The summary.
PHP RUNS ON ESSENTIALLY ALL SHARED HOSTING, WHICH MATTERS WHERE THAT IS THE ACCESSIBLE OPTION
Verify the version serving pages matches the command-line version — they frequently differ and cause confusing failures.
KEEP CONTROLLERS THIN
Logic inside them cannot be reused or tested independently.
THE COMMONEST PERFORMANCE FAULT IS QUERYING INSIDE A LOOP
Load relationships in advance, and monitor query count per request during development. Nothing else reveals it.
RESTRICT MASS ASSIGNMENT
Otherwise a request can set fields it should not.
PLACE EVERYTHING EXCEPT THE ENTRY POINT OUTSIDE THE SERVED DIRECTORY
Then verify by requesting the configuration file in a browser. It must not be served.
Disable debug in production — it exposes paths, versions and sometimes credentials.
QUEUE WORKERS HOLD CODE IN MEMORY AND MUST BE RESTARTED AFTER EVERY DEPLOYMENT
Forgetting leaves old code running indefinitely.
