# Laravel Small Business Kit

Prepared October 29, 2026. Companion: [Laravel for Small Business](https://jwatte.com/blog/laravel-small-business-guide/).

## What Laravel is

Laravel is an open source PHP web framework under the MIT license. A developer uses it to build web applications such as customer portals, job trackers and booking systems. It supplies common application parts, including database access, page templates, authentication starting points, background jobs and scheduled tasks. It does not supply your finished business process. See the [framework introduction](https://laravel.com/framework/docs/13.x/installation) and [license](https://raw.githubusercontent.com/laravel/framework/13.x/LICENSE.md).

Laravel 13 was released March 17, 2026 and requires PHP 8.3 or newer. Its [support table](https://laravel.com/framework/docs/13.x/releases) gives bug fixes through Q3 2027 and security fixes through March 17, 2028. A custom app needs a developer and ongoing upkeep. A brochure site or ordinary store may be better served by an existing website or commerce platform. This kit is a planning aid based on documentation, not an installation test or a quote.

## Decide: build, buy or use a Laravel based product

Write the problem in one sentence: ____________________.

Business size, locations and expected users: ____________________.

The person responsible for keeping the system working: ____________________.

1. **Buy** if a product already covers your main workflow and its limitations are tolerable. Try it with representative tasks before paying for custom work.
2. **Use a Laravel based product or toolkit** when it covers a substantial part of the requirement. [Statamic](https://statamic.com/) is a third party content management system. [Filament](https://filamentphp.com/) is a third party application and admin panel toolkit. Filament still requires development; it is not a finished business management system.
3. **Build** when an unusual, valuable process cannot be handled acceptably by existing software, and you can fund development and maintenance.

Decision checks:

* [ ] We have tried an existing product with a normal day's work and a difficult exception.
* [ ] We can name the exact requirement that justifies custom work.
* [ ] We have separated essential first release work from later requests.
* [ ] We have budgeted for updates, backups, restore tests and handover.
* [ ] We have identified sensitive records and asked which rules apply before storing them.
* [ ] We can export our data and have a way to keep working during an outage.
* [ ] We know who owns the source code, accounts and custom work.

Chosen path and reason: ____________________.

For accounting and tax document portals, check the GLBA Safeguards Rule and [FTC guidance](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know) with an adviser before storing tax records or Social Security numbers. For payments, check [PCI DSS responsibilities](https://www.pcisecuritystandards.org/merchants/) with the processor and avoid collecting card details in your own database. Laravel itself is not a compliance certification.

## Hosting comparison

Prices read October 29, 2026, USD before tax except the euro billing qualification. The rows describe different services. A platform fee, a server rental and a panel subscription are not complete application budgets.

| Provider and plan | Published price | What it manages | Catch |
|---|---|---|---|
| [Laravel Cloud Starter](https://laravel.com/cloud/pricing) | $5/month plus usage; $5 monthly usage credit | First party Laravel platform and deployment | Starter targets prototypes; compute, databases and workers affect the bill. Growth is $20/month plus usage. |
| [Laravel Forge Hobby](https://laravel.com/forge/pricing) | $12/month plus server | First party server provisioning and deployment | One external server; Growth is $19/month for unlimited servers. Application upkeep remains yours. |
| [Laravel Vapor Unlimited Monthly](https://vapor.laravel.com/) | $39/month plus AWS; $399/year option | First party AWS Lambda deployment platform | AWS infrastructure and usage are additional. |
| [Vultr Cloud Compute Regular, 4 GB](https://www.vultr.com/pricing/) | $20/month listed | 2 vCPU, 4 GB RAM, 80 GB SSD virtual server | You manage software; Forge costs extra. The 2 GB, 1 vCPU plan is $10. Prices vary by region. |
| [DigitalOcean Basic Regular, 4 GiB](https://www.digitalocean.com/pricing/droplets) | $24 monthly cap | 2 vCPU, 4 GiB RAM, 80 GiB virtual server | Server administration and backup storage are additional. |
| [DigitalOcean App Platform Shared Fixed, 512 MiB](https://www.digitalocean.com/pricing/app-platform) | $5/container/month | Managed builds and runtime | Entry size, not a sizing recommendation; worker and database cost extra. |
| [Akamai Cloud Linode 4GB](https://api.linode.com/v4/linode/types) | $24/month at base US locations | 2 vCPU, 4 GiB RAM, 80 GB virtual server | You manage software; optional server backups cost extra. |
| [Hetzner CX23, Germany/Finland](https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/) | $6.49 monthly cap, excluding IPv4 | 2 shared vCPU, 4 GB RAM, 40 GB virtual server | [Product page](https://www.hetzner.com/cloud/cost-optimized/) marked it unavailable at our read. Check capacity; IPv4 and backups extra. |
| [Ploi Basic](https://ploi.io/pricing) | $10/month displayed USD; €8 base | Third party Laravel aware server panel | Server bill extra; dollar conversion varies. Panel support does not maintain your custom app. |
| [Hostinger Premium web hosting](https://www.hostinger.com/web-hosting) | $2.49/month equivalent; $119.52 upfront for 48 months | Shared hosting, server upkeep, weekly backups | Renewal $10.99/month equivalent for the same term. Confirm current Laravel and worker support. |

