AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data rooms
10 business days
To start a PHP engagement
Scoping through first sprint
100%
Senior engineers, US-based
No offshore handoff
Every sprint
Working software on a preview URL
Not a status deck between milestones
100%
Code and repositories you own
From the first commit
Where PHP still does the heavy lifting
The systems a huge share of the web still runs on PHP
PHP's reputation lags its actual footprint. It's the language under most of the content management and eCommerce platforms businesses already run, whether or not "PHP" is the word anyone uses to describe the project.
Content management systems
WordPress, Joomla, and Drupal are all PHP applications at their core. Custom theme and plugin development, and CMS platforms built to fit a workflow none of the big three quite match, are still a large share of real PHP work.
eCommerce platforms
Magento and WooCommerce — the two most widely used eCommerce platforms — are both PHP. Custom storefronts, checkout customization, and platform migrations are common, concrete PHP projects, not an edge case.
Custom APIs and backends
PHP is a legitimate, mature choice for a server-side API or backend, particularly for teams already running PHP elsewhere in their stack, or building something that will eventually integrate with a PHP-based CMS.
Server-side rendered, content-heavy sites
For sites where most pages are read more than they're interacted with, PHP's server-side rendering model is simple, fast, and doesn't need a JavaScript build pipeline just to display text.
What's involved
PHP engagement types
What moves the scope is whether the work builds on an existing platform (WordPress, WooCommerce, Magento) or is a custom application from scratch, and how far behind current the PHP version and dependencies are on anything already live.
| Engagement | Commitment | Timeline | What's included |
|---|---|---|---|
| Custom PHP application or API | Fixed scope | 8 – 16 weeks | A framework-based (typically Laravel) or framework-free PHP application built on current PHP 8, with a database layer and test suite from the start. |
| WordPress custom development | Fixed scope | 3 – 10 weeks | Custom theme or plugin development, or a headless WordPress build serving content to a separate front end, matched to what the project actually needs. |
| eCommerce build (WooCommerce or Magento) | Fixed scope | 6 – 14 weeks | A storefront built or customized on an existing eCommerce platform, or evaluated against a custom build when the platform's constraints don't fit. |
| Legacy PHP version upgrade | Fixed scope | 2 – 8 weeks | An application on an unsupported PHP 5 or PHP 7 version brought to current PHP 8, addressing deprecated functions and breaking changes along the way. |
| Dedicated PHP engineer | Staff augmentation | Ongoing | A senior PHP engineer embedded in your team and sprint process, working in your repository rather than as a separate outside workstream. |
Ranges assume US-based senior engineers and include test coverage and a security review rather than treating those as add-ons a cheaper quote strips out. A legacy PHP version is the fastest way to turn a small update into a large one — see the FAQ below on why that timing matters.
The language itself
PHP 8 is not the PHP your last vendor learned it on
A lot of PHP's dated reputation is really a description of PHP 5 — a loosely typed, forgiving scripting language with few guardrails. PHP 8 is a meaningfully different language to write and to maintain.
Strict types and typed properties
PHP 8 supports strict type declarations for function parameters, return values, and class properties, catching an entire class of bugs — the wrong data shape passed into a function — before they reach production instead of failing silently or coercing unpredictably the way older PHP would.
Enums
Native enums, added in PHP 8.1, replace the class-constant workarounds PHP developers used for years to represent a fixed set of values, with real type safety the old pattern never had.
Readonly properties and named arguments
Readonly properties let a class guarantee a value is set once and never changed, closing off an entire category of accidental-mutation bugs. Named arguments make a function call self-documenting at the call site, which matters most in APIs and frameworks with many optional parameters.
A real performance jump from the JIT compiler
PHP 8's Just-In-Time compiler improves performance on CPU-heavy code paths meaningfully over PHP 7, on top of PHP's already-mature opcode caching — a real, measurable gain, not a marketing claim.
There's still no formal language specification
PHP has no official written standard — what counts as idiomatic PHP is set by community convention (PSR standards from the PHP-FIG group) rather than a language spec. That makes code style and static analysis tooling (like PHPStan or Psalm) worth adopting deliberately rather than assuming the language itself enforces consistency.
Framework and platform decisions
The choices that actually shape a PHP project
Most of the cost in a PHP project is decided by which of these choices gets made, not by how many pages or features are on the list.
Laravel vs. Symfony vs. no framework
Laravel is the most widely adopted modern PHP framework, with strong conventions, an active ecosystem, and a lower learning curve for most teams. Symfony offers more granular, swappable components and tends to fit larger enterprise applications with specific architectural requirements. A simple script, a small internal tool, or a single WordPress plugin often doesn't need either — framework overhead is a cost, not a default good.
Custom WordPress theme or plugin, honestly scoped
Customizing WordPress's existing back end covers a large share of what businesses actually need. A fully custom theme or plugin is worth it when the design or functionality genuinely can't be achieved by configuring what already exists — not as the default starting point for every WordPress project.
When WordPress's data model doesn't fit
Some applications are shaped enough like content management that WordPress feels tempting, but have data relationships or workflows WordPress's post-and-page model doesn't represent cleanly. Forcing that mismatch usually costs more in workarounds than building a purpose-built PHP application from the start.
Headless WordPress
Running WordPress purely as a content API, with a separate front end (often a JavaScript framework) consuming it, is a legitimate and increasingly common pattern — it keeps WordPress's mature content-editing experience while freeing the front end from its templating system entirely.
