Updated October 2026 · Written and maintained by the Progression Agency strategy team
A PHP web development company designs, builds and maintains websites and web applications written in PHP, the server-side language most widely used on the web. We take on custom PHP websites, client portals, internal tools, APIs, ecommerce builds and the upgrade of older PHP systems, for businesses that want one accountable team rather than a single contractor. Progression Agency is based in New York City and works with clients across the United States and worldwide.
On this page · 19 sections
- What does a PHP web development company build?
- Is PHP good for web development in 2026?
- What is custom PHP development?
- Custom PHP websites, WordPress plugins and Drupal modules
- PHP application development: portals, dashboards and SaaS products
- PHP API development and integrations
- PHP ecommerce development
- Which PHP version should your application run?
- Legacy PHP modernization, upgrade and migration services
- The PHP stack we build with
- Are PHP websites secure?
- Performance and scale in PHP
- PHP maintenance services after launch
- PHP development outsourcing: project, retainer or team
- How much does custom PHP development cost?
- Our process from first call to handover
- How to choose a PHP development company
- AI answers: how buyers ask assistants for a PHP partner
- Related services for PHP projects
The short answerOur PHP development services cover new builds on supported PHP 8 releases, custom modules for WordPress and Drupal, APIs and integrations, ecommerce, and the audit, upgrade and refactoring of legacy code. Work is scoped in writing, built in short releases with automated tests, and measured by uptime, page and API response times, error rates and the hours of manual work removed. On published US price bands (market figures, not a Progression rate card) an integration runs $15,000 to $50,000 over 4 to 10 weeks and a portal or business platform $75,000 to $250,000 over 4 to 8 months.
Version dates and platform requirements are described as published in October 2026 and can change. Software cost figures are published US price bands (market figures, not a Progression rate card); website prices are Progression’s own fixed-scope list. A quote follows a written scope.
What does a PHP web development company build?
It builds the server side of websites and web applications in PHP, and often the front end and hosting setup around them. The projects below cover most of what companies bring to us.
| Service | What you get | Typical project |
|---|---|---|
| Custom PHP websites | A site built around your content and data, not a theme | A catalog site with a dealer locator and quote forms |
| PHP application development services | Logins, roles, workflows and reporting | A client portal for documents, invoices and requests |
| Internal tools and dashboards | Screens that replace spreadsheets and email chains | An operations dashboard over orders and stock |
| APIs and integrations | REST or GraphQL endpoints and system-to-system sync | A mobile app back end, or CRM to ERP sync |
| CMS extensions | Custom WordPress plugins and Drupal modules | A booking engine inside an existing WordPress site |
| Ecommerce | Catalog, checkout, payments and fulfillment links | A WooCommerce store tied to an inventory system |
| Legacy upgrade and modernization | An audited, tested, current codebase | A PHP 7.2 application moved to a supported release |
| Maintenance and support | Updates, monitoring, fixes and small changes | A monthly plan for a revenue-critical portal |
PHP web development services for new builds
New projects start from a written scope, a data model and a release plan. We build on a supported PHP release, keep the code in your repository from day one and ship to a staging environment you can click through every sprint.
Taking over an existing codebase
Many clients come with a PHP system someone else wrote. The first step is a paid audit that tells you what you have, what is risky and what it would take to bring it up to date, before anyone proposes new features.
Is PHP good for web development in 2026?
Yes, for most content, commerce and portal back ends. It runs on almost every host, has mature frameworks and content systems, and a predictable yearly release cycle. It is a weaker fit for some workloads, and we say so when that is the case.
W3Techs’ server-side language survey puts PHP at 69.3% of websites whose server-side language it can detect, as of October 21, 2026. Part of that reach comes from content systems: W3Techs counts WordPress on 39.6% of all websites. For a buyer that means a deep pool of hosting, tooling and people who can maintain the code later.
Where PHP does its best work
Request-and-response web applications: content sites, member areas, catalogs, checkouts, portals, admin tools and the APIs behind mobile apps. These are the projects where its hosting reach and ecosystem save money.