[Forge's current provider list](https://laravel.com/forge/docs/server-providers) includes Laravel VPS, DigitalOcean, [Akamai / Linode](https://api.linode.com/v4/linode/types), Vultr, Amazon AWS outside GovCloud, Hetzner Cloud and your own server. [App Platform supports PHP and Laravel detection](https://docs.digitalocean.com/products/app-platform/reference/buildpacks/php/). [Ploi documents Laravel features](https://ploi.io/laravel-optimized). Application development remains a separate responsibility in each case.

Vultr documents a [LEMP Marketplace app](https://docs.vultr.com/how-to-use-vultrs-lemp-marketplace-application). Its separate [Laravel app listing](https://www.vultr.com/marketplace/apps/laravel/) showed Laravel 11.11.1 with Apache. Laravel 11's security support ended March 12, 2026. Upgrade to supported components before production use. Use Laravel's own MIT license as authoritative when a marketplace label differs.

[Hostinger's support guide](https://www.hostinger.com/support/which-programming-languages-and-frameworks-are-supported-at-hostinger/) documents Laravel on Web and Cloud hosting but names Laravel 12 in its installer discussion. Confirm Laravel 13 support and the exact process limits before purchase. Shared hosts may restrict persistent queue workers, SSH, Composer and available PHP versions.

## Production readiness checklist

Use the [Laravel deployment guide](https://laravel.com/framework/docs/13.x/deployment) and ask the developer to record evidence beside each item. Mark a feature not applicable only with a reason.

* [ ] PHP is compatible and supported. Laravel 13 requires PHP 8.3 or newer. Check the [PHP support calendar](https://www.php.net/supported-versions.php).
* [ ] Required extensions are present: Ctype, cURL, DOM, Fileinfo, Filter, Hash, Mbstring, OpenSSL, PCRE, PDO, Session, Tokenizer and XML.
* [ ] Composer dependencies can be installed from the recorded project version. Database driver and database access work.
* [ ] The web server points to `public/`. Configuration and source directories are outside the public document root.
* [ ] `storage` and `bootstrap/cache` have the intended write permissions without making the whole project broadly writable.
* [ ] HTTPS works and renewal has an owner. SSH or a deployment tool provides controlled access.
* [ ] Production has `APP_DEBUG=false`. Plaintext `.env` is excluded from source control and protected from public access.
* [ ] `APP_KEY` and other recovery secrets are stored securely, separately from ordinary documentation. Key rotation follows Laravel's documented procedure.
* [ ] If using asynchronous queues, workers have a supervisor, failed jobs have an owner, and workers reload after deployment.
* [ ] The scheduler runs once per minute through cron or the platform's documented equivalent. A scheduled task has been observed completing.
* [ ] Authentication, staff roles and access to other customers' records have been tested.
* [ ] Uploaded documents are private by default, with file restrictions and a retention policy.
* [ ] Repeated payment notifications do not create duplicate bookings or charges. Payment failures have a visible recovery process.
* [ ] Database, uploads and protected recovery information are backed up separately from the server.
* [ ] A restore has been demonstrated and the business has agreed how much data loss and downtime it can accept.
* [ ] Dependency and framework updates have an owner, schedule and test process. Urgent security notices have an escalation route.
* [ ] Error reports, queue failures and independent availability monitoring reach a named person.
* [ ] The business has approved the first release against written acceptance criteria.

Laravel's template includes [Apache rewrite configuration](https://raw.githubusercontent.com/laravel/laravel/13.x/public/.htaccess); its deployment guide includes Nginx configuration. Either still needs correct PHP handling and a safe document root. Check the [queue guide](https://laravel.com/framework/docs/13.x/queues), [scheduler guide](https://laravel.com/framework/docs/13.x/scheduling), [configuration guide](https://laravel.com/framework/docs/13.x/configuration) and [encryption guide](https://laravel.com/framework/docs/13.x/encryption) rather than copying an old tutorial.