WooCommerce vs. Magento vs. custom
WooCommerce fits most WordPress-based stores well and inherits WordPress's plugin ecosystem. Magento is built specifically for larger, more complex catalogs and B2B commerce requirements. A fully custom build is worth it only when both platforms' constraints genuinely conflict with the business's actual requirements — which is less common than it might seem.
Composer and dependency management
Modern PHP development runs on Composer for dependency management, the same way Node.js runs on npm. A `composer.lock` file and a policy on adding new dependencies matter here for the same supply-chain-security reasons they matter in any language's ecosystem.
Security and version currency
Why the PHP version running your app is a security decision, not a settings toggle
PHP versions have a defined active-support and security-support window, the same as any modern language runtime. Running past it isn't a style choice.
Unsupported PHP versions stop receiving security patches
Once a PHP version reaches end of life, newly discovered vulnerabilities in the language itself go unpatched. An application still running PHP 5 or an old PHP 7 minor version is carrying that risk indefinitely, independent of how well-written the application code on top of it is.
Prepared statements over raw SQL, without exception
SQL injection remains one of the most common real-world PHP vulnerabilities, almost always traceable to string-concatenated queries instead of prepared statements or an ORM (like Laravel's Eloquent). This is one of the cheapest fixes in software and one of the most consequential to skip.
Hosting and cPanel version mismatches break apps silently
Many PHP hosting environments (cPanel-based hosts especially) let you select which PHP version runs a site, separate from what the application's code was written against. A mismatch here doesn't always throw a clear error — it can produce silent failures or deprecation warnings that look like bugs in the application itself.
Static analysis catches what PHP's flexibility hides
Because PHP has no formal spec enforcing strictness, tools like PHPStan or Psalm are worth running in CI to catch type mismatches and undefined-behavior patterns PHP itself will happily run without complaint until the exact wrong input arrives in production.
Related
Related services
What PHP work usually connects to.
Questions
Common questions about PHP development
What teams ask before a first call.
PHP is a server-side scripting language, most visibly powering the content management systems (WordPress, Joomla, Drupal) and eCommerce platforms (Magento, WooCommerce) that run a large share of the web. It's also a legitimate choice for custom backends and APIs, particularly for teams already running PHP elsewhere.
Most real PHP work today falls into one of two buckets: customizing or extending an existing PHP-based platform, or building a custom application on a modern framework like Laravel.
What actually drives the number is the type of work: customizing an existing WordPress or WooCommerce site is a smaller scope than a custom application built from scratch, and upgrading a legacy PHP 5 or PHP 7 codebase is priced differently than either. A dedicated engineer joining your team on an ongoing basis is a different commitment than a fixed-scope project.
A short scoping call, looking at any existing codebase, gets you a real number for your specific project faster than a general estimate would.
For the jobs it's actually suited to — building on WordPress or WooCommerce, or a team already running PHP elsewhere in its stack — yes, and PHP 8's strict typing, enums, and performance improvements have closed a real gap with newer languages. For a greenfield project with no existing PHP investment and no CMS requirement, Node.js, Python, or another language might fit better depending on the team and the workload.
We'll recommend based on what the project actually needs and what you're already running, not out of habit toward one language over another.
Yes. We build custom themes and plugins when WordPress's existing back end and available plugins genuinely can't achieve what the project needs — a design that doesn't fit an existing theme, or functionality specific enough that no plugin covers it well.
Where WordPress's post-and-page data model doesn't fit the application's actual data relationships, we'll say so and scope a purpose-built PHP application instead, rather than forcing WordPress to do a job it wasn't built for.
WooCommerce is the strongest fit for most WordPress-based stores, inheriting WordPress's plugin ecosystem and content tools. Magento is built for larger, more complex catalogs and B2B commerce requirements that outgrow WooCommerce's assumptions. A fully custom build earns its cost only when both platforms' constraints genuinely conflict with real business requirements, which is less common than a first instinct toward "custom" usually suggests.
We'll evaluate against your actual catalog size, checkout requirements, and integrations before recommending a platform, rather than defaulting to whichever one we know best.
Yes, and it's worth prioritizing before an unpatched vulnerability in an end-of-life PHP version forces the timeline. The upgrade typically involves addressing deprecated functions and breaking changes between major versions, updating dependencies through Composer, and testing against the parts of the application most likely to rely on PHP 5 or PHP 7-era behavior that PHP 8 handles differently.
The further behind current an application has fallen, the larger this project tends to be — which is exactly why we treat it as its own scoped engagement rather than folding it quietly into a feature request.
Yes. A dedicated senior PHP engineer can join your existing team, sprint cadence, and codebase directly — working in your repository and attending your standups rather than operating as a separate outside project. It's often the better fit for ongoing development on a WordPress site, a Laravel application, or any PHP product you already run.
Laravel has the larger ecosystem, stronger conventions, and generally the lower learning curve for most teams, which makes it the more common default for a new custom PHP application. Symfony's more granular, swappable components tend to fit larger enterprise applications with specific architectural requirements that Laravel's conventions don't accommodate as cleanly.
For a lot of smaller projects, the honest answer is neither — a simple script or small internal tool often doesn't need a full framework's overhead at all. We'll recommend based on the application's actual complexity, not by default.