Legacy PHP rescue · US · UK · Canada
Hire PHP Developers for Legacy Code
Hire PHP developers for legacy code without committing to a rewrite first. An inherited application, a PHP 5.x or 7.x codebase, or something nobody left documentation for: it starts with a two-day audit and a written answer to the only question that matters, which is whether to patch it, upgrade it, or replace it a module at a time.
- The audit report is yours
- Fixed fee, written, and yours to take to another team if you would rather.
- We will tell you to leave it alone
- If it earns, works, and nobody needs to change it, that is what the report says.
- Nothing is rewritten by surprise
- No engineer here refactors your codebase into their preferred shape on a Friday.
- NDA before repository access
- Yours or ours, signed before anyone opens the code.
- IP assigned on day one
- Yours on commit, not on final payment.
- Ten working days risk-free
- On real tickets in your tracker. Walk away and owe nothing.
Send read access, get our findings inside one business day
The real question
Patch it, upgrade it, or replace it
Nobody hiring a PHP developer for legacy code is really shopping for a developer. They are shopping for an answer to this. Here are the three, with the timeline and the honest risk of each, and the two-day audit tells you which one is yours and what it costs.
Patch and hold
Security fixes, dependency updates and the minimum PHP bump that gets you back onto a supported version. Nothing else changes.
- TIMELINE
- Ongoing retainer
- DOWNTIME
- None
- THE RISK
- The gap widens each year. Every PHP release makes the eventual upgrade slightly larger and the hiring pool slightly smaller.
Upgrade in place
MOST CHOSENStatic analysis first, then Rector in small passes, branch by branch, with the application live throughout. Same architecture, current PHP. The full order is our upgrade checklist for a legacy application.
- TIMELINE
- 4-12 weeks
- DOWNTIME
- None. Runs in parallel
- THE RISK
- The mechanical part is quick. The cost is the regression suite you probably do not have yet, and that is most of the estimate.
Strangle and replace
New modules behind the old router, one at a time, until nothing routes to the original. Never a big-bang rewrite. How a strangler migration runs, worked through on a CodeIgniter app.
- TIMELINE
- 14-28 weeks
- DOWNTIME
- None, cut over per module
- THE RISK
- Highest cost, and it needs product decisions from you the whole way through rather than at the start.
If the answer is "leave it alone and patch it", that is what the report will say. It will have cost you two days rather than a quarter, and you are free to take it to somebody else.
Book the auditBefore you spend anything
How bad is it, really?
Five things we check first on every inherited PHP application. If you recognise two or more of them, the audit is worth more to you right now than a developer is.
Send us read access to the repository and we will run these checks ourselves. No form and no call first: a reply with what we found inside one business day.
Running PHP 7.4 or older
This is a live security exposure today, not a technical-debt item for next quarter. It gets fixed first, whatever you decide about the rest.
No test suite, and deploys happen over FTP
The tests are the project. You cannot safely change code that nothing verifies, and every estimate that ignores this is wrong.
Nobody who wrote it still works there
Two days of documentation and a runbook save more than two months of archaeology, and they are useful whoever does the work next.
Business rules living in includes/ or a 4,000-line controller
This is where the real cost hides. Not the framework version, and not the line count.
It handles money, bookings or stock
Strangler migration, module by module, whatever anyone quotes you for a rewrite. The blast radius decides the method.
Engagement models
Four ways to hire legacy PHP developers
Pick by how much certainty you need. Every model is the same engineers, the same review standards and the same published rate.
The audit
Two days, fixed fee, a written report. The usual way this starts and it commits you to nothing.
Priced on the rates pageHourly
A specific fix, a PHP compatibility bump, or a security patch. Billed in 15-minute blocks.
Priced on the rates pageDedicated
MOST CHOSENOne engineer, full time. Every upgrade and strangler migration runs on this model.
Priced on the rates pagePatch retainer
Security fixes and dependency updates on an application you are not otherwise changing.
Priced on the rates pageStraight answer
When legacy PHP is worth modernising, and when it is not
Start from the least fashionable answer: if the application is stable, earning money, and nobody needs to change it much, leaving it alone is a legitimate engineering decision. An old application on a supported PHP version, with a patch retainer behind it, can run for years. Modernisation is not a virtue in itself, and any agency that opens with "you need to rewrite this" has told you something about their sales model rather than about your codebase.
