Skip to content

PHP development and modernization

Three things bring people here: something new to build in PHP, an estate that already earns money and is slow to change, or a team that needs senior PHP engineers now. We take all three, including white-label work behind an agency's brand, and we stay accountable for what ships.

01Capabilities

Four shapes of PHP work, and which one you are in

PHP work arrives here in three commercial shapes. We own the outcome, which on an existing system is legacy software modernization and on a new one is custom software development. We extend a team you already run. Or we work white-label behind an agency's brand, under a non-disclosure agreement, never in front of your client. The engineering is the same in all three. Four kinds of job account for most of it. Choosing a framework for something new is the Laravel argument; an inherited Yii2 application is the Yii2 one.

  • Platforms

    Subscription products with a decade of rules inside them

    Long-lived SaaS platforms, including e-commerce and learning platforms. The engineering problem is changing them without breaking the customers who depend on the old behaviour. Every rule in there was added because something went wrong once.

  • Upgrades

    Getting off an unsupported PHP release

    Moving an estate onto a supported runtime, getting dependencies back under Composer, and replacing the home-grown framework somebody wrote in 2013. An unsupported version is a security position, not only a technical one. You cannot install a patch that will not run.

  • Payments

    Payments, APIs, and the reconciliation between them

    The real engineering is retries, and idempotency (the same request arriving twice must not charge twice), and what happens when a provider returns a partial success. Not the checkout page. We rebuilt payment processing in PHP to meet credit-card security (PCI) requirements on Sterling Test Prep's platform.

  • Handovers

    Code the last vendor left behind

    Half-finished migrations, and systems where the original team is gone. We read the running application before we trust the handover pack. On a ten-year-old codebase the documentation describes an intention, not a deployment. This is legacy software modernization work.

02Case studies

Six PHP systems we built or took over

Six systems in production, across SaaS, healthcare, logistics, leisure and education.

See all case studies

03Fit

When PHP is the wrong answer, and what we say instead

PHP runs a large share of the web, which means the question is rarely whether PHP is good. It is whether your PHP system should be modernized, rebuilt, or left alone, and whether a new system belongs in PHP at all. Here is how we answer that, including the cases where we say no.

Six situations we meet, and what we say in each
Your situationWhat we recommend
A PHP estate that earns money and is slow to change Modernize in placeRaise the version floor, get tests around the paths that take money, then refactor. A rewrite is usually the expensive way to buy what a refactor delivers.
Something new, PHP is the right family, and no framework is chosen yet Different pageOur Laravel page. Deeper ecosystem, better documentation and an easier hiring position, which matter more over five years than any feature comparison.
A working application already on Yii2 Different pageOur Yii2 page. Porting to Laravel as an opening move is rarely worth funding, and that page is honest about when it is.
Realtime features, websockets, or long-lived connections at volume We argue againstFor that part, a Node.js service beside the PHP application. PHP is built to answer one request and finish, and holding thousands of open connections is not that job.
A transactional core several teams will maintain for a decade We argue againstJava or .NET carry the deeper story on long-lived transactional systems. We say so even though PHP work is ours to win.
Old, patched, stable, and nothing is actually blocked Leave it aloneSpend the budget where change is genuinely blocked. A modernization you cannot point at a blocked change is spending with no return.

Scope

What we own on a PHP engagement is the modernization sequence and everything downstream of it: what gets touched first, what stays frozen, and whether the system is deployable on any given day. It also covers whether your own team can keep changing it after we stop. unicrew has been building this kind of system since 2012, with 100+ senior in-house engineers across six countries, under an ISO 27001:2022 certified information-security management system. Where the honest answer is a smaller piece of work than the one you came for, you get that answer, including when the larger piece would have been ours.

The PHP argument people bring us is usually about the language, and it is almost never the language. Modern PHP with types, a real dependency manager and a test suite is perfectly good for the systems it is running. What actually hurts is a codebase on an unsupported version, where you cannot take a security patch without losing a weekend to it. Fix the version floor before you decide whether PHP was the mistake.

Yaroslav HavrylivSenior Engineering Manager, unicrew

04Delivery

The order we work in on a codebase we did not write

Inherited PHP is work we take on deliberately rather than reluctantly. Step one is what stops month three going badly, and it is the step most vendors compress to win the pitch.

  1. Read what actually runsThe deployed topology, the PHP and framework versions, the data model, the cron jobs and every integration. On a long-lived estate the surprise is almost always a scheduled job or a webhook nobody remembered.
  2. Get tests around the code that takes moneyBilling, checkout, authentication, and whatever the business cannot survive being wrong, covered before any refactor. On a codebase with thin coverage this is the difference between a modernization and an outage with a project plan attached.
  3. Raise the version floorRuntime, Composer dependencies and the deployment path first. An unsupported runtime blocks most library updates and leaves you unable to take security patches, which makes it the cheapest high-value thing on the list. This is the core of legacy software modernization work.
  4. Decide the framework question lastOnce the floor is current and the critical paths are covered, moving framework becomes an incremental business decision instead of a rewrite you fund up front. Plenty of estates never need that step at all.

05Client voices

Five clients, in their own words

See our client reviews
5.0 unified ratingacross 61 verified client reviewsRead them on Clutch

07Questions

What people ask us before they start

Short answers, written the way we would give them on a call. If yours is not here, it is a good first message.

Yes. Our engineers join your repository, your board and your release process, as managed teams. What that does not mean is people handed over and the result left with you. An architect outside the delivery team reviews the architecture and the data model. Changes ship through the same QA practice we run on our own builds. Accountability for what ships stays with us.

Yes. Upgrading is not a precondition we impose before starting. What we will tell you plainly is what the version costs you: security patches you cannot install, libraries you cannot update, and a hiring position that gets worse every year. Raising the version floor is usually one of the first things we recommend, sequenced around your release calendar rather than used as a gate.

For anything new, Laravel. The ecosystem, the documentation and the hiring pool are all deeper, and that outweighs any feature comparison over the life of a system. If you already run Yii2, the answer is usually not to port it. A working Yii2 application with tests around it is worth more than a half-finished Laravel rewrite.

Yes, and it is normal work for us rather than an exception. We read the running system before the handover document, and we get tests around the critical paths before changing anything. Expect the first few weeks to look slower than a greenfield start. That is where the risk gets found, instead of discovered in production by a customer.

Yes. Your client keeps dealing with you, we sit under a non-disclosure agreement, and you ship the PHP as your own work. That is white-label web development, and the wider agency offer is for agencies. On PHP the usual asks are version upgrades on a platform you inherited with the client, payment and integration work, and steady delivery on a codebase you do not want to staff full-time.

A scoping call that is a technical conversation, usually with an engineer who would work on the system. If it already exists we ask for read access to the repository first, because an hour in the code is worth three describing it. You get back a written read: what we would do first, what we would not touch, and where the risk sits. Most engagements start within two to four weeks.

Three shapes, and which fits depends on how settled the scope is. Time and materials is billed hourly and quoted per project, which suits work still moving. Fixed price is outcome based and quoted per project, offered once the first read is done, because a fixed number on a system nobody has opened is a guess with a contract around it. Team extension is billed monthly per engineer.

Sitting on PHP that is slow to change?

Send us the repository and tell us where it hurts. You get an engineer's read on the sequence, including the parts we would leave exactly as they are.

Book a scoping call

Thank you

Thanks for your message. We will get in touch with you shortly.