The [January 16, 2024 CISA/FBI Androxgh0st advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a) describes attacks on exposed Laravel configuration and credentials. The older [Ignition remote code execution patch](https://github.com/facade/ignition/pull/334), associated with CVE-2021-3129, is another reason to track dependencies and keep development debugging out of production.

## Cost worksheet

These are planning assumptions, not promised project hours. An agency or freelancer bills more than an employee compensation estimate. Ask for an actual quote and replace every assumption that does not fit.

| Input | Your low estimate | Your high estimate |
|---|---|---|
| Business users and locations | ____ | ____ |
| Development hours | ____ | ____ |
| Developer hourly cost | ____ | ____ |
| Server setup hours | ____ | ____ |
| Server administration hourly cost | ____ | ____ |
| Servers and monthly server charges | ____ | ____ |
| Monthly panel or platform fee | ____ | ____ |
| Retained backup GB, including versions | ____ | ____ |
| Monthly backup storage and transfer cost | ____ | ____ |
| Monthly administration hours | ____ | ____ |
| Monthly application maintenance hours | ____ | ____ |
| Other recurring costs: database, messages, monitoring | ____ | ____ |
| Alternative SaaS plan, users and billing term | ____ | ____ |
| Alternative setup and monthly price | ____ | ____ |
| Migration, training, payment fees and optional services | ____ | ____ |

Development rate in the examples: $65.38 / 0.700 = **$93.40/hour**, using the May 2025 [BLS Software Developers median](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151252&year=2025) and June 2026 [ECEC private industry wage share](https://data.bls.gov/timeseries/CMU2020000000000P) of 70.0%. Server administration: $47.66 / 0.700 = **$68.09/hour**, rounded to cents, from the [systems administrator profile](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151244&year=2025).

Our hosting assumption is one DigitalOcean Basic Regular 4 GiB server at $24/month. Server setup is 4 to 12 hours; ongoing administration is 1 to 3 hours monthly. These are one server planning ranges, not tested capacity or service guarantees. Application maintenance is additional.

Our backup assumption is 50 to 200 GB retained in [Backblaze B2](https://www.backblaze.com/cloud-storage/pricing), priced at $6.95/TB/month with 10 GB free. Monthly storage = max(0, retained GB minus 10) × $0.00695, giving $0.278 to $1.3205. Restore traffic is assumed within the included allowance of three times average stored data, with no chargeable API use. Add actual transfer and API charges if that assumption fails.

1. Setup = development hours × developer rate + server setup hours × administrator rate + other setup costs.
2. Monthly = hosting + backups + platform fees + administration hours × administrator rate + application maintenance hours × developer rate + other monthly costs.
3. Custom 36 month total = setup + 36 × monthly.
4. Alternative 36 month total = alternative setup + 36 × alternative monthly price.
5. Saving = alternative total minus custom total. A negative result means the custom app costs more.
6. If custom monthly cost is lower, break even = setup cost difference / monthly saving, rounded up to a whole month, with a minimum of zero. If custom setup and monthly costs are both higher, break even is never from subscription savings alone.

Calculate with unrounded amounts, then round displayed totals to whole dollars. Our comparisons exclude migration, training, payment fees, hardware, optional messaging, specialist compliance and serious incidents on both sides. Add them to the actual decision. SaaS onboarding is assumed to cost $0; verify in a quote.

### One salon: Square Plus against a custom booking app

[Square's US Appointments page](https://squareup.com/us/en/appointments/pricing) lists Square Free at $0, Plus at $49 per location per month, and Premium at $149. We compare one location on Plus, month by month, with no introductory discount. Our custom app assumptions are 80 to 160 build hours and 1 to 3 application maintenance hours monthly, in addition to server administration.

| Cost | Square Plus | Laravel low | Laravel high |
|---|---:|---:|---:|
| Build and server setup | $0 assumed | $7,744 | $15,761 |
| Monthly subscription or operations | $49 | $186 | $510 |
| 36 month total | $1,764 | $14,432 | $34,114 |
| Extra cost of custom app over 36 months | Reference | $12,668 | $32,350 |
| Break even from subscription savings | Reference | Never | Never |

Buying wins decisively for ordinary booking. Square's free plan may make the comparison even stronger if it meets the business's needs. Payment fees, hardware, SMS, migration and training are excluded on both sides and must be priced separately; this compares subscription and software ownership costs, not every operating expense. The custom app is narrower than Square's full product.

