Free
Performance
Autoloader Optimization
Your application has the Composer autoloader optimization configured in production.
Check detailsCheck catalogue
Every signal, in one place.
Browse 134 Laravel-aware checks across performance, security, and reliability. Every check is labelled clearly as Free or Pro.
- 67
- Free
- 67
- Pro
- 134
- Total
37 Performance
50 Security
47 Reliability
Free
Performance
Cache Driver
A proper cache driver is configured.
Check details
Free
Performance
Cache Header
Your application caches compiled assets for improved performance.
Check details
Free
Performance
Collection Call
Aggregation is done at the database query level rather than at the Laravel Collection level.
Check details
Free
Performance
Config Caching
Application config caching is configured properly.
Check details
Free
Performance
Debug Log
Your application does not use the debug log level in production.
Check details
Free
Performance
Dev Dependency
Dev dependencies are not installed in production.
Check details
Free
Performance
Env Call
Your application does not contain env function calls outside of your config files.
Check details
Free
Performance
Horizon Suggestion
Your application uses Horizon when using the Redis queue driver.
Check details
Free
Performance
Minification
Your application minifies assets in production.
Check details
Free
Performance
MySQL Single Server
MySQL is configured properly on single server setups.
Check details
Free
Performance
OPcache
OPcache is enabled.
Check details
Free
Performance
Queue Driver
A proper queue driver is configured.
Check details
Free
Performance
Route Caching
Application route caching is configured properly.
Check details
Free
Performance
Session Driver
A proper session driver is configured.
Check details
Free
Performance
Shared Cache Lock
Your application does not use locks on your default cache store.
Check details
Free
Performance
Unused Global Middleware
Your application does not contain unused global HTTP middleware.
Check details
Free
Performance
View Caching
View caching is configured properly.
Check details
Free
Security
App Debug
Your application hides technical errors in production.
Check details
Free
Security
App Debug Hide
Sensitive environment variables are hidden in non-local environments.
Check details
Free
Security
App Key
Application key is set.
Check details
Free
Security
CSRF
Your application includes middleware to protect against CSRF attacks.
Check details
Free
Security
Encrypted Cookies
Your application encrypts its cookies.
Check details
Free
Security
Env Access
Your .env is not publicly accessible.
Check details
Free
Security
File Permissions
Your project files and directories use safe permissions.
Check details
Free
Security
Fillable Foreign Key
Your application does not expose foreign keys for mass assignment.
Check details
Free
Security
Frontend Vulnerable Dependency
Your application does not rely on frontend dependencies with known security issues.
Check details
Free
Security
HSTS Header
Your application includes the HSTS header if it is a HTTPS only app.
Check details
Free
Security
HTTP Only Cookie
Cookies are secured as HttpOnly.
Check details
Free
Security
Hashing Strength
A secure hashing strength is configured.
Check details
Free
Security
License
Your application does not rely on dependencies you are not legally allowed to use.
Check details
Free
Security
Login Throttling
Your application includes login throttling for protection against brute force attacks.
Check details
Free
Security
Mass Assignment
Your application is not exposed to mass assignment vulnerabilities.
Check details
Free
Security
PHP Ini
Your PHP configuration is secure.
Check details
Free
Security
Stable Dependency
Your application uses stable versions of dependencies.
Check details
Free
Security
Unguarded Models
Your application does not un-guard models.
Check details
Free
Security
Up To Date Dependency
Dependencies are up-to-date.
Check details
Free
Security
Vulnerable Dependency
Your application does not rely on backend dependencies with known security issues.
Check details
Free
Security
XSS
Your application sets appropriate HTTP headers to protect against XSS attacks.
Check details
Free
Reliability
Cache Prefix
Cache prefix is set to avoid collisions with other apps.
Check details
Free
Reliability
Cache Status
Your application cache is working.
Check details
Free
Reliability
Composer Validation
Your application's composer.json file is valid.
Check details
Free
Reliability
Custom Error Page
Your application defines custom error page views.
Check details
Free
Reliability
Database Status
Database is accessible.
Check details
Free
Reliability
Dead Code
Your application does not contain any dead or unreachable code.
Check details
Free
Reliability
Deprecated Code
Your application does not use any deprecated code.
