unsafe habits found in much older PHP content online.
- Resource· VideoPHP For BeginnersJeffrey Way's PHP For Beginners on Laracasts is a video series of around 50 episodes and just over ten hours that teaches modern PHP 8 from the first PHP tag, variables, arrays and functions up to a small application with a router, a PDO database layer and form handling, built without a framework. It suits beginners heading towards Laravel, because you build by hand the pieces a framework later gives you.
- Resource· GuideOWASP API Security Top 10The OWASP API Security Top 10 (2023 edition) lists the most critical security risks in APIs, led by broken object level authorisation, broken authentication and broken object property level authorisation. Each risk comes with attack scenarios and prevention advice. It suits anyone building or reviewing backends, because these flaws are common, easy to miss in code review and often invisible in normal testing.
Checked against 23 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- laravel/laravel application skeleton
- Laravel installer source
- Laravel: Installation
- Laravel: Directory Structure
- Laravel: Configuration
- Laravel: Routing
- Laravel: Validation (form requests)
- Laravel: Authorization (policies)
- Laravel: Eloquent API Resources
- Laravel: Queues
- Laravel: Task Scheduling
- Laravel: Database Testing
- Laravel: Deployment
- Laravel Sanctum
- Laravel Horizon
- Laravel Pulse
- Laravel Sail
- Pest documentation
- Pest: Browser testing
- Pest: Architecture testing
- Larastan
- FrankenPHP: Laravel
- Deptrac documentation
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com