When we would not choose PHP
Heavy data science or machine learning, long-running real-time systems that keep thousands of connections open, and teams whose existing services are all in another language. Our Python development and Java development pages cover the alternatives we reach for.
Will PHP ever die?
Not on any timeline that matters for a project you start now. PHP 8.5 shipped on November 20, 2025, and php.net lists security support for it until December 31, 2029. A new branch has arrived each year since 2022.
What is custom PHP development?
Custom PHP development is writing PHP code for your specific business rules, data and integrations, instead of configuring a packaged product as it ships. It ranges from a single plugin to a complete application.
| Approach | Best for | You own | Main trade-off |
|---|---|---|---|
| Custom PHP application | Unusual workflows, roles and data | All of the code and data | Higher first cost, full control |
| CMS with custom modules | Content-led sites with some special features | Your modules and content | Platform updates set the pace |
| Packaged SaaS product | Standard processes many companies share | Your data, under the vendor’s terms | Limits on what can change |
Custom PHP development services, scope by scope
A custom PHP development project can be a feature added to a site you already run, a standalone tool or a platform that replaces several systems. Each starts with a written description of what the software must do and how we will know it works.
A custom PHP website versus a theme
A theme starts from someone else’s idea of a website. A custom PHP website starts from your content model, your search and filters and your forms, which matters most for catalogs, directories and member areas. That is where a PHP website development company adds the most over a theme marketplace.
The general build-or-buy question is covered on our custom software versus off-the-shelf page; the grid above is the PHP-specific version.
Custom PHP websites, WordPress plugins and Drupal modules
Most PHP websites run on a content system, and much of our custom work lives inside one. We build modules that survive platform updates and keep custom logic out of the core files.
WordPress: custom plugins, not edited themes
WordPress recommends PHP 8.3 or greater with MySQL 8.0 or MariaDB 10.11 or newer. We write custom features as plugins with their own tests, so a theme change or core update does not wipe them out. Full WordPress builds sit with our WordPress development team.
Drupal: modules for structured content
Drupal suits sites with many content types, editorial workflows and permissions. Its documentation lists PHP 8.3 as the minimum for Drupal 11, so an older server is the first thing to check before any module work.
PHP CMS development without a CMS
Sometimes the content needs are small and the application needs are large. Then a lean admin built into a custom application is simpler than bending a CMS, and editors still get the screens they need.
Decoupled builds, with WordPress as the editing tool and a separate front end, are described on our headless WordPress page.
PHP application development: portals, dashboards and SaaS products
As a PHP app development company we build software that people log into to get work done. The value is in the workflow and the data, so we design those first and the screens second.
Client and partner portals
Customers download documents, pay invoices, raise requests and see status. Partners register deals or check stock. Each role sees only what it should, and every action is logged. See our web portal development page for portal-specific features.
Internal tools that replace spreadsheets
Order desks, scheduling boards, approval flows and reporting screens built on your own data. These are often the fastest return a PHP project delivers, because the manual work they remove is easy to count.
SaaS products in PHP
Accounts, subscriptions, billing, tenant separation and an admin console. PHP frameworks handle these well; the hard decisions are pricing logic and data separation, which we settle in discovery. Our SaaS development page covers the product side.
PHP API development and integrations
PHP is a practical choice for APIs that feed mobile apps, single-page front ends and partner systems. We design the contract first, document it, version it and test it automatically.
REST and GraphQL back ends
REST suits most integrations and public APIs; GraphQL suits front ends that need flexible queries. Either way we publish the schema, handle authentication with tokens and rate-limit what partners can call.
Connecting the systems you already pay for
CRM, ERP, accounting, payment, shipping and marketing tools usually have APIs. Sync jobs run in background queues with retries and alerts, so a supplier’s outage does not freeze your checkout. More on this on our API development page.
| Pattern | How it works | Fits when |
|---|---|---|
| Synchronous API call | The request waits for the other system’s answer | The user needs the answer on screen now |
| Background queue job | Work is queued and retried until it succeeds | The other system is slow or sometimes down |
| Webhook receiver | The other system calls you when something changes | You need changes as they happen |
| Scheduled batch | A job runs on a timetable and moves data in bulk | Large volumes, overnight is fine |
| File exchange | CSV or XML files over secure transfer | The partner system offers nothing else |
Running a PHP application nobody wants to touch?Send us the repository access or a description of the system and its PHP version. You get a free proposal with a written scope for an audit and the first fixes.