Check details
Free
Reliability
Directory Write Permissions
Your storage and cache directories are writable.
Check details
Free
Reliability
Env Example
All env variables used in your .env file are defined in your .env.example file.
Check details
Free
Reliability
Env File
A .env file exists for your application.
Check details
Free
Reliability
Env Variable
All env variables defined in your example file are set in your .env file.
Check details
Free
Reliability
Foreach Iterable
Your application only uses iterable types in foreach loops.
Check details
Free
Reliability
Invalid Function Call
Your application does not contain invalid function calls.
Check details
Free
Reliability
Invalid Import
Your application does not contain invalid imports.
Check details
Free
Reliability
Invalid Method Call
Your application does not contain invalid method calls.
Check details
Free
Reliability
Invalid Method Override
Your application does not contain invalid method overrides.
Check details
Free
Reliability
Invalid Offset
Your application does not use invalid offsets.
Check details
Free
Reliability
Invalid Property Access
Your application does not access class properties in an invalid manner.
Check details
Free
Reliability
Invalid Return Type
Your application does not use invalid return types.
Check details
Free
Reliability
Maintenance Mode
Your application is not currently in maintenance mode.
Check details
Free
Reliability
Missing Model Relation
Your application does not refer to model relations that do not exist.
Check details
Free
Reliability
Missing Return Statement
Your application does not contain missing return statements.
Check details
Free
Reliability
Queue Timeout
An appropriate timeout and retry after is set for queues.
Check details
Free
Reliability
Syntax Error
There are no syntax errors in your application code.
Check details
Free
Reliability
Undefined Constant
Your application does not rely on undefined constants.
Check details
Free
Reliability
Undefined Variable
Your application does not reference undefined variables.
Check details
Free
Reliability
Unset
Your application does not try to unset undefined variables.
Check details
Free
Reliability
Up To Date Migrations
Migrations are up-to date.
Check details
Pro
Performance
CDN
Production assets are served from the configured CDN.
Check details
Pro
Performance
Command Constructor Injection
Artisan commands avoid constructor dependency injection.
Check details
Pro
Performance
Compression Header
HTTP responses use content compression.
Check details
Pro
Performance
Event Caching
Event discovery is cached appropriately for the current environment.
Check details
Pro
Performance
Fallback Route
The application avoids catch-all fallback routes.
Check details
Pro
Performance
HTTP Two
The production endpoint negotiates HTTP/2 or newer.
Check details
Pro
Performance
Redis Cache Hit Ratio
The Redis cache hit ratio meets the configured target.
Check details
Pro
Performance
Redis Rate Limiting
Redis-backed queues use Redis-specific rate limiting.
Check details
Pro
Performance
Redis Single Server
Single-server Redis connections use Unix sockets.
Check details
Pro
Performance
Redis Throttling
Redis-backed applications use Redis-specific request throttling.
Check details
Pro
Performance
Telescope Cache Hit Ratio
The Telescope cache hit ratio meets the configured target.
Check details
Pro
Performance
Telescope Duplicate Query
Telescope has not recorded duplicate queries within a request.
Check details
Pro
Performance
Telescope Memory Intensive Request
Requests stay below the configured memory threshold.
Check details
Pro
Performance
Telescope Model Hydration
Requests do not hydrate excessive numbers of Eloquent models.
Check details
Pro
Performance
Telescope N Plus One Query
Telescope has not recorded N+1 query patterns.
Check details
Pro
Performance
Telescope Non Queued Notification
Notifications recorded by Telescope are queued.
Check details
Pro
Performance
Telescope Slow Query
Telescope has not recorded slow database queries.
Check details
Pro
Performance
Telescope Slow Response
Responses stay below the configured duration threshold.
Check details
Pro
Performance
Xdebug
Xdebug is not loaded in production.
Check details
Pro
Security
Arbitrary File Upload
Uploaded files have explicit type restrictions.
Check details
Pro
Security
Clickjacking
HTTP responses prevent clickjacking.
Check details
Pro
Security
Column Name SQL Injection
User input is not used as a database column or ordering expression.
Check details
Pro
Security
Command Injection
User input is not interpolated into operating-system commands.