### Five HVAC users: Jobber Connect against a job tracker

[Jobber Connect](https://www.getjobber.com/pricing/), with the team size set to two to five people and monthly billing without a commitment, costs $199 a month and includes five users. We use the regular price and exclude temporary promotions. Our custom app assumptions are 120 to 240 build hours and 2 to 4 maintenance hours monthly, plus server administration.

| Cost | Jobber Connect | Laravel low | Laravel high |
|---|---:|---:|---:|
| Build and server setup | $0 assumed | $11,480 | $23,233 |
| Monthly subscription or operations | $199 | $279 | $603 |
| 36 month total | $7,164 | $21,530 | $44,948 |
| Extra cost of custom app over 36 months | Reference | $14,366 | $37,784 |
| Break even from subscription savings | Reference | Never | Never |

The Laravel estimate is for the narrow tracker described above, not a duplicate of Jobber. Payment charges, optional services, migration and training remain outside the totals. We assume no paid SaaS onboarding; confirm that in the quote. Annual or committed pricing may lower the subscription cost further, but it is a different buying decision.



Both examples favor buying for the described ordinary workflow. A custom app is narrower than the established product and needs a separate business benefit to justify its extra cost. Do not count a subscription saving and the same avoided staff task twice.

## Handover checklist

* [ ] The business owns the source repository, hosting account, domain, payment account and backup account.
* [ ] The contract states who owns custom code and identifies third party licenses.
* [ ] The repository contains the complete source, dependency lock files and documented deployment steps.
* [ ] Tests and a separate test environment are available to the next developer.
* [ ] A named person knows how to restore the database and uploaded files.
* [ ] The business can recover necessary secrets securely without asking the departing developer.
* [ ] Account recovery and multifactor authentication belong to the business; no shared personal login is required.
* [ ] Server, queue and scheduler processes are documented, with monitoring and failure procedures.
* [ ] Framework, PHP, database and package versions are recorded with their update responsibilities.
* [ ] Outstanding bugs, unpaid service commitments and license renewals are listed.
* [ ] A new maintainer has completed a test deployment and restore using the handover instructions.
* [ ] Departing personnel's access is removed and exposed credentials are rotated through an agreed procedure.

Handover accepted by: ____________________. Date: ____________________.

## Questions for the developer

1. Which part of this process requires custom software? Show why a packaged product will not work.
2. What is included in the first release, and what is explicitly outside the quote?
3. Which third party components will you use, and who maintains our changes to them?
4. Can you demonstrate denied access to another customer's document and recovery from a failed background job?
5. How do you prevent duplicate effects when a payment notification arrives twice?
6. What is the update budget, including PHP and Laravel major upgrades?
7. Who responds to a security issue or outage when you are unavailable?
8. Can another developer deploy and restore the application from your handover material?

## Questions for the host or platform

1. Does this exact plan support our PHP version, required extensions and Composer workflow?
2. Can we run persistent queue workers, and what happens when one exits?
3. How do scheduled tasks run, and how can we verify they completed?
4. Can the document root point to `public/`, with configuration kept private?
5. What SSH or deployment access is included? What account and process limits apply?
6. Which database, worker, storage, backup and transfer charges are additional?
7. What are the initial commitment, renewal price, currency and taxes?
8. Who updates the operating system and PHP, and what does support exclude?
9. Can we export everything and restore elsewhere? What retention and recovery options are actually included?

## Sources and observation dates

Observation times are UTC. The prices are a dated comparison, not a quote.