What forces the decision is rarely the framework. It is a PHP version going out of support, a dependency that no longer installs, a payment provider deprecating the API you integrated in 2016, or the one person who understood the codebase leaving. Those are the moments to spend money, and the order matters: get onto a supported PHP version first, then decide about the framework. Doing both at once is how migrations end up abandoned at sixty per cent.
When migration is right, it should never be a rewrite. We run the strangler pattern: one router in front, modules moved across one at a time, both frameworks live together for as long as it takes, with experienced Laravel developers building the replacement modules. Every week ends with something shipped and something deletable. A big-bang rewrite asks you to fund six months with nothing in production at the end, and to trust that the new system covers a decade of undocumented business rules. It usually does not.
One more thing worth knowing before you take quotes: the cost is almost never in the
controllers. It is in the custom libraries doing what a framework should do: a
hand-rolled ORM, a bespoke auth system, a PDF generator someone wrote in 2014. Any
estimate that has not opened application/libraries, the folder where a
CodeIgniter 3 application keeps
them, or its equivalent elsewhere, is a guess, which is
exactly why we sell two days of looking before we sell anything else.
If the audit says leave it alone, the report says leave it alone. Selling a migration the business did not need is the fastest way to lose a client, and we would rather keep one.
The alternatives
What you are actually choosing between
Marketplace and in-house figures are typical US mid-to-senior PHP ranges for 2026, including employer costs. Ours are the published rates.
Capabilities
What our legacy PHP developers actually do
Eight things owners of legacy PHP applications ask us for most. Six of the eight are maintenance and upgrade work rather than replacement, which is the honest shape of this.
Legacy code audit and written report
What the real risks are, what an upgrade would cost, and what to leave alone. Delivered as a document with a risk register, not a call. Yours to take to another supplier if you would rather.
PHP 5.x and 7.x upgrades to 8.4
Static analysis first, then Rector in small passes, branch by branch, live throughout.
A regression suite for code that has none
Characterisation tests around current behaviour first, so you can change things without guessing.
Security patching for unsupported stacks
Dependency updates, known-CVE fixes and a WAF in front while the longer decision gets made.
Strangler migration to Laravel
Module by module behind the existing router. Every week ends with something shipped.
Laravel 12 Getting an undocumented codebase understood
A dependency map, the data model as it actually is rather than as it was designed, an environment somebody new can run on their first morning, and a runbook for the deploys that currently live in one person’s head.
DockerRunbook Performance work on an old database
Query profiling, indexes, and caching, measured before and after, in writing.
Redis Getting off a dead dependency
An abandoned package, a payment gateway that sunset its API, a PHP extension with no 8.x build.
ComposerAdapters Not sure it is worth saving?
That is a fair question and the audit answers it. Sometimes the report says rebuild, and we will tell you that even though it is the harder sale.
Tech stack
Current versions, not a wish list
What is in production for our clients this quarter. We will work in older versions too, most rescue jobs start there.
The upgrade toolchain
PHP 8.3 / 8.4 Rector PHPStan level 8 Psalm Pest / PHPUnit Composer What we usually find
PHP 5.6 / 7.x 
CodeIgniter 3 Laravel 5-8 Zend / Symfony 2 
WordPress + custom No framework at all Where it usually goes
Laravel 12 
MySQL 8 Redis Docker 
GitHub Actions Staying where it is The engineers
The people who would be on your standup
Legacy PHP is a speciality, not a punishment posting. These engineers have spent years in codebases nobody documented, and you interview them before anything is agreed.
Strangler migrations off dead frameworks, and the patch retainers that keep an unsupported stack secure for clients who are not moving yet.
Laravel 12 CodeIgniter 3 Writes the regression tests that make changing a ten-year-old codebase survivable. On legacy work this is the first hire, not the last.
PHP Integrations specialist. Usually the person who replaces the payment gateway that sunset its API two versions ago.
Stripe REST Queues Takes the modules that come out of a strangler migration and builds them properly on the other side.
Laravel 12 
Vue 3 MySQL 5 more engineers, with full profiles, shipped work and GitHub history. Meet the whole team →
How we work
What a legacy engagement includes by default
Legacy work has its own defaults, because the risk sits in different places than it does on a new build.
You do not have to take any of this on trust. The first ten working days are risk-free, and every rate is published in full.
See what is included- Safety net before any change
- Characterisation tests and static analysis come before the first line is touched. The projects that go wrong skipped this step, not a tool.
- Branch by branch, never a big bang
- Each step is deployable and reversible. Risk moves out of one cutover day and into small increments.
