Laravel hosting: PHP version, extensions, queue workers and the plan you actually need

TL;DR: Laravel 13, released on 17 March 2026, needs PHP 8.3 at minimum and works best on 8.4. Beyond the version, a real Laravel app needs SSH and Composer access, a document root pointing at the public folder, a cron entry for the scheduler and, for most apps, a queue worker that stays running. Basic shared hosting rarely allows the last two. A small VPS does, and is the safest default for anything beyond a brochure site.

Which PHP version Laravel needs right now

Laravel follows a fixed support policy: roughly 18 months of bug fixes and two years of security fixes for each major version, and no long-term-support release since Laravel 6. As of late October 2026 the position is:

Laravel version	Minimum PHP	Status
13	8.3 (8.4 recommended)	Current, released 17 March 2026
12	8.2	Bug fixes ended 13 August 2026, security fixes until 24 February 2027
11	8.2	Security support ended 12 March 2026
10	8.1	Out of support

Some sources report that later Laravel 13 point releases effectively need PHP 8.4 because of the Symfony 8 components they pull in, so choose PHP 8.4 for a new project and you will not hit surprises. If you run Laravel 11 or older in production, plan the upgrade now, because no further security fixes arrive.

The PHP version also matters for security. Two critical PHP engine flaws were patched on 21 October 2026, so whichever branch you run, make sure it is a patched build. The details are in our PHP2Shell guide.

The PHP extensions Laravel expects

Laravel's documentation lists a standard set of extensions. Most good hosts enable them by default, but confirm before you buy:

• Ctype, cURL, DOM, Fileinfo, Filter, Hash
• Mbstring, OpenSSL, PCRE, PDO and the driver for your database (pdo_mysql, pdo_pgsql)
• Session, Tokenizer, XML

Add redis or phpredis if you use Redis for cache, sessions or queues, gd or imagick for image work, and zip for packages that unpack archives. Also confirm that OPcache is enabled in production, since it makes a large difference to response time.

What a Laravel host must allow

A host can advertise PHP and MySQL and still be a poor fit. Check these six things:

1. SSH access. Without it you cannot run composer install, php artisan migrate or php artisan optimize. Uploading a pre-built vendor folder over FTP is fragile and slow.
2. Composer 2. Installed globally or available to you.
3. A configurable document root. Laravel must be served from the public directory. If your plan forces the web root to be the account's main folder, you end up exposing .env and application code, which is a serious security failure. Never solve this by copying the framework into the web root.
4. Cron. The scheduler needs a single entry running every minute: * * * * * cd /path/to/app && php artisan schedule:run >> /dev/null 2>&1.
5. A long-running process for queues. Mail, notifications, exports and webhooks belong in queued jobs. A worker started with php artisan queue:work must stay alive and restart after a crash or deploy. On a VPS you manage it with systemd or Supervisor.
6. Writable storage and bootstrap/cache. The web user needs write access to both, and nothing else.

Keep secrets in .env outside version control and set APP_DEBUG=false in production. Our guide to environment variables and secrets covers the habits that stop credentials leaking.

Shared hosting, VPS or platform: where each fits

Shared hosting works for a small Laravel site that sends little mail and needs no background jobs, provided the host gives SSH, Composer and a configurable document root. You can approximate a queue by running queue:work --stop-when-empty from cron every minute, but that is a workaround, and anything time-sensitive suffers.

A VPS is the sensible default for a real application. You control PHP versions, run workers under systemd, add Redis, schedule jobs and tune the server. The trade-off is that you are responsible for updates and security, so work through the first ten things to do on a new Linux VPS and set up Git-based deployment so releases are repeatable.

A managed platform such as a PaaS removes server work in exchange for higher cost and less control. It suits teams without anyone comfortable on a server, but compare the bill carefully once traffic grows.

If you are unsure whether you have outgrown shared hosting, the seven signals that you need a VPS are a good test.

How much server you need

There is no universal number, because Laravel apps vary widely. As rough starting points:

• Small site, low traffic: 1 vCPU and 1 to 2 GB of RAM can run PHP-FPM, Nginx and a small database, though a database on the same box is tight at 1 GB.
• Typical business application with a queue worker and Redis: 2 vCPU and 4 GB of RAM leaves room for growth.
• Heavy imports, reports or image processing: size up and consider running the queue worker on a separate machine.

Treat these as starting points and measure. Watch memory and CPU after launch and resize when the numbers say so. Rotate logs from day one, because a busy app fills a small disk faster than expected, as our guide to log rotation on a VPS explains.

A deployment checklist

• Choose PHP 8.4 and confirm the build is patched
• Point the web server at public and block access to dotfiles
• Run composer install --no-dev --optimize-autoloader
• Set APP_ENV=production and APP_DEBUG=false, then generate APP_KEY
• Run php artisan migrate --force
• Cache configuration, routes and views with php artisan optimize
• Add the scheduler cron entry
• Start the queue worker under systemd or Supervisor, and restart it on each deploy
• Install an SSL certificate and automate renewal
• Back up the database and storage folder off the server

FAQs

Which PHP version should I use for a new Laravel project?

Use PHP 8.4. Laravel 13 requires 8.3 at minimum and recommends 8.4, and 8.4 receives security fixes for longer than 8.3.

Can Laravel run on cheap shared hosting?

A small app can, if the plan includes SSH, Composer and a configurable document root. Without those, deployment becomes risky and unmaintainable, so check before buying.

Do I need a queue worker?

If your app sends email, processes uploads, calls external APIs or handles webhooks, yes. Running those inside the web request makes pages slow and fragile.

How do I run the scheduler?

Add one cron entry that runs php artisan schedule:run every minute. Laravel then decides which scheduled tasks are due.

Is it safe to put the whole Laravel folder in public_html?

No. Only the public directory should be web-accessible. Putting the whole project there can expose .env, which contains database passwords and keys.

Should I use MySQL, MariaDB or PostgreSQL?

All are supported. MySQL and MariaDB are the most commonly available on Indian hosts, and Laravel handles the differences. Pick what your team already operates well.

How often should I update Laravel and PHP?

Apply security patches promptly, and move to the next major Laravel version before the current one loses security support. Test on staging first.

Does Laravel need Redis?

Not at the start. File or database cache and queues work for small apps. Add Redis when queue throughput or cache speed becomes a bottleneck.

Conclusion

Laravel hosting comes down to a short list: a supported PHP version, the right extensions, SSH and Composer, a correct document root, a scheduler and a persistent queue worker. Plans that meet all six are usually a VPS, while basic shared hosting suits only the simplest apps.

If you are moving a Laravel app to a server you control, HostCloud's VPS options give you the access and resources it needs. See the plans at https://hostcloud.in.

Sources:

• Laravel PHP compatibility matrix, April 2026
• What We Know About Laravel 13, Laravel News
• PHP ships emergency patches for critical PHP2Shell flaws, BleepingComputer