PHP ecommerce development
PHP powers WooCommerce, which runs on WordPress, as well as many custom checkouts. We build stores that tie the catalog, checkout and fulfillment to the systems behind them.
WooCommerce stores and extensions
WooCommerce recommends PHP 8.3 or greater and warns that older versions past end of life may expose a site to security problems. We build custom extensions for pricing rules, B2B accounts, subscriptions and ERP sync.
Custom checkouts and B2B ordering
Quote-to-order flows, customer-specific price lists, account credit and reorder screens often outgrow a standard store. A custom PHP module or a separate ordering portal handles them cleanly.
Store design and platform choice are covered on our ecommerce development page; this page covers the PHP engineering underneath.
Which PHP version should your application run?
A supported one, ideally 8.3 or newer for anything you plan to keep past 2026. Each branch gets two years of active support and two years of security fixes only, then nothing.
| Branch | First released | Security fixes until | What we advise |
|---|---|---|---|
| 8.5 | November 20, 2025 | December 31, 2029 | Default for new builds once your libraries support it |
| 8.4 | November 21, 2024 | December 31, 2028 | Safe target for most upgrades |
| 8.3 | November 23, 2023 | December 31, 2027 | Fine today; plan the next move |
| 8.2 | December 8, 2022 | December 31, 2026 | Upgrade now; support ends this year |
| 8.1 and older | 2021 and earlier | Already ended | Treat as an urgent project |
What end of life means in practice
php.net’s supported versions page says a branch is fully supported for two years from release, then gets critical security fixes only for two more, after which it is no longer supported. Its end-of-life list shows PHP 7.4 ended on November 28, 2022 and 8.0 on November 26, 2023.
Speed is not the main reason to upgrade
PHP 8.0 added two JIT compilation engines, yet its release notes state that typical application performance is on par with PHP 7.4. The case for upgrading is security fixes and library support; any speed gain is a bonus we measure, not promise.
Legacy PHP modernization, upgrade and migration services
We modernize legacy PHP in place, in small tested steps, so the business keeps running. A full rewrite is rarely the cheapest or safest route, and we only propose one when the audit shows it is.
PHP upgrade services: one branch at a time
Upgrades fail on dependencies more often than on your own code. We list every package and extension, upgrade the ones that block the move, then step through PHP branches on staging with a rollback ready for each production release.
Tools that make large upgrades safer
Rector describes itself as a PHP tool for instant upgrades and automated refactoring, and PHPStan says it finds bugs in code without writing tests. We use both alongside new tests on the paths that matter most, so automated changes are checked twice.
PHP migration services: servers, databases and platforms
Moving to new hosting, a managed database, containers or a different framework is planned like any migration: inventory, staging copy, rehearsal, cutover window and rollback. Site moves that affect search traffic follow our website migration checklist.
| Situation | Our usual recommendation | Why |
|---|---|---|
| Works well, old PHP version | Upgrade in place | Lowest risk; the business logic is already proven |
| Works, but every change breaks something | Add tests, then refactor the worst modules | Fixes the cost of change without a restart |
| Built on an abandoned framework | Staged migration to a maintained framework | Moves module by module behind the same URLs |
| Logic no one understands, no tests | Characterization tests, then decide | You cannot safely change what you cannot describe |
| Wrong product for today’s business | Rebuild, possibly not in PHP | When the requirements, not the code, are the problem |
The PHP stack we build with
Current PHP, Composer for dependencies, a mainstream framework where it helps, a relational database, a cache and queue, automated tests and a deployment pipeline. Nothing exotic, because the next team has to maintain it.
