- What is lox/xhprof and what does it do in Laravel?
- lox/xhprof is a fork of XHProf packaged for Composer, providing hierarchical PHP profiling that can be wired into Laravel through middleware or a prepend hook and configuration to enable or disable profiling. It is not a Laravel-native package, so expect custom glue for containers, middleware pipelines, and request lifecycle integration.
- How do I install lox/xhprof in a Laravel application?
- Install it with Composer, but plan for more than a composer require: the native XHProf PHP extension must be compiled, loaded, and compatible with your runtime. Add a disabled-by-default middleware or auto_prepend_file hook, pin the package and extension source, and verify xhprof_enable and xhprof_disable are available before relying on it.
- Does lox/xhprof require the XHProf PHP extension?
- Yes. The Composer package supplies the library portion, but meaningful profiling depends on the native XHProf extension being built and loaded. Confirm extension load order and that xhprof functions exist in both CLI and PHP-FPM before committing to a spike.
- Which Laravel and PHP versions are supported by lox/xhprof?
- There is no clear, maintained compatibility matrix for lox/xhprof, and the package is archived with unknown repository metadata. Validate against your exact PHP minor version, OPcache settings, Laravel release, and deployment model in a disposable environment. Do not assume support for newer Laravel or PHP releases without a proof of concept.
- How do I enable or disable profiling per request in Laravel?
- Use a Laravel middleware or prepend hook gated by configuration and environment variables, with profiling disabled by default. Enable it per request or for sampled traffic, and avoid capturing all production traffic because trace volume can grow quickly.
- Can lox/xhprof be used with Laravel Octane or Swoole?
- lox/xhprof is a poor fit for long-running workers such as Laravel Octane or Swoole unless carefully guarded and tested. XHProf was designed around traditional short-lived PHP-FPM requests, and silent incompatibility or memory growth is a risk under persistent runtimes. Validate explicitly before using it outside PHP-FPM.
- Is lox/xhprof safe for production?
- Treat it as a diagnostic capability, not a platform dependency. Production use carries high risk from unmaintained code, extension build fragility, CPU and memory overhead, storage growth, and sensitive trace data. If you proceed, limit it to opt-in or sampled requests, add access controls and retention limits, and assign an internal owner.
- Is lox/xhprof still maintained?
- No. The package is archived with only 35 stars, the repository metadata is unknown, and there is no active maintainer. That means no security fixes, bug fixes, or PHP-version upgrade support from upstream. Any adoption requires an internal fork policy and a documented exit plan.
- What are alternatives to lox/xhprof for Laravel profiling?
- Consider maintained profiling and observability tools such as Xdebug profiling, Tideways, or Blackfire, depending on your budget and deployment model. These alternatives generally offer better support, compatibility testing, and production safeguards than an archived XHProf fork.
- How should I handle trace storage and sensitive data with lox/xhprof?
- XHProf traces can contain request data, so design storage, access control, and retention before broad use. Capture to local storage in a spike, sanitize or restrict sensitive endpoints, and avoid retaining raw traces longer than needed. Do not expose trace files through public paths or shared logs.