Laravel Interview Questions 2026: 50 Questions with Answers

The best Laravel interview questions in 2026 test six areas: the request lifecycle and service container, Eloquent and database design, APIs and security, queues and performance, testing, and senior-level architecture. Below are 50 questions with answers covering each area. For each group, we explain what a strong answer sounds like and which red flags to watch for.

Most Laravel interviews still lean on trivia. “What is a facade?” “Name three Artisan commands.” Candidates can memorize those answers in an evening, and you learn almost nothing about how they'll handle a slow query at 2 a.m.

These Laravel interview questions and answers are for founders, CTOs, and engineering leads who need to hire well, as well as developers preparing for a senior Laravel interview. Each answer is short enough to use as a scoring key. The questions get harder as you go, so you can stop at the level the role requires.

Key Takeaways

• Ask about trade-offs, not definitions. “When would you use cursor() instead of chunkById()?” reveals far more than “What is Eloquent?”

• Questions 1 to 20 suit junior and mid-level roles; questions 21 to 50 help separate senior Laravel developers from experienced juniors.

• The N+1 problem, queue idempotency, and mass assignment are three topics candidates often struggle to explain, even experienced ones.

• Pair 8 to 12 questions with a short code review of a real Laravel app. It's usually a stronger signal than questions alone.

• In 2026, ask how candidates review AI-generated code. Reviewing and steering AI output is now part of the daily job.

The people in this article's examples are illustrative composites based on common Laravel hiring scenarios.

How to Use These Laravel Interview Questions

Don't ask all 50. Pick 8 to 12 that match the role, and let follow-up questions do the real work. A good follow-up is “What breaks if you do that?” or “How would you know it was working in production?”

Score each answer on a simple 1-to-3 scale:

• 1: Recites a definition without an example.

• 2: Explains how it works and gives one real use case.

• 3: Explains the trade-offs, identifies a failure mode, and describes how they'd debug it.

Use this table to pick questions by role:

When Priya, CTO of a 12-person logistics startup, hired her first senior Laravel developer in 2025, she used a list of 30 trivia questions. Her top-scoring candidate answered 28 correctly.

Three months later, he had shipped a reporting page that ran 400 queries per request. For her next hire, she cut the list to 10 questions and added a 45-minute code review. The developer she hired spotted an N+1 bug in the sample code within five minutes.

If you're still deciding whether to hire at all, our guide to hiring Laravel developers in 2026 covers costs, team structure, and when AI tooling changes the equation.

Laravel Fundamentals (Questions 1 to 10)

These Laravel interview questions and answers cover the framework basics every mid-level developer should be able to explain without hesitation.

1. Walk me through the Laravel request lifecycle.

The request enters public/index.php, which loads the autoloader and creates the application from bootstrap/app.php. The HTTP kernel registers and boots service providers, then sends the request through global middleware. The router matches a route, runs route middleware, and calls the controller or closure. The response travels back through the middleware to the browser.

Red flag: No mention of service providers or middleware.

2. What is the service container, and why does it matter?

The service container manages class dependencies and performs dependency injection. When a controller type-hints a class, Laravel resolves it automatically. You can bind interfaces to implementations so you can swap a payment gateway or mock it in tests without changing the calling code.

3. What's the difference between register() and boot() in a service provider?

register() should only bind things into the container. boot() runs after every provider has been registered, so it's safe to use other services there to register observers, macros, gates, or view composers. Using another service inside register() can fail because it may not be bound yet.

4. How do facades work?

A facade is a static-looking proxy to an object in the container. Cache::get() resolves the cache service and calls get() on it. Facades are testable because you can call Cache::shouldReceive() or use fakes like Mail::fake(). A strong candidate also mentions that heavy facade use can hide a class's real dependencies.

5. Where do you register middleware in Laravel 11 and later?

In bootstrap/app.php, using the withMiddleware() callback. The old app/Http/Kernel.php is gone from new applications. Candidates who only know the Kernel file haven't worked on a recent Laravel version. That's fine for some roles, but it's worth knowing.

6. What is route model binding?

Laravel injects a model instance when a route parameter matches a type-hinted variable. /posts/{post} with Post $post fetches the post by ID or returns a 404. You can bind by another column with {post:slug} and use scopeBindings() to ensure a nested child belongs to its parent.