| Layer | What we use | Why it matters to you |
|---|---|---|
| Language | A supported PHP 8 release | Security fixes and current libraries |
| Dependencies | Composer with a committed lock file | Every environment installs the same versions |
| Code structure | PSR-4 autoloading and a coding standard | Code any PHP team can read and extend |
| Frameworks | Symfony, Laravel or CodeIgniter when they fit; plain PHP for small services | Proven building blocks, fewer surprises |
| Database | MySQL, MariaDB or PostgreSQL | Chosen for the data and the host |
| Cache and queues | Redis and a background job runner | Fast pages; slow work off the request |
| Testing | PHPUnit plus static analysis in CI | Problems found before users find them |
| Delivery | Containers and an automated pipeline | Repeatable deploys and quick rollbacks |
Composer and locked dependencies
Composer’s command-line documentation explains that install uses the exact versions recorded in composer.lock, so everyone gets the same dependencies, and that composer audit checks installed packages against security advisories. We run that audit on every build.
Standards that keep code portable
PSR-4 describes a specification for autoloading classes from file paths. Following it and a shared coding style means another competent PHP team can take over without a rewrite. Framework choice is discussed on our web development frameworks page.
Hosting the result
We deploy to your cloud or hosting account, configured for the PHP version and extensions the application needs. Options and trade-offs are on our PHP hosting page, and pipelines on our DevOps page.
Are PHP websites secure?
PHP websites are as secure as the code, dependencies and server behind them. The language gives developers safe tools; the risk comes from not using them and from software left on unsupported versions.
Queries that cannot be injected
The PHP manual says that if an application uses prepared statements exclusively, the developer can be sure no SQL injection will occur, provided no other part of the query is built from unescaped input. Every database call we write binds its parameters.
Passwords stored the right way
PHP’s password_hash function creates a hash with a strong one-way algorithm and a generated salt, with bcrypt as the default since PHP 5.5 and Argon2id available where PHP is built with it. We never store or log passwords in any other form.
A shared checklist for every release
OWASP describes its Top 10 as a standard awareness document for developers and web application security; the current edition is from 2025. We review new features against it and against the access rules in your scope.
- Bound parameters on every query, validated input at every boundary
- Output escaping in templates to stop cross-site scripting
- CSRF tokens on forms and state-changing requests
- Uploads checked by type and stored outside the web root
- Secrets in environment configuration, never in the repository
- Dependency audits on every build and a monthly update window
- Admin areas behind multi-factor authentication
- Logs that record who changed what, without recording secrets
Ongoing hardening, monitoring and incident help for sites of any kind sit on our website security services page.
Performance and scale in PHP
PHP scales by running many short requests in parallel behind a load balancer, with caching and background queues doing the heavy lifting. When a PHP site is slow, the database is the first place we look, before blaming the language.
Where the time usually goes
Repeated database queries inside loops, missing indexes, uncached pages, large images and calls to third-party APIs during the request. We profile before we change anything, then fix the biggest cost first.
Caching and queues
Page and fragment caching, an object cache such as Redis, and queues for email, exports and integrations keep response times steady when traffic spikes. Front-end and Core Web Vitals work is covered on our website speed optimization page.
PHP maintenance services after launch
A monthly plan keeps PHP, the framework or CMS and every dependency current, watches uptime and errors, and covers small changes. It is the cheapest protection a working application can have.
| Task | How often | What it protects |
|---|---|---|
| Security updates for PHP, framework and packages | Monthly, and within days for critical advisories | Known vulnerabilities |
| Dependency audit | Every build | Packages with published advisories |
| Backups with a test restore | Daily backups, restore tested quarterly | Data loss and bad deploys |
| Uptime and error monitoring | Continuous | Outages nobody noticed |
| Small changes and fixes | Within the monthly allowance | A backlog that never moves |
| Version roadmap | Twice a year | Surprise end-of-life deadlines |
Taking over maintenance from another team
We start with an audit and a handover checklist: repository access, hosting and DNS credentials in your name, deploy steps written down and a list of known issues. Then the plan begins. Our website maintenance page covers simpler sites.
