Hire PHP Developers

Updated September 2026 · Written and maintained by the Progression Agency strategy team

“PHP developer” describes four jobs that barely overlap — WordPress, modern frameworks, legacy maintenance and integration work — and hiring for the wrong one is the usual cause of a disappointing engagement. This page covers how to tell which you need, the version question to ask before anything else, how to screen without being technical, and what you must own when the work ends.

“PHP developer” is four different jobs

The commonest hiring mistake in this category is treating PHP as one skill. It is a language shared by several ecosystems that barely overlap in practice, and a developer who is excellent in one can be genuinely weak in another.

A WordPress developer works inside a plugin and theme architecture with its own conventions and an enormous installed base of third-party code. A Laravel or Symfony developer works in a modern framework with dependency injection, migrations and a test suite. A legacy maintainer works in procedural code written before any of that existed, often without version control. And an integration developer mostly writes glue between systems and rarely touches a front end at all.

Hiring for the wrong one is the usual cause of a disappointing engagement, and it is entirely avoidable by naming the job before writing the brief.

WordPress is a specialty, not a lesser skill

It powers a very large share of the web, and working safely inside it — hooks rather than core edits, update-survivable customization, an awareness of what a plugin update can break — is a genuine discipline. A developer who dismisses it will produce code that does not survive the next update. The platform’s own requirements page is the baseline for what it expects to run on.

Framework work is application development

If you are building something with users, roles, state and business logic, you want framework experience and a test suite. Building that inside a content-management system is possible and is usually a decision people regret.

Legacy maintenance is undervalued and hard

Reading someone else’s undocumented code and changing it without breaking a working business is a real skill. Candidates who lead with a rewrite proposal are describing the job they want rather than the job you have.

Integration work needs different questions

Ask about idempotency, retries and what happens when the third-party API is down. Those answers separate people who have run integrations in production from people who have written one.

The version question you should ask before anything else

PHP releases follow a predictable lifecycle — roughly two years of active support followed by a further period of security-only fixes, after which a version receives nothing at all. The current status of every branch is published on php.net’s supported versions page, and it is worth checking before you hire rather than after.

This matters commercially because an application running on an end-of-life version is accumulating unpatched vulnerabilities every month, and because the upgrade gets harder the longer it is deferred. It is also the single most useful screening question you can ask a candidate or an agency: what version are we on, what is its support status, and what would it take to move.

A developer who cannot answer that quickly is telling you something. So is an agency that quotes a feature roadmap without mentioning it.

Find out what you are actually running

Frequently nobody knows, and the answer is older than anyone expects. Hosting control panels report it; so does a one-line script.

Budget the upgrade as its own project

Version upgrades are not features and should not be squeezed into a feature sprint. They need a staging environment and a rollback plan.

Watch for the extension trap

Upgrades usually break on a dependency or an abandoned extension rather than on your own code. That audit is the real work.

Do not let hosting decide it for you

A host that silently upgrades PHP can take a site down without warning; one that never upgrades leaves you exposed. Neither default is acceptable.

Contractor, agency or employee

All three work and they fail differently. A contractor is the best value for well-specified work and carries genuine single-point-of-failure risk. An agency buys continuity and process at a higher rate. An employee makes sense above a threshold of steady work and is expensive below it, because a developer waiting on other people’s decisions is the most costly way to buy code.

The honest test is how much work you genuinely have. Under roughly a day a week, a contractor or a small agency is almost always right. Above a steady three or four days a week with a real backlog, hiring starts to make sense — and the fully loaded cost is considerably more than the salary.

How to screen a PHP developer without being technical yourself

You do not need to read code to run a useful screen. You need to ask questions whose answers reveal how someone works, and to notice whether the answers are specific or generic.

The most informative question is about something that went wrong. Ask a candidate to describe a production incident they caused or inherited, what the impact was, and what they changed afterwards. People who have genuinely operated systems answer this readily and in detail. People who have not will generalize.

Ask what they would not do

A developer who cannot name an approach they consider a mistake has either not formed opinions or is telling you what you want to hear.

Ask how they test

“Manually” is an acceptable answer for a small site and a warning sign for an application. The question is whether the answer is deliberate.

Ask what happens when they are unavailable

Every contractor should have an answer. The absence of one is the risk you are actually buying.

Give a small paid task before a large one

A short paid piece of real work tells you more than any interview, and it is fair to the candidate.