7. How does Laravel protect against CSRF?

In Laravel 13, the PreventRequestForgery middleware in the web group first checks the browser's Sec-Fetch-Site header and allows same-origin requests. If that check can't be made, it falls back to validating the CSRF token, which forms include with @csrf. Stateless routes using bearer tokens don't need it, but cookie-based SPA authentication with Sanctum does.

8. Why use a Form Request instead of validating in the controller?

A Form Request moves validation and authorization into its own class. The controller stays thin, the rules are reusable, and authorize() keeps access checks close to the input they protect. Failed validation automatically redirects back with errors or returns a 422 JSON response for API requests.

9. Why shouldn't you call env() outside config files?

After php artisan config:cache, the .env file is no longer loaded, so env() returns null everywhere except inside config files. Always read values through config('services.stripe.key'). This is a classic production-only bug.

10. How do you write a custom Artisan command and schedule it?

Run php artisan make:command, set the $signature, and put the logic in handle(). In Laravel 11 and later, schedule it in routes/console.php with Schedule::command('reports:send')->dailyAt('07:00'). A single cron entry runs php artisan schedule:run every minute. Bonus points for withoutOverlapping() and onOneServer().

Eloquent and Database Questions (11 to 20)

Most production problems in Laravel apps start here. If your role involves reporting, multi-tenant data, or anything with large tables, spend extra time on this section. Our guide to Eloquent relationships is a good refresher for candidates.

11. What is the N+1 query problem, and how do you fix it?

Looping over 100 posts and accessing $post->author runs one query for posts plus 100 queries for authors. Fix it with eager loading: Post::with('author')->get(), or $posts->load('author') afterward. Strong candidates mention Model::preventLazyLoading() in development to catch the problem automatically.

Red flag: “I'd add caching.” Caching hides the problem; it doesn't fix it.

12. Explain hasManyThrough and polymorphic relationships.

hasManyThrough reaches related records through an intermediate model, such as a country's posts through its users. Polymorphic relationships let one model belong to several types, such as comments on both posts and videos using commentable_id and commentable_type. See the Eloquent relationships documentation for all relationship types.

13. What is mass assignment, and how do you protect against it?

Mass assignment means passing an array of input directly into create() or update(). Without protection, a user could submit is_admin=1. Use $fillable to allow specific fields, and pass $request->validated() rather than $request->all().

Red flag: Setting $guarded = [] everywhere “because it's easier.”

14. How do accessors, mutators, and casts work in modern Laravel?

Accessors and mutators are defined as methods that return an Attribute object with get and set closures. Casts are declared in a casts() method in Laravel 11 and later. They can convert columns to dates, arrays, encrypted strings, or PHP enums.

15. What are query scopes?

Local scopes are reusable query constraints, such as scopePublished(), which you can call as Post::published(). Global scopes apply to every query on a model. Soft deletes use a global scope, and many apps use them to enforce tenant_id filtering. A senior candidate warns that global scopes can surprise teammates and should be documented.

16. When do you use a database transaction?

Use a transaction when several writes must all succeed or all fail, such as creating an order, its line items, and a payment record. Use DB::transaction(fn () => ...). A strong answer adds that queued jobs and events dispatched inside a transaction should run after the transaction commits, using afterCommit() or the queue connection's after_commit option for jobs, and ShouldDispatchAfterCommit for events.

17. Compare chunk(), chunkById(), lazy(), and cursor().

All four process large tables without loading everything into memory. chunk() can skip rows if you update the column you're filtering on; chunkById() avoids that. lazy() returns a lazy collection backed by chunked queries. cursor() runs one query and hydrates one model at a time, but it can't eager load relationships.

18. How do soft deletes work?

Add the SoftDeletes trait and a deleted_at column. delete() sets the timestamp instead of removing the row, and a global scope hides deleted rows. Use withTrashed(), restore(), and forceDelete() as needed. Watch for unique indexes that still count soft-deleted rows.

19. How do you run migrations safely on a large production table?

Use an expand-and-contract approach: add new nullable columns first, backfill them in batches with a queued job, deploy code that uses both, then remove the old column in a later release. Avoid locking a huge table with a single ALTER. Always test the rollback.