PHP development outsourcing: project, retainer or team
There are three ways to work with an outside PHP team: a fixed-scope project, a monthly retainer, or an outsourced team that works from your backlog. The right one depends on how well the work is defined and how steady it is.
| Model | How it works | Best when | What to insist on |
|---|---|---|---|
| Fixed-scope project | A written scope, a price and milestones | The outcome can be described up front | Acceptance criteria per milestone |
| Monthly retainer | A set number of hours or a fixed plan each month | Ongoing maintenance and small features | A monthly report of work done |
| Outsourced team | A team works from your backlog in sprints | A product with a steady roadmap | Named people and a demo every sprint |
| Audit first | A short paid review before any commitment | An inherited or troubled codebase | A written report you can take elsewhere |
Outsourcing versus adding one person
An outside company gives you a team with design, testing and operations skills, and continuity when someone is on leave. Adding a single person suits a narrow, steady stream of work; our guide to bringing in a PHP developer covers that route.
Working with a PHP development company in the USA
Same time zones for standups and incidents, US contracts and invoicing, and a team that understands US privacy and accessibility expectations. We work with clients across the country and abroad, with overlap hours agreed in the scope.
Need a portal, dashboard or API built in PHP?Describe the users, the data and the systems it connects to. A free proposal follows with a written scope, a phase plan and the matching price band.
How much does custom PHP development cost?
On published US price bands (market figures, not a Progression rate card), an integration or automation costs $15,000 to $50,000, an internal tool or dashboard $25,000 to $75,000 and a portal or business platform $75,000 to $250,000. A quote follows a written scope.
| Scope | Price band (market) | Typical duration | PHP example |
|---|---|---|---|
| Integration or automation | $15,000 to $50,000 | 4 to 10 weeks | A CRM to ERP sync or a scheduled export |
| Performance or scaling project | $15,000 to $60,000 | 2 to 8 weeks | Profiling, query fixes, caching and queues |
| Internal tool or dashboard | $25,000 to $75,000 | 2 to 4 months | An order desk or reporting screen |
| SaaS product MVP | $60,000 to $150,000 | 3 to 6 months | Accounts, billing and the core workflow |
| Client portal or business platform | $75,000 to $250,000 | 4 to 8 months | A multi-role portal with integrations |
| Enterprise system or modernization | $250,000+ | 6 to 12+ months | Re-platforming a large legacy PHP estate |
Progression’s own website prices
When the project is a website rather than an application, our fixed-scope list applies: a brochure site of 5 to 8 pages from $9,500, a business site of 10 to 16 pages from $18,000, ecommerce under 200 SKUs from $34,000 and ecommerce with ERP, PIM or fulfillment integrations from $78,000. The full list is on our website design and development page.
What moves a PHP quote
The number of user roles and integrations, data migration, the state of an inherited codebase, test coverage you need and hosting requirements. An audit of existing code is the fastest way to turn a range into a fixed price.
Why rates alone mislead
The Bureau of Labor Statistics web developer profile reports a median annual wage of $99,520 in May 2025 for web developers and digital designers. A team quote also carries design, testing, project management and operations, so compare proposals line by line, not by hourly rate.
General software ranges are on our software development company page and back-end ranges on our backend development page.
Our process from first call to handover
Every project moves through the same checkpoints: scope, foundation, build, release and handover. You see working software at each one, not just status reports.
| Phase | What happens | You receive | Measure we report |
|---|---|---|---|
| Scope | Workshops, code or data review, risks listed | Written scope, estimate and plan | Scope signed off |
| Foundation | Repository, environments, pipeline, first deploy | A deployable skeleton in your account | First automated deploy |
| Build | Features in two-week sprints with tests | A staging site to review every sprint | Stories accepted per sprint |
| Release | Load and security checks, data migration, launch | Production release with a rollback plan | Error rate and response time |
| Handover | Documentation, training, support plan | Runbooks and admin guides | Open issues at handover |
What we need from you
One decision-maker, access to existing systems and data, and an hour a sprint to review what was built. Quick answers keep the schedule; slow ones are the most common cause of delay.
What you own at the end
The repository, the cloud or hosting account, the domain and DNS, the data and the documentation are yours from the first day, not transferred at the end.
