Overview
PHP remains one of the most widely deployed server-side languages on the web. WordPress, Drupal, Magento, WooCommerce, and the majority of shared hosting infrastructure run on PHP. Bespoke web applications built a decade ago that are still in active use are frequently PHP applications. The language has evolved substantially — PHP 8.x is a genuinely modern language with strong typing, match expressions, fibers, enums, first-class callable syntax, and performance improvements that make it meaningfully faster than earlier versions. The ecosystem around modern PHP — Composer for dependency management, Laravel and Symfony as mature full-stack frameworks, PHPUnit for testing, PHP-CS-Fixer and PHPStan for code quality — is production-ready infrastructure that supports serious application development.
PHP is not our primary development language. New applications that we design from scratch are typically built in our primary stack — Rust, C#, TypeScript/Next.js — where those languages offer performance, type safety, or ecosystem advantages for the specific application. PHP enters our work primarily in two contexts: existing PHP applications that need to be maintained, extended, or refactored; and applications where the target deployment environment, the team's existing expertise, or the integration requirements make PHP the pragmatic choice — WordPress plugin development, WooCommerce customisation, custom applications on shared hosting infrastructure, and integrations with PHP-native ecosystems.
We work in PHP where the project requires it — with the same attention to code quality, correctness, and maintainability that we apply in our primary languages.
Where PHP Makes Sense
WordPress and WooCommerce development. WordPress powers a large fraction of the web, and WooCommerce is the dominant e-commerce solution built on it. When the requirement is a WordPress plugin, a WooCommerce extension, a custom theme, or integration with the WordPress/WooCommerce ecosystem, PHP is not a choice — it is a requirement. Plugin and theme development, custom post types and meta boxes, WooCommerce hooks and filters, payment gateway integration, REST API extensions, Gutenberg block development in PHP and React.
Existing PHP application maintenance and extension. A business running on a PHP application — whether custom-built or on a framework like Laravel, Symfony, CodeIgniter, or plain PHP — needs PHP developers to maintain and extend it. Rewriting a working production application in a different language is rarely the right choice; extending it, refactoring its worst sections, and improving it incrementally is usually more practical and delivers more value per unit of development effort.
Shared hosting deployments. Many small and medium business web applications run on shared hosting environments where PHP is the primary or only available server-side language. Applications designed for shared hosting deployment — client portals, booking systems, content management tools, small business operational applications — are naturally PHP applications when deployment to shared hosting is a requirement.
Laravel and Symfony applications. Laravel is a mature, well-designed MVC framework that has significantly raised the quality bar for PHP web application development. Symfony provides the component ecosystem that many PHP projects depend on. Applications built on these frameworks with modern PHP practices are maintainable, testable, and can support significant business logic complexity.
What PHP Development Covers
Modern PHP application development. PHP 8.x application code that takes advantage of the language's current capabilities — typed properties, union types, constructor property promotion, named arguments, enums, match expressions, readonly classes, and the other features that make modern PHP code more expressive and less error-prone than PHP 5.x or 7.x code.
Composer and dependency management: managing project dependencies through Composer, the standard dependency manager for PHP. Package selection from Packagist, version constraint management, autoloading configuration. The discipline of keeping dependencies current and auditing them for known vulnerabilities.
Type safety: PHP 8.x's type system applied consistently — typed function signatures, typed properties, return type declarations, the strict mode declaration that makes PHP enforce type checks at runtime. PHPStan for static analysis at the strictest level — catching type errors, null pointer dereferences, and other issues before they manifest as runtime errors. The combination of runtime typing and static analysis that approximates the safety of a compiled typed language.
Testing with PHPUnit: unit tests for business logic, integration tests for database interaction and external API calls, the test coverage that makes refactoring safe. Test doubles — mocks, stubs, fakes — for isolating units under test from their dependencies. The test infrastructure that allows PHP code to be developed with confidence.
Laravel development. Laravel's MVC structure — controllers, models, views, routes — for web application request handling. Eloquent ORM for database interaction with the fluent query builder and model relationships that make database access readable. Laravel's Blade templating for server-rendered HTML. Artisan CLI for code generation, database migrations, queue management, and other operational tasks.
Queue workers and jobs for background processing — the job that sends an email, processes an uploaded file, or calls an external API — with the queue backend (Redis, SQS, database) appropriate to the deployment environment. Laravel's event system for decoupled application components that communicate through events and listeners. Laravel's notification system for sending notifications through email, SMS, and other channels.
API development with Laravel: the Laravel API resources that transform Eloquent models into JSON responses, API authentication with Laravel Sanctum or Passport, the route structure and validation that well-designed Laravel APIs use.
WordPress plugin and theme development. The WordPress plugin API — actions and filters, the hook system that allows plugins to modify and extend WordPress behaviour without modifying core files. Custom post types and taxonomies for extending WordPress's content model. Custom meta boxes and fields for post and user metadata. Settings pages using the Settings API.
WooCommerce development: the WooCommerce hook system for extending e-commerce functionality, product type customisation, checkout field additions, order status management, shipping method development, payment gateway integration. The WooCommerce REST API for headless and integration use cases.