20. When would you drop down to the query builder or raw SQL?

For heavy reports, aggregates, and bulk updates where hydrating thousands of models wastes memory. The query builder still uses parameter binding. With DB::raw() or whereRaw(), the candidate must use bindings, never string interpolation.

Hiring for a new Laravel product? StackMivo generates a full-stack Laravel app from a plain-English prompt, including a Filament admin panel. A generated app also makes a realistic starting point for the code review stage of an interview.

API, Authentication, and Security Questions (21 to 30)

From here on, the questions help separate experienced developers from those who've only built CRUD screens. Use the Laravel security best practices guide to explore the answers in more depth.

21. Sanctum or Passport: which would you choose?

Choose Sanctum for first-party SPAs using cookie-based session authentication and for simple API tokens used by mobile apps. Choose Passport when you need a full OAuth2 server, such as when third-party apps must request access on behalf of your users. Most products only need Sanctum.

22. What's the difference between gates and policies?

Gates are closures for actions not tied to a model, such as “view admin dashboard.” Policies group authorization logic for a specific model, such as PostPolicy@update. Use $this->authorize() in controllers, can middleware on routes, and @can in Blade.

23. How does Laravel prevent SQL injection, and where can it still happen?

Eloquent and the query builder use PDO parameter binding. Injection can still happen with raw expressions built from user input and with column names taken from the request, such as orderBy($request->sort). Validate column names against an allowlist.

24. How does Blade prevent XSS?

{{ $value }} escapes output with htmlspecialchars. {!! $value !!} outputs raw HTML and should only be used for content you've sanitized. A strong candidate also mentions escaping in JavaScript contexts and using Js::from() to pass data safely to scripts.

25. How do you design API responses in Laravel?

Use API resources (JsonResource) to control exactly which fields leave your app, so you never leak columns like password or internal IDs. Version the API in the URL or headers, paginate collections, and return consistent error formats.

26. How do you implement rate limiting?

Define limiters with RateLimiter::for() in a service provider and apply them with the throttle middleware, such as throttle:uploads. Limit by user ID when authenticated and by IP otherwise. Login and password reset routes need stricter limits than read endpoints.

27. What are signed URLs used for?

Signed URLs carry a signature that Laravel validates with the signed middleware. They're used for email verification, unsubscribe links, and temporary download links via URL::temporarySignedRoute(). If anyone tampers with the URL, the signature check fails.

28. How do you store passwords and sensitive data?

Hash passwords with Hash::make(), which uses bcrypt by default, with Argon2 also available. Never encrypt passwords; hashing is one-way. Use the encrypted cast for data you must read back, such as API keys from integrations, and keep APP_KEY out of version control.

29. How do you handle file uploads securely?

Validate the MIME type and size, store files outside the public web root or on S3, and generate your own file names instead of trusting the original name. Serve private files through a controller that checks authorization or through temporary URLs.

30. How do you verify incoming webhooks?

Verify the provider's signature header against the raw request body using a shared secret, reject old timestamps to block replays, and process the payload on a queue. Webhooks can arrive twice, so the handler must be idempotent.

Queues, Caching, and Performance Questions (31 to 40)

These questions matter most for apps with real traffic. For deeper reading, point candidates to our guides on Laravel queues, jobs, and workers and the performance optimization checklist.

31. When should work go on a queue?

Queue anything slow or unreliable that the user doesn't need to wait for, such as sending email, generating PDFs, calling third-party APIs, or processing images. The queues documentation covers the available drivers. Redis and database queues are the most common in production.

32. What makes a job idempotent, and why does it matter?

An idempotent job produces the same result if it runs twice. Jobs can run more than once after timeouts, retries, or worker crashes. Check the state before acting (“has this invoice already been sent?”), use unique keys, or implement ShouldBeUnique to prevent duplicate jobs from being queued.

Red flag: “Jobs only run once.”

33. How do you handle failed jobs?

Set $tries and $backoff on the job, implement a failed() method to alert or clean up, and keep the failed_jobs table. Retry jobs with php artisan queue:retry. A strong candidate distinguishes temporary failures, which can be retried, from permanent ones, which should fail fast with $this->fail().

34. What's the difference between queue:work and queue:listen?

queue:work is a long-running process that keeps the framework in memory, making it fast. Because it doesn't reload the code, you must run php artisan queue:restart after every deploy. queue:listen reloads the framework for each job, which is slower but convenient in local development.

