Laravel Development UK: Web Apps, Portals and APIs in Laravel

Why we use Laravel for business applications

Laravel is our default framework for web applications that run a business: portals, booking systems, billing, stock, approvals and reporting. It is PHP, so it runs on mainstream hosting and there is a large pool of developers who can maintain it. It also gives us, out of the box, most of what a business system needs:

• Eloquent and database migrations, so the schema is version-controlled alongside the code.
• Authentication, policies and gates for role-based access.
• Queues and the scheduler for background jobs, imports, emails and integrations, with Horizon to monitor Redis queues.
• Sanctum for API tokens and single-page app authentication.
• Notifications across email, SMS and Slack.
• First-class testing with Pest or PHPUnit.

That means less code to write and less unusual code for the next developer to learn.

Laravel versions and support

Laravel releases a major version each year. Under its published support policy, each version gets 18 months of bug fixes and two years of security fixes.

Anything older than Laravel 12 is already outside security support. Many business applications we are asked to look at are on Laravel 8, 9 or 10, often on PHP versions that are also out of support. Upgrades are usually very manageable if done one version at a time with tests in place; they become painful only when left for years. We use tools such as Rector to automate the mechanical changes and spend our time on the parts that need judgement. See PHP upgrade and modernisation.

What we build in Laravel

Customer and supplier portals

Logged-in areas where customers see orders, invoices and documents, raise requests and update details, often pulling data from Xero, Sage or an ERP. See customer portal development.

Operations systems

Job management, stock, scheduling, approvals and staff target tracking, replacing spreadsheets that several people edit at once. We have built bespoke web-based billing and staff target management software for years, and the same patterns apply.

APIs and integrations

A Laravel API that your website, mobile app and partners all use, or a Laravel service that sits between systems and keeps them in step. See API development.

Admin panels

Back-office screens for staff to manage data, often built quickly with Filament or Livewire so budget goes on the business logic rather than form layouts.

How we build it

• Tests first where it matters. Pricing, invoicing, permissions and integrations get automated tests. A change to a tax rule should never silently break invoices.
• Queues for anything slow or external. API calls, PDFs, emails and imports run as queued jobs with retries and backoff, so users never wait on a third-party service.
• Idempotent integrations. Webhooks from Stripe or Xero can arrive more than once; we store event IDs and ignore repeats.
• Static analysis with PHPStan or Larastan to catch mistakes before they reach production.
• Repeatable environments with Docker or Laravel Sail, and automated deployments with zero-downtime releases.
• Audit logs for who changed what, which matters for finance data and GDPR.

Security and data protection

Business applications hold customer records, invoices and sometimes health or financial data, so security is part of the build, not a bolt-on. Laravel gives us good foundations: CSRF protection, parameterised queries through Eloquent, escaped Blade output and bcrypt or Argon2 password hashing. On top of that we add:

• Two-factor authentication for staff accounts, and single sign-on with Microsoft Entra ID or Google Workspace where your team already uses it.
• Policies on every model so users only see and change what their role allows.
• Encrypted storage for API tokens and sensitive fields.
• Rate limiting on logins and public endpoints.
• Data retention rules and export tools that help you answer UK GDPR subject access requests.

Inheriting a Laravel project

We often pick up Laravel applications from other developers. We start with a code audit: versions, dependencies, test coverage, security, database design and deployment. You get a plain-English summary of what is sound, what is risky and what we would fix first, with a fixed-price quote for that work.

New project or rescue, we begin with a free chat. For bigger builds we usually recommend a short discovery and scoping stage, then a fixed price for each phase. Get in touch.

What we deliver

• New Laravel web applications, portals and admin systems
• REST or JSON APIs with Sanctum or OAuth 2.0 authentication
• Queued integrations with Xero, QuickBooks, Stripe, CRMs and ERPs
• Role-based access, audit logs and reporting dashboards
• Laravel version upgrades and PHP upgrades with test coverage added
• Code reviews and rescues of inherited Laravel projects
• CI/CD pipelines and Docker-based environments

How it works and what it costs

Every project gets a fixed-price quote after a free initial chat and a short scoping stage. You own the code and the data.

1. Free chat

   Tell us the problem in plain English: what you do now, what goes wrong and what "better" looks like. No charge, no obligation.

2. Scoping

   We map the processes, systems and data involved, agree what is in and out, and write it down so there are no surprises.

3. Fixed-price quote

   You get a fixed price for the agreed scope, or a phased plan for bigger builds, so you can start small and prove it works.

4. Build and test

   We build in short stages you can see and try, test against real data, then go live carefully with a rollback plan.

5. Hand over and look after

   You own the code and the data. We can host it, support it and keep improving it, or hand it to your own team.

Related