Skip to content
Get a quote

PHP upgrades · Laravel · Legacy code

Your PHP site is out of support. We fix that — safely.

We move custom PHP and Laravel projects to PHP 8.4/8.5 with automated refactoring, careful manual review and testing on staging. Fixed price after a quick look at the code.

PHP versions we migrate across
5.x → 8.5
PHP versions we migrate across
Free fixes after every release
14 days
Free fixes after every release
Reply time for new requests
1 day
Reply time for new requests
Price agreed before work starts
Fixed
Price agreed before work starts

Services

What we fix and upgrade

Prices are starting points. The final fixed price comes after a short code review — before any work starts.

from $79

Code & Compatibility Audit

Know exactly what breaks before you pay for the fix.

  • Static analysis against PHP 8.4 / 8.5
  • List of breaking changes with effort estimate
  • Risk map: payments, auth, forms, integrations
  • Fixed quote for the migration
Timeline: 1–2 days Get a quote →
from $199

Custom PHP → PHP 8.4 / 8.5

Fix your outdated PHP site before it breaks or gets hacked.

  • Compatibility & risk audit
  • Automated refactoring (Rector) + manual review
  • Testing of main user flows on staging
  • Short report of every change
Timeline: 3–7 days Get a quote →
from $349

Laravel Upgrade

From Laravel 6–10 to the current release, without downtime.

  • Dependency and package audit
  • Step-by-step major version upgrades
  • Package replacements where abandoned
  • Key features verified on staging
Timeline: 5–12 days Get a quote →
from $299

CRM, Admin Panels & Internal Tools

Modernize the system your team relies on every day.

  • PHP upgrade + code modernization
  • Business logic preserved and covered by checks
  • Better error handling and logging
  • Clear summary of changes
Timeline: 5–14 days Get a quote →
from $89

Scripts, Parsers & Bots

Make old scripts run again on modern hosting.

  • Removed / deprecated functions replaced
  • Basic reliability and retry logic
  • Ready-to-run version + notes
Timeline: 1–4 days Get a quote →
from $149

Emergency Fix

Hosting upgraded PHP and your site is down.

  • Response within business hours, same day
  • Site back online first, clean fix second
  • Root cause explained in plain words
Timeline: 24–48 hours Get a quote →
from $149

WordPress Performance & PHP Upgrade

Slow WordPress even with caching? We find the real bottleneck.

  • Profiling with Query Monitor and server logs
  • Autoloaded options, N+1 queries, external HTTP calls
  • Plugin culprit isolated on staging
  • PHP version upgrade under the site
Timeline: 1–3 days Get a quote →
from $990

Legacy → Modern Framework

Move spaghetti code to Laravel or Symfony step by step.

  • Composer, autoloading, PSR standards
  • Tests around critical scenarios
  • Module-by-module migration (strangler fig)
  • The site keeps working the whole time
Timeline: from 2 weeks Get a quote →
from $129

Server & Hosting Move

From aging shared hosting to a fast, predictable setup.

  • VPS or Docker setup, PHP-FPM, OPcache
  • HTTPS, backups, basic monitoring
  • Zero-downtime DNS switch
Timeline: 1–3 days Get a quote →
from $79/mo

Care Plan

Keep it upgraded so you never need an emergency fix.

  • Uptime and error monitoring
  • Monthly dependency and security updates
  • Included hours for small changes
  • Planned PHP upgrades each year
Timeline: monthly Get a quote →

Why now

Old PHP is a risk that grows every month

Unsupported versions get no security patches. Hosting providers switch them off, and the site breaks on a random Tuesday.

  1. PHP 5.x – 7.4 No patches since 2022 or earlier
  2. PHP 8.0 End of life Nov 2023
  3. PHP 8.1 End of life Dec 2025
  4. PHP 8.2 Security fixes end Dec 2026
  5. PHP 8.3 Security only until Dec 2027
  6. PHP 8.4 Supported until Dec 2028
  7. PHP 8.5 Supported until Dec 2029

Security holes

Known vulnerabilities stay open forever.

Forced hosting upgrades

The provider updates PHP and fatal errors appear overnight.

Blocked development

Modern packages and payment SDKs require PHP 8.2+.

Emergency costs

A rushed fix costs more than a planned migration.

How we modernize

Three ways forward — we tell you which one fits

01

Upgrade in place

Same code, new PHP version. Automated refactoring with Rector, static analysis with PHPStan, manual fixes where logic is involved.

When: When the code works and the goal is to stay supported.

Fastest, lowest cost

02

Incremental modernization

Composer, autoloading, tests around critical flows, then module-by-module migration into Laravel or Symfony. The site keeps running.

When: When the project will live for years and needs new features.

Spread over weeks, pays back in maintenance

03

Rewrite

Only when the first two cost more. We recommend it rarely and say so openly.

When: When the old code blocks the business and has no salvageable core.

Highest cost and risk

Tooling: RectorPHPStanPHPCompatibilityComposerPHPUnit / PestDockerGitQuery Monitor

Process

Predictable steps, no surprises in production

  1. 01

    Audit

    We review the code and hosting, list breaking changes and risky areas.

  2. 02

    Fixed quote

    You get a price and timeline. No hourly surprises.

  3. 03

    Staging copy

    All work happens on a copy. Your live site is untouched.