1. [framework introduction](https://laravel.com/framework/docs/13.x/installation). Read October 29, 2026, 21:48 UTC.
2. [license](https://raw.githubusercontent.com/laravel/framework/13.x/LICENSE.md). Read October 29, 2026, 21:47 UTC.
3. [support table](https://laravel.com/framework/docs/13.x/releases). Read October 29, 2026, 21:47 UTC.
4. [Statamic](https://statamic.com/). Read October 29, 2026, 21:47 UTC.
5. [Filament](https://filamentphp.com/). Read October 29, 2026, 21:47 UTC.
6. [FTC guidance](https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know). Read October 29, 2026, 22:05 UTC in a regular browser; it lists tax preparation firms among the financial institutions the rule covers.
7. [PCI DSS responsibilities](https://www.pcisecuritystandards.org/merchants/). Read October 29, 2026, 21:57 UTC.
8. [Laravel Cloud Starter](https://laravel.com/cloud/pricing). Read October 29, 2026, 21:46 UTC.
9. [Laravel Forge Hobby](https://laravel.com/forge/pricing). Read October 29, 2026, 21:46 UTC.
10. [Laravel Vapor Unlimited Monthly](https://vapor.laravel.com/). Read October 29, 2026, 21:46 UTC.
11. [Vultr Cloud Compute Regular, 4 GB](https://www.vultr.com/pricing/). Browser review received October 29, 2026, 21:53 UTC.
12. [DigitalOcean Basic Regular, 4 GiB](https://www.digitalocean.com/pricing/droplets). Read October 29, 2026, 21:46 UTC.
13. [DigitalOcean App Platform Shared Fixed, 512 MiB](https://www.digitalocean.com/pricing/app-platform). Read October 29, 2026, 21:46 UTC.
14. [Akamai Cloud Linode 4GB](https://api.linode.com/v4/linode/types). Read October 29, 2026, 21:46 UTC.
15. [Hetzner CX23, Germany/Finland](https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/). Read October 29, 2026, 21:47 UTC.
16. [Product page](https://www.hetzner.com/cloud/cost-optimized/). Read October 29, 2026, 21:50 UTC.
17. [Ploi Basic](https://ploi.io/pricing). Read October 29, 2026, 21:46 UTC.
18. [Hostinger Premium web hosting](https://www.hostinger.com/web-hosting). Read October 29, 2026, 21:46 UTC.
19. [Forge's current provider list](https://laravel.com/forge/docs/server-providers). Read October 29, 2026, 21:46 UTC.
20. [App Platform supports PHP and Laravel detection](https://docs.digitalocean.com/products/app-platform/reference/buildpacks/php/). Read October 29, 2026, 21:46 UTC.
21. [Ploi documents Laravel features](https://ploi.io/laravel-optimized). Read October 29, 2026, 21:47 UTC.
22. [LEMP Marketplace app](https://docs.vultr.com/how-to-use-vultrs-lemp-marketplace-application). Read October 29, 2026, 21:47 UTC.
23. [Laravel app listing](https://www.vultr.com/marketplace/apps/laravel/). Browser review received October 29, 2026, 21:53 UTC.
24. [Hostinger's support guide](https://www.hostinger.com/support/which-programming-languages-and-frameworks-are-supported-at-hostinger/). Read October 29, 2026, 21:46 UTC.
25. [Laravel deployment guide](https://laravel.com/framework/docs/13.x/deployment). Read October 29, 2026, 21:46 UTC.
26. [PHP support calendar](https://www.php.net/supported-versions.php). Read October 29, 2026, 21:47 UTC.
27. [Apache rewrite configuration](https://raw.githubusercontent.com/laravel/laravel/13.x/public/.htaccess). Read October 29, 2026, 21:47 UTC.
28. [queue guide](https://laravel.com/framework/docs/13.x/queues). Read October 29, 2026, 21:47 UTC.
29. [scheduler guide](https://laravel.com/framework/docs/13.x/scheduling). Read October 29, 2026, 21:47 UTC.
30. [configuration guide](https://laravel.com/framework/docs/13.x/configuration). Read October 29, 2026, 21:47 UTC.
31. [encryption guide](https://laravel.com/framework/docs/13.x/encryption). Read October 29, 2026, 21:47 UTC.
32. [January 16, 2024 CISA/FBI Androxgh0st advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a). Read October 29, 2026, 21:47 UTC.
33. [Ignition remote code execution patch](https://github.com/facade/ignition/pull/334). Read October 29, 2026, 21:47 UTC.
34. [BLS Software Developers median](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151252&year=2025). Read October 29, 2026, 21:46 UTC.
35. [ECEC private industry wage share](https://data.bls.gov/timeseries/CMU2020000000000P). Read October 29, 2026, 21:47 UTC.
36. [systems administrator profile](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151244&year=2025). Read October 29, 2026, 21:12 UTC.
37. [Backblaze B2](https://www.backblaze.com/cloud-storage/pricing). Read October 29, 2026, 21:10 UTC.
38. [Square's US Appointments page](https://squareup.com/us/en/appointments/pricing). Read October 29, 2026, 21:47 UTC.
39. [Jobber Connect](https://www.getjobber.com/pricing/). Browser review received October 29, 2026, 21:53 UTC.

*This kit is informational, not legal or financial advice. Product names identify the products discussed. No affiliation or endorsement is implied.*