Advanced PHP: Architecture, Security and Scale

Before you start

• You have built and deployed a structured PHP application — the Practice course or equivalent (Composer, PDO, OOP, tests)
• You are comfortable with SQL beyond CRUD (joins, indexes) and with a Linux shell
• A VPS or local Docker setup with PHP 8.2+, MySQL/MariaDB and Redis to run the exercises against

Curriculum

Lesson 1 is free to read, no account needed. The rest unlock the moment you buy.

1. 1 How PHP executes — opcache, preloading, the JIT and PHP-FPM Preview free The request lifecycle from socket to bytecode, what each cache layer removes, why the JIT rarely matters for web apps, and how to size PHP-FPM from numbers instead of folklore. 4 min
2. 2 The modern type system, used on purpose Union, intersection and DNF types, readonly classes, enums with behaviour, first-class callables, attributes, never, and static analysis that turns all of it into compile-time guarantees. 4 min
3. 3 Dependency injection and a container you write yourself Why `new` inside a class is a design smell, constructor injection, a PSR-11 container with reflection-based autowiring, interface binding, singletons versus fresh instances, and the service-locator trap. 4 min
4. 4 PSR-7 messages and a PSR-15 middleware pipeline Replace globals with immutable request/response objects, compose cross-cutting concerns as middleware, and see that a router is just the last handler in the chain. 3 min
5. 5 Domain modelling — entities, value objects, aggregates and repositories Put the business rules in objects that don't know the database exists, decide aggregate boundaries by the invariants they protect, and keep persistence behind an interface. 5 min
6. 6 The database at scale — indexes, isolation, deadlocks and live migrations Reading EXPLAIN properly, composite and covering indexes, what REPEATABLE READ actually promises, optimistic versus pessimistic locking, a deadlock retry that works, and changing a 50-million-row table without downtime. 6 min
7. 7 Caching strategies — APCu, Redis, HTTP and the stampede Which cache for which data, cache-aside done correctly, invalidation by versioned keys, stampede protection with locks and early recomputation, and HTTP caching that lets browsers and CDNs do the work. 4 min
8. 8 Security in depth — the OWASP Top 10 in PHP terms Broken access control (the real number one), XSS by context, SSRF, deserialization, command injection, secrets and encryption at rest, timing attacks, dependency auditing, and the headers that make a browser your ally. 5 min
9. 9 Concurrency — parallel HTTP, queues with guarantees, locks and Fibers curl_multi for fan-out, a Redis queue with at-least-once delivery and idempotency keys, distributed locks that expire, long-running workers that shut down cleanly, and what Fibers are actually for. 5 min
10. 10 Multi-tenant SaaS architecture — one codebase, hundreds of hotels Tenant resolution from host or domain, shared-schema versus database-per-tenant with the trade-offs made explicit, repositories that can't forget the tenant, per-tenant config and storage, jobs that carry their tenant, billing state, onboarding and offboarding. 6 min
11. 11 Observability — logs you can query, errors you hear about, and the four numbers to alert on Structured JSON logging with Monolog, a request id that follows a request through PHP, the queue and the database, error tracking with releases, health checks that mean something, metrics and the alerts worth waking up for. 5 min
12. 12 Shipping — CI, zero-downtime deploys, expand/contract migrations, flags and versioning A GitHub Actions pipeline that runs static analysis, tests and an audit against a real database; atomic releases with opcache reset and FPM reload; migrations old and new code can both live with; feature flags per tenant; and semantic versioning for software you sell to others. 6 min

How it works

1. 1 · Buy once

   One payment in your own currency, no subscription. Your account is created from the email you pay with.

2. 2 · Log in and read

   Every lesson opens in your account on any device. Mark each one done and pick up where you left off.

3. 3 · Keep the Word file

   The whole course as a .docx — annotate it, print it, read it offline. Re-download it any time from your orders.

Where this course fits

1. PHP Foundations
2. →
3. PHP in Practice
4. →
5. Advanced PHP Architecture · you are here
6. →
7. Agentic AI Course

Questions about this course