Security is the part that gets skipped and then costs the most

PHP applications are among the most attacked targets on the web, mostly through predictable routes: outdated dependencies, injection through unvalidated input, weak session handling and file upload flaws. None of it is exotic and almost all of it appears on the OWASP Top Ten, which is the reference worth handing a developer.

The commercial framing is what usually lands: the cheapest hour anyone spends on your codebase is the one that keeps dependencies current, and the most expensive is the incident response you buy by not doing it. That is an ongoing budget line, not a one-off task.

What PHP work costs, and why quotes vary so much

Rates vary more by what you are buying than by geography. A WordPress fix priced hourly, a framework build priced per sprint and a legacy rescue priced as a retainer are three different commercial arrangements, and comparing their headline rates tells you very little.

The variable that actually predicts cost is specification quality. Well-specified work is cheap in any arrangement because the developer is not absorbing your indecision. Vague work is expensive everywhere, and the expense arrives as scope disputes rather than as a higher rate.

Specify outcomes, not implementations

Say what must be true when it is done. Prescribing how to build it removes the expertise you are paying for.

Separate discovery from delivery

A short paid discovery that produces a real spec is almost always cheaper than a fixed-price quote against a vague brief.

Beware the cheapest fixed price

On a vague brief it is a bid on the narrowest possible reading, and the difference arrives as change requests.

What you should own when the work ends

Everything, and it should be true continuously rather than arranged at the end. The repository in your organization, the hosting and domain in your accounts, the environment variables documented, and the deployment process written down somewhere other than in one person’s head.

The test is simple and worth applying before you need it: if this developer stopped answering tomorrow, could another one take over? If the honest answer is no, that is the risk you are carrying, regardless of how well the relationship is going.

Where PHP work most often goes wrong after launch

The failures that cost most are rarely in the original build. They arrive months later, when nobody owns the system, dependencies drift, and the person who understood it has moved on. Every one of these is predictable and cheap to prevent at the start.

The pattern is consistent enough to plan against: the site works, so maintenance is deferred; a dependency goes stale; an update eventually becomes mandatory and now breaks three things at once; and the developer who could have fixed it in an hour left eighteen months ago.

The maintenance conversation worth having before the build

Ask who owns the system after launch, what the monthly update routine is, and what happens when a dependency needs a breaking change. A supplier with real answers will have them ready. A supplier who treats maintenance as an afterthought is quoting you a lower number by leaving the expensive part out.

What Progression does and does not do here

We build and maintain PHP applications and WordPress sites where the work has to keep running — version upgrades, dependency hygiene, integrations and the documentation that makes the next person’s job possible.

We are not a staffing agency and we do not place contractors. If what you need is a developer embedded in your team on a day rate, that is a different supplier and we will say so.

Where we would tell you not to hire us

If you have a large, healthy engineering team and need one more pair of hands, a contractor is cheaper and faster than an agency relationship.

What we are weakest at

We do not do high-volume mobile application work. PHP back ends that serve mobile clients, yes; native app development, no.

What to establish before you hire PHP developers

Businesses arrive at the decision to hire PHP developers from two very different directions, and the right answer differs sharply between them. One is building something new and choosing a stack. The other has inherited a working PHP application and needs someone who can safely change it. The second is far more common and far less well served by generic job descriptions.

If you are maintaining an existing system, the framework and version matter more than general language skill. A PHP web developer fluent in Laravel is not automatically productive in a legacy codebase with no framework, and a developer comfortable on PHP 8 may be slowed considerably by a PHP 5 application that cannot be upgraded quickly. Ask about the specific situation rather than the language.

If you are building new, the more useful question is what else the work touches. Most projects that need a PHP developer also need database design, front-end work, and deployment. Whether you hire a PHP website developer who covers that range or assemble specialists changes both the cost and how long the project takes to start moving.

Marketing expense

A definitional question with accounting consequences.

What is marketing expense: the cost of activities intended to promote and sell products, recorded as an operating expense in the period incurred rather than capitalized. It covers advertising media, agency and contractor fees, marketing salaries, events, production of promotional material, martech subscriptions and market research.

Two boundaries cause most of the confusion. Advertising costs are generally expensed as incurred under US accounting standards rather than spread across the periods the advertising is expected to benefit, which is why a large campaign lands in one quarter. And website development costs are treated differently again: some development is capitalized as software while the content and promotional elements are expensed, which is worth agreeing with finance before a large build.

Reference videos

Technical and measurement fundamentals relevant to the work described above.

Frequently asked questions