  4. 04

    Refactor

    Automated changes first, then manual review of business-critical parts.

  5. 05

    Test

    Main user flows checked: forms, payments, admin, cron jobs.

  6. 06

    Release

    Planned switch with a rollback plan and a written report.

14-day guarantee

If something we changed breaks within 14 days after release, we fix it for free.

Case studies

Real legacy, fixed

Recent migrations, anonymized. Each one went through staging and is live on PHP 8.3+.

Hosting provider

PHP 5.6 → PHP 8.3

64 → 0 SQL queries with raw variables

− Before

  • SQL injection on the news page, exploited for over a year
  • Client passwords stored in plain text
  • DB password and API keys hardcoded in source
  • 37 MB error log and phpinfo() publicly accessible

+ After

  • Single front controller, PDO with bound parameters
  • CSRF on every form, admin login with password_hash and IP lockout
  • All old URLs kept with 301 redirects
  • Billing system isolated for a separate upgrade

Agency job-tracking system

PHP 5.4 → PHP 8.3

109 → 0 concatenated SQL queries

− Before

  • Admin login could be bypassed without a password
  • Full database dump downloadable from the site root
  • Staff passwords in plain text, users in unsalted md5
  • Destructive actions triggered by plain GET links

+ After

  • Parameterized queries throughout
  • password_hash with transparent rehash on login
  • CSRF protection, all changes via POST
  • Public DB dump and phpinfo() removed

Client statistics portal with payments

PHP 5.4 → PHP 8.3

~470 → 0 SQL queries built from request data

− Before

  • register_globals emulation: any GET/POST parameter overwrote any variable
  • Payment provider private keys in source code
  • Password reset tokens from md5(time)

+ After

  • Explicit, typed input handling and PDO everywhere
  • JSON API with CSRF instead of legacy AJAX connectors
  • Secure reset tokens, 437 passwords upgraded on next login
  • PHPUnit test suite

Web agency site with custom CMS

PHP 5.4 → PHP 8.3

419 MB public error log, now gone

− Before

  • Entire codebase reachable from the web
  • SQL injection and XSS throughout, no CSRF
  • Email header injection in contact forms

+ After

  • Only index.php is public; modular CMS core shared across sites
  • Templates with auto-escaping, real 404 responses
  • Every legacy /page.php URL 301-redirected
  • Content migrated and verified against the original site

What actually changes

Typical fixes in a PHP 7 → 8.4 migration

Most breakages are well known. Tools catch the mechanical ones, we handle the rest by hand.

each() removed in PHP 8
− beforewhile (list($k, $v) = each($items)) {
    echo "$k: $v";
}
+ afterforeach ($items as $k => $v) {
    echo "$k: $v";
}
mysql_* removed in PHP 7
− before$r = mysql_query("SELECT * FROM users WHERE id = $id");
$user = mysql_fetch_assoc($r);
+ after$st = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$st->execute([$id]);
$user = $st->fetch();
create_function() removed in PHP 8
− beforeusort($rows, create_function('$a,$b',
    'return $a["price"] - $b["price"];'));
+ afterusort($rows, fn($a, $b) =>
    $a['price'] <=> $b['price']);

Who’s behind FixPHP

You talk to the engineer who does the work

FixPHP is a small engineering studio focused on one thing: keeping PHP projects alive, secure and supported. No account managers, no outsourcing chain — the person who reviews your code is the person who fixes it.

  • Direct communication, no middlemen
  • Code and data stay private, NDA on request
  • Written report after every project

Focus

What we don’t do

Staying narrow is how we keep quality high and prices fixed.

  • WordPress theme or plugin development (performance and PHP upgrades only)
  • Design and marketing sites from scratch
  • Projects without access to the code (we can host the staging copy on our side)

Pricing

Starting prices

Every project gets a fixed quote after the audit. The audit fee is credited to the work.

Service Price
Code & Compatibility Audit 1–2 days from $79
Custom PHP → PHP 8.4 / 8.5 3–7 days from $199
Laravel Upgrade 5–12 days from $349
CRM, Admin Panels & Internal Tools 5–14 days from $299
Scripts, Parsers & Bots 1–4 days from $89
Emergency Fix 24–48 hours from $149
WordPress Performance & PHP Upgrade 1–3 days from $149
Legacy → Modern Framework from 2 weeks from $990
Server & Hosting Move 1–3 days from $129
Care Plan monthly from $79/mo

FAQ

Questions clients ask

How do you give a fixed price?

We look at the code (repository or archive) and hosting, run static analysis and estimate the effort. You get one number before any work starts.

Will my site go down during the upgrade?

No. All work happens on a staging copy. The live site is switched only after you approve the result, with a rollback plan ready.

What do you need from me?

Access to the code, a database dump (anonymized is fine) and a list of things that must not break: payments, forms, integrations.

What if there are no tests?

That is normal for legacy code. We add checks for the critical flows during the migration so the next upgrade is easier.

Do you work with WordPress?

Only performance problems and PHP version upgrades. We don’t build themes or plugins.

Can you sign an NDA?

Yes. We also work through Upwork contracts if you prefer escrow.

Contact

Tell us about your project

Answer a few questions — we reply within one business day with next steps or a preliminary estimate.

hello@fixphp.dev

We use your data only to reply to this request. Privacy