How to choose a PHP development company
Pick the company that asks about your PHP version, your data and your users before quoting features, and that can show tested, documented code. The checks below separate the best PHP development company for your project from a polished pitch.
| Requirement | How to check it |
|---|---|
| Works on supported PHP versions | Ask what version they would build on today and why |
| Writes tests | Ask what share of a recent project’s code ran in automated tests |
| Handles legacy code calmly | Ask how they would upgrade a PHP 7 system without downtime |
| Security habits | Ask how they handle queries, passwords, uploads and secrets |
| Clear ownership | Confirm repository, hosting and data are in your name from day one |
| Honest about fit | Ask when they would recommend a CMS, a SaaS product or another language |
| Named team | Ask who will write the code and who reviews it |
Questions for the first call
What would you audit first in our codebase? Which part of our scope would you cut from release one? How do you roll back a bad deploy? What happens if we part ways halfway through?
Red flags
A rewrite proposed before anyone has read the code, quotes without a written scope, code kept in the vendor’s own accounts, no mention of PHP version or tests, and promises of a fixed launch date with no discovery.
AI answers: how buyers ask assistants for a PHP partner
Technical and business buyers ask ChatGPT, Claude, Perplexity, Gemini, Copilot and Google’s AI Overviews to shortlist PHP firms, explain upgrade paths or estimate costs. Assistants answer from pages they can read and compare.
What buyers type
Prompts such as “custom PHP development company for a client portal”, “how hard is upgrading PHP 7.4 to 8.3”, “is PHP still a good choice for a new web app” and “PHP development company USA with WooCommerce experience”.
What gets cited
Pages that answer plainly, show tables of scope and price bands, name supported versions with dates, and link to the PHP manual, framework documentation and review sites. Directory profiles and published case material help a firm get named alongside others.
What a PHP company should publish
One page per service with a clear definition, a stack table, a version policy, price bands and process. Our answer engine optimization work does this for software firms, and AEO for SaaS covers product companies.
Related services for PHP projects
PHP work usually touches design, hosting, security and other languages. These pages go deeper.
- Bringing a PHP developer onto your team
- Web app development company
- Custom software development company
- Web development services
- Python development company
- PHP hosting options compared
- Web development frameworks compared
- Custom software versus off-the-shelf
- WordPress development company
- WordPress maintenance services
- Ecommerce development services
- API development
- Backend development services
- Web portal development
- Dashboard development
- DevOps services
- Cloud migration services
- Website security services
- Java development company
- .NET development services
Start your PHP project with a written scope
Tell us what the software must do, what you run today and your PHP version if you know it. We will reply with a free proposal and a written scope.
Getting found in search
AI, AEO and what is changing
Paid media and lead generation
Websites and design
Choosing and working with an agency
Software and app development
Website design by industry and type
Web development, platforms and hosting
Social, content and brand
By industry and by situation
Frequently asked questions
How to choose a PHP development company: what should we check first?
What is custom PHP development, and when do you need it?
Is PHP good for web development in 2026?
Are PHP websites secure?
Will PHP ever die?
What does custom PHP development cost on published price bands?
Which services does a PHP web development company provide?
Which PHP version should our application run?
Can you upgrade an old PHP 5 or PHP 7 application?
Do you build custom WordPress plugins and Drupal modules?
Which PHP frameworks do you work with?
What PHP maintenance services do you offer once the site is live?
Can you take over a PHP codebase another company built?
Should we rewrite our legacy PHP application in another language?
Can you build a PHP API that a mobile app talks to?
Can PHP handle a high-traffic application?
How is PHP development outsourcing different from adding one developer?
How many weeks does a custom PHP build take?
Can you build an online store in PHP?
Which databases do you pair with PHP?
How do you test PHP code before it reaches production?
What does a PHP app development company build beyond websites?
Can a PHP development company in the USA work remotely with our team in another state?
Running a PHP application nobody wants to touch?Send us the repository access or a description of the system and its PHP version. You get a free proposal with a written scope for an audit and the first fixes.
Get a free marketing proposal
Tell us what you are trying to grow and we will come back with a plan, not a pitch deck. Same-day reply on weekdays.