35. What are job chaining and batching?

Chaining (Bus::chain()) runs jobs in sequence and stops if one fails. Batching (Bus::batch()) runs jobs in parallel and lets you track progress and react with then, catch, and finally callbacks. Batches need the job_batches table.

36. How do you cache an expensive query?

Use Cache::remember('key', $ttl, fn () => ...). The hard part is invalidation: clear or update the key when the data changes, often in a model observer. Senior candidates mention cache stampedes and tools like Cache::lock(), which ensures only one process rebuilds the value, or Cache::flexible(), which serves stale data and refreshes it after the response is sent.

37. What do you run on every production deploy?

Run composer install --no-dev --optimize-autoloader, php artisan migrate --force, php artisan optimize (which caches config, routes, views, and events), and php artisan reload (or queue:restart for queue workers only). Enable OPcache on the server.

38. How do you find a slow page?

Measure before guessing. Use Laravel Telescope, Debugbar, or Pulse locally and in staging. Check query counts and duplicate queries, then look for missing indexes with EXPLAIN. Only reach for caching after that.

39. What is Laravel Octane, and when would you avoid it?

Octane serves your app with FrankenPHP, Swoole, or RoadRunner, keeping it in memory between requests for much higher throughput. See our Laravel Octane performance guide for benchmarks and setup. Avoid it if your code relies on static state or singletons that hold per-request data, because that state can leak between requests.

40. How would you add real-time features?

Use broadcasting with events that implement ShouldBroadcast and a WebSocket server such as Laravel Reverb (first-party) or a hosted service like Pusher. Use private or presence channels with authorization for user-specific data.

Senior Laravel Interview Questions: Testing and Architecture (41 to 50)

A senior Laravel interview should spend most of its time here. These questions have no single right answer, so listen for reasoning, trade-offs, and real examples.

Daniel runs a seven-person Laravel agency. In early 2026, he interviewed two senior candidates with almost identical CVs. Both explained the repository pattern well. Only one said, “I wouldn't add it to this codebase. You have 14 models and one database; it's an extra layer with no payoff.”

Daniel hired that developer. Six months later, she had cut the agency's average feature delivery time by removing abstractions instead of adding them.

41. How do you structure tests in a Laravel app?

Use mostly feature tests that hit routes and assert on responses and the database, with unit tests for isolated business logic. Use RefreshDatabase and model factories. Reserve browser tests (Dusk or Pest 4) for critical flows like checkout. Our guide to Laravel testing with AI covers a practical setup.

42. How do you test code that sends email or calls an external API?

Use fakes: Mail::fake(), Queue::fake(), Event::fake(), and Notification::fake(), then assert what was sent. For HTTP calls, use Http::fake() with canned responses and Http::preventStrayRequests() so tests never hit real services.

43. Pest or PHPUnit?

Both run on the same engine, Laravel supports both out of the box, and the laravel new installer selects Pest by default. Pest offers more readable syntax, architecture tests, and, since Pest 4, browser testing. A good answer is pragmatic: match what the team already uses.

44. Where should business logic live?

Not in controllers. Common choices are action classes (one class per use case, such as CreateInvoice), service classes, or rich models for simple domains. Strong candidates explain why they'd choose a particular approach for a given codebase and how they'd keep it consistent.

45. When is the repository pattern worth it in Laravel?

Rarely, for most apps. Eloquent already abstracts the database, so a repository that wraps it often adds code without much benefit. It can make sense when data comes from several sources or when the domain must stay independent of the framework.

46. How would you build a multi-tenant SaaS?

There are two main approaches: a single database with a tenant_id column enforced by a global scope, or a separate database for each tenant. A single database is simpler and cheaper; separate databases provide stronger isolation for enterprise clients. Either way, tenant leaks must be covered by tests.

47. Events and listeners, or direct method calls?

Events decouple side effects from the main action. For example, OrderPlaced can trigger an email, analytics, and inventory updates without the checkout code knowing about them. The trade-off is traceability, because it becomes harder to see what happens when an order is placed. Use events for real side effects, not as a default.

48. How do you upgrade a large app to a new major Laravel version?

Read the upgrade guide, improve test coverage on critical paths first, update dependencies one at a time, and upgrade one major version per step. Tools like Laravel Shift can automate much of the mechanical work. Deploy to staging with production-like data first, and have a rollback plan.