Gutenberg block development: custom blocks using React and the WordPress block editor API, with the PHP render_callback for server-rendered block output. Block attributes, block controls, and the InspectorControls that configure block behaviour in the editor sidebar.
Security in WordPress plugin development: escaping output with esc_html(), esc_attr(), esc_url(), and the appropriate escaping function for each context. Sanitising input with sanitize_text_field() and appropriate sanitisers. Nonce verification for form submissions and AJAX requests. Capability checks for administrative actions. The security practices that prevent the SQL injection, XSS, and CSRF vulnerabilities that poorly written WordPress plugins introduce.
Database interaction. PDO for database access in non-framework PHP — parameterised queries that prevent SQL injection, prepared statement reuse for queries that execute multiple times, transaction management for operations that require atomicity. Connection pooling considerations for high-traffic applications. Query performance analysis with EXPLAIN and the slow query log.
MySQL and MariaDB administration for PHP applications — schema design, index optimisation for the query patterns the application uses, connection configuration for PHP applications.
API integration. PHP HTTP clients for consuming REST APIs — Guzzle as the standard HTTP client, with request construction, authentication, response handling, and error management. Webhook handlers for receiving events from external services — Stripe payment webhooks, Mollie payment webhooks, shipping carrier status updates.
iDEAL integration for Dutch payment processing: Mollie's PHP client library for iDEAL, Bancontact, and other Dutch and European payment methods. The payment flow — payment creation, redirect to the payment provider, webhook notification of payment status, redirect back to the application with status.
AFAS and Exact Online PHP integration: REST API clients for AFAS Profit and Exact Online built in PHP for applications that run in PHP environments and need to integrate with these Dutch ERP systems.
Legacy PHP maintenance. Older PHP codebases — PHP 5.x or early PHP 7.x — that need to be maintained and progressively improved. Refactoring approaches that improve code quality without requiring a complete rewrite: introducing interfaces, extracting classes from procedural code, adding tests before refactoring, and upgrading PHP version compatibility incrementally.
PHP version migration: updating code that runs on older PHP versions to run correctly on PHP 8.x — handling deprecated features, fixing type errors that strict mode exposes, updating extension usage for changed APIs.
PHP in the Broader Architecture
PHP rarely operates in isolation in the systems we build. Its role is typically the web application layer or the integration layer in an architecture where other components handle different responsibilities.
PHP frontend, Rust or C# backend. In hybrid architectures where PHP handles the web presentation layer — serving HTML to browsers, handling user sessions, managing the web application routing — while a Rust or C# service handles computation-intensive processing or complex business logic, the PHP application communicates with the backend service through HTTP APIs or message queues. PHP remains the right tool for the web layer; Rust or C# handles the parts where PHP's performance or typing limitations would be a problem.
WordPress with headless architecture. WordPress used as a content management system with its REST API or GraphQL (via WPGraphQL) as the data layer, with a Next.js frontend consuming the WordPress content API rather than using WordPress's PHP template rendering. The combination that retains WordPress's mature content management capabilities while providing the modern frontend performance and developer experience of React/Next.js.
Shared hosting with external services. PHP applications on shared hosting infrastructure that integrate with external services — payment processors, email providers, CRM systems, ERP systems — through their APIs, with the business logic and data processing that the shared hosting PHP application handles being complemented by specialised external services for the capabilities that PHP is not the best fit for.
Technologies Used
- PHP 8.x — current language version with modern typing and performance features
- Composer — dependency management and autoloading
- Laravel 11 — primary PHP framework for new PHP application development
- Symfony components — used directly where full Symfony or specific components are appropriate
- WordPress / WooCommerce — CMS and e-commerce platform development
- PHPUnit — testing framework
- PHPStan — static analysis at strictest levels
- PHP-CS-Fixer — code style enforcement
- Eloquent / Doctrine — ORM for database access
- Guzzle — HTTP client for API integration
- Mollie PHP client — Dutch payment integration
- MySQL / MariaDB — primary databases for PHP applications
- Redis — session storage, queue backend, caching for Laravel applications
- Nginx / Apache — web server configuration for PHP deployment
- Docker — containerised PHP development and deployment environments
PHP Done Properly
PHP has a long history of poorly written code — global variables, SQL injection vulnerabilities, no error handling, no tests, PHP 4-era patterns still running in production. Modern PHP, written with current practices, is not this. Type-safe PHP 8.x code with Composer-managed dependencies, PHPStan at level 9, PHPUnit tests, and a modern framework is a legitimate foundation for production business applications.
The difference is not the language — it is the practices applied to it. PHP written with the same discipline applied to any other language produces code that is maintainable, testable, and reliable. PHP written without that discipline produces the legacy codebases that give the language its poor reputation.
We write PHP with that discipline, whether it is a new Laravel application, a WordPress plugin, or a legacy codebase that needs to be improved incrementally.
PHP Where PHP Is Required
PHP development for the projects that require it — WordPress and WooCommerce customisation, existing PHP application maintenance and extension, Laravel and Symfony applications, and shared hosting deployments — with the code quality standards that make PHP applications maintainable rather than accumulations of technical debt.