- An unsupported PHP is fixed first
- Whatever you decide about the architecture, running on a version that receives no security fixes is not a decision you get to defer.
- We will tell you not to do it
- If the application works, earns, and nobody needs to change it, a patch retainer costs a fraction of a migration, and the report will say so.
How it works
From first email to a developer on your standup
Twelve working days end to end, and no money changes hands until you have seen the work.
- Day 0
You send read access, or just describe it
A repository link and what worries you. No form to fill in and no call before anyone has looked at anything.
- Day 1
We reply within one business day
What we found, whether the audit is even worth buying, and roughly which of the three answers is likely yours.
- Week 1
The two-day audit, if you want it
Fixed fee, quoted before it starts, and it ends in a written report rather than a proposal.
- Week 1
You interview the engineer
A named person with the date they come available. You decide, not us.
- Week 2
Ten working days risk-free
Real tickets in your tracker. Read the pull requests. Walk away at the end and owe nothing.
Why India
Why hire PHP developers for legacy code in India
This is the one place where India is not just cheaper, it is genuinely deeper. PHP has been the backbone of Indian software services for twenty years, which means a very large number of production applications written across that whole period, and the engineers who kept them running. Maintaining somebody else's ten-year-old codebase is unglamorous work that few developers anywhere want; the difference here is that it is a recognised speciality with a hiring pool behind it rather than a job nobody will take. What that costs against a local hire is worked through in PHP developer hourly rates, India vs the US.
YOUR WORKING DAY, AND OURS
- IP assignment on day one
- Everything written for you is yours on commit, not on final payment. Assignment clause, not a licence.
- NDA before repository access
- Yours or ours, signed before anyone is added to your GitHub organisation.
- The audit report is yours
- Fixed fee, written, and yours to take to another supplier if you would rather. It is not a sales document.
- Thirty days notice to stop
- Month to month after the trial. No annual minimum and no exit fee.
FAQ
Questions buyers ask before the first call
If yours is not here, email it. We publish the answer rather than saving it for a sales call.
Can I hire a PHP developer for legacy code nobody documented?
That is the usual case rather than the exception, and it is why this starts with an audit instead of an estimate. Undocumented is a known quantity: the first work is a dependency map, the data model as it actually is, and an environment a new engineer can run on their first morning. What is not a known quantity is what the business rules are meant to be, and that part needs somebody on your side who remembers, which is the half hour a day our guide on briefing an offshore team is about.
Our application runs on PHP 5.6. Is that still fixable?
Yes, and it is common. PHP 5.6 stopped receiving security fixes years ago, so the first question is not whether to modernise but how exposed you are today. The mechanical part of a 5.6 to 8.4 upgrade is largely Rector and static analysis; the cost is the regression suite, because there almost never is one. Budget most of the estimate there and treat the version jump as the cheap half.
How much does it cost to hire legacy PHP developers?
The same published rates as everything else: from $22 an hour, with every band on the rates page. Legacy work usually lands on the senior band at $30 rather than the mid one, because the expensive part is judgement about what not to touch. The two-day audit is a separate fixed fee, quoted before it starts.
Will you rewrite it rather than fix it?
Not unless the report argues for it and you agree. A rewrite is the most expensive answer and the one most often reached for, usually because reading somebody else’s code is less enjoyable than writing your own. The default here is upgrade in place, and the strangler pattern when replacement is genuinely right.
Can you take over from the developer who built it?
Yes, and we would rather do it with a handover than without one. If they are still contactable, a paid week of their time is the cheapest thing you will buy in this whole project. If they are not, that is what the audit and the runbook are for. After the handover it is the same month-to-month arrangement as when you hire PHP developers in India for new work.
Who owns the code and the IP?
You do, assigned from the first commit rather than on final payment. Work happens in your repository and your cloud accounts, so there is nothing to hand over at the end.
What if the audit says the app is fine?
Then it says so, you have paid for two days rather than a quarter, and you owe us nothing further. We would rather write that report than sell a migration the business did not need, because the second one comes back.
How quickly can somebody start?
Usually within five business days, and same-week for a security patch on an exposed version. Each engineer profile carries the date they come available.
Talk to an engineer
Tell us what needs building
You get a reply within one business day from someone who has migrated this exact kind of application, with a named engineer, their rate and their start date. No discovery fee, no obligation.
Ten working days risk-free before you pay
NDA signed before repository access
Or book a 20-minute call at a time you pick
We never share your details, and we do not run a mailing list.
Sent. You will hear back within one business day