49. How do you review AI-generated Laravel code?

Review it as you would a junior developer's pull request, but with extra scrutiny. Check for N+1 queries, missing authorization, $request->all() in mass assignment, unvalidated input, and invented package methods. Run the tests, and read every migration before it touches production. AI code review tools for PHP can help, but they don't replace a human reviewer.

Red flag: “I trust it if the tests pass” when the AI also wrote the tests.

50. What would you change first in an unfamiliar Laravel codebase?

Nothing at first. A senior developer reads the code, runs the tests, checks error logs and monitoring, and asks the team where the pain points are. Then they fix the riskiest problem with the smallest change, usually by adding missing tests around revenue-critical paths.

Beyond Questions: The Code Review Interview

Questions tell you what a candidate knows. A code review tells you how they work. Give candidates a small Laravel app with four or five planted issues, such as an N+1 query, a missing policy check, $guarded = [], a non-idempotent job, and an env() call in a controller. Ask them to review it like a real pull request, out loud, in 45 minutes.

Aisha, an engineering manager at a fintech company, switched to this format in 2026. Previously, each senior hire took her team about nine interview hours across four rounds. With one 45-minute code review replacing two question rounds, the total dropped to about six hours.

Candidates also preferred it. Several said it was the first interview that felt like the actual job.

Building that sample app by hand takes time. Generating it is faster. With StackMivo, you can describe a small app (“an invoicing tool with clients, invoices, and a monthly billing job”), get real Laravel code, and then plant the issues you want candidates to find.

For candidates, the same applies in reverse. If you're preparing for an interview, the Laravel developer roadmap for 2026 shows which skills to build before you apply.

Red Flags to Watch for in Any Laravel Interview

• Every answer is a definition. They know the docs but haven't encountered the problems.

• “I'd just cache it.” Caching is the first response instead of measuring the problem.

• No mention of tests when describing how they'd change risky code.

• $request->all() and $guarded = [] in their own code samples.

• They can't name a mistake they've made. Senior developers have production stories.

• Blind trust in AI output. Using AI tools is normal in 2026; failing to review their output isn't.

Frequently Asked Questions

What are the most common Laravel interview questions?

The most common Laravel interview questions cover the service container, service providers, middleware, Eloquent relationships, the N+1 problem, validation, authentication with Sanctum, queues, and testing. Senior interviews add architecture, multi-tenancy, performance, and code review.

How do I prepare for a senior Laravel interview?

Build and deploy something real, then be ready to discuss trade-offs: why you chose queues, how you tested the app, what broke in production, and how you fixed it. Review queues, caching, authorization, database performance, and how you review AI-generated code.

How many questions should a Laravel interview include?

Eight to twelve well-chosen questions with follow-ups are enough for a 60-minute technical round. Pair them with a code review or a short paid take-home task rather than adding more questions.

Are Laravel interview questions different in 2026?

Yes, in two ways. Answers should reflect Laravel 11 and later conventions, such as using bootstrap/app.php for middleware and scheduling in routes/console.php. Interviewers should also ask how candidates use and review AI coding tools.

Should candidates be allowed to use AI tools in a Laravel interview?

It depends on what you're testing. For fundamentals, ask candidates to answer without help. For a code review or take-home task, allowing AI tools is closer to the real job, as long as candidates can explain and defend every line.

Conclusion: Hire for Judgment, Not Memory

The best Laravel interview questions don't test memory. They test judgment: when to queue, when to cache, when an abstraction is worth it, and how to spot a bug before it reaches production.

To recap:

• Pick 8 to 12 questions that match the role, and score answers on reasoning, not recall.

• Use questions 1 to 20 for junior and mid-level roles, and questions 21 to 50 for senior hires.

• Add a 45-minute code review of a real Laravel app with planted issues.

• Ask how candidates review AI-generated code, because that's now part of the job.

Whether you're hiring your first Laravel developer or growing a team, a strong process can save you from expensive mis-hires. And if you need to ship before the hire starts, an AI app builder can carry part of the load.

Need a Laravel app to build on, or one to use in your next code review interview? Try StackMivo free → New accounts get 20 free credits, no card required.