Check details
Pro
Security
Cookie Domain
Session cookies use a narrowly scoped domain.
Check details
Pro
Security
Debug Statement
Application code does not contain debug statements.
Check details
Pro
Security
Directory Traversal
User input is not used directly in filesystem paths.
Check details
Pro
Security
Eval
Application code does not use eval.
Check details
Pro
Security
Extract
Application code does not import untrusted array keys as variables.
Check details
Pro
Security
File Bomb Validation
Archive and XML uploads include file-bomb safeguards.
Check details
Pro
Security
File Size Validation
Uploaded files have explicit size limits.
Check details
Pro
Security
Hard Coded Credentials
Application code does not contain hard-coded credentials.
Check details
Pro
Security
Horizon Security
Horizon is isolated on a dedicated host.
Check details
Pro
Security
Host Injection
The application restricts trusted host names.
Check details
Pro
Security
Mime Sniffing
HTTP responses disable MIME sniffing.
Check details
Pro
Security
Nova Security
Nova is isolated on a dedicated host.
Check details
Pro
Security
Object Injection
Untrusted input is not passed to PHP deserialization.
Check details
Pro
Security
Open Redirection
Redirect destinations are not controlled by user input.
Check details
Pro
Security
Raw SQL Injection
Raw query expressions do not interpolate user input.
Check details
Pro
Security
Regex Dos
Regular-expression patterns are not controlled by users.
Check details
Pro
Security
SQL Injection
Native SQL execution does not receive user-controlled statements.
Check details
Pro
Security
Same Site Cookie
Session cookies use a safe SameSite policy.
Check details
Pro
Security
Secure Cookie
Session cookies are marked secure on HTTPS applications.
Check details
Pro
Security
Session Timeout
Session lifetime does not exceed the configured maximum.
Check details
Pro
Security
Telescope Security
Telescope is isolated on a dedicated host.
Check details
Pro
Security
Unrestricted File Upload
Uploaded files are not stored under user-controlled names.
Check details
Pro
Security
Validation SQL Injection
Database validation rules do not use user-controlled identifiers.
Check details
Pro
Security
Vite Subresource Integrity
Vite assets include Subresource Integrity hashes.
Check details
Pro
Security
Web Server Fingerprinting
HTTP responses do not expose server implementation details.
Check details
Pro
Reliability
Cache Busting
Frontend assets use cache-busting URLs.
Check details
Pro
Reliability
Composer Package Publish
Composer republishes vendor assets after package updates.
Check details
Pro
Reliability
Dead Route
All registered routes reference invokable actions.
Check details
Pro
Reliability
Disk Space
The application filesystem has sufficient free space.
Check details
Pro
Reliability
Failed Job Timeout
Failed jobs do not show timeout failures.
Check details
Pro
Reliability
Global Variable
Application code avoids globals, superglobals, and unsafe native APIs.
Check details
Pro
Reliability
Horizon Prefix
Horizon uses an application-specific Redis prefix.
Check details
Pro
Reliability
Horizon Provisioning Plan
Horizon has a provisioning plan for the current environment.
Check details
Pro
Reliability
Horizon Status
Laravel Horizon is running.
Check details
Pro
Reliability
PCNTL
Asynchronous queue workers have PCNTL support.
Check details
Pro
Reliability
Production Health Route
Production exposes Laravel's health route for orchestration and monitoring.
Check details
Pro
Reliability
Queue Blocking
Redis queue workers do not block indefinitely.
Check details
Pro
Reliability
Redis Eviction Policy
Redis eviction policies match each connection workload.
Check details
Pro
Reliability
Redis Prefix
Redis uses an application-specific key prefix.
Check details
Pro
Reliability
Redis Shared Database
Cache data is isolated from persistent Redis workloads.
Check details
Pro
Reliability
Redis Status
Configured Redis connections are reachable.
Check details
Pro
Reliability
Script Terminating Function
Application code avoids script-terminating constructs.
Check details
Pro
Reliability
Storage Link
Configured public storage links exist and target the right paths.
Check details
Pro
Reliability
Vite Production Build
Production uses a complete Vite build and not the development server.
Check detailsNo checks match these filters.
Try a broader search or reset one of the filters.