The verdict in three sentences
A business application on PHP 5 whose original developer has left is no longer a technical topic but an operational risk: PHP 5 has received no security patches since 2019. For an insurer or SME in Frankfurt, incremental module-by-module migration costs EUR 60,000 to 150,000 excluding VAT over 9 to 12 months and keeps operations running; a full rewrite costs EUR 120,000 to 250,000 and is only justified if business rules have changed deeply. In 7 cases out of 10, incremental migration is the right call.
The measured diagnosis before any decision
Before comparing quotes, a 5 to 10 day audit (EUR 4,000 to 9,000) measures the application's real condition. Here are the indicators we most often find on this type of project.
| Indicator | Typical observed value | Acceptable threshold | Consequence |
|---|---|---|---|
| PHP version | 5.6 | 8.2 or later | No security patches since 2019 |
| Critical vulnerabilities (SQL injection, XSS) | 3 | 0 | Risk of member data leaks |
| Automated tests | 0 | 60% of business rules covered | Every fix can break something else |
| People who know the code | 1 | 2 minimum | Possible shutdown if they leave |
| Lines of code | 80,000 to 150,000 | Not applicable | Basis for the estimate |
| Outdated dependencies | 15 to 30 | 0 unmaintained | Server incompatibility in the short term |
| Average bug fix time | 3 to 5 days | Under 1 day | Maintenance cost tripled |
For a health insurer, the 3 critical vulnerabilities alone justify urgency: health data falls under Article 9 of the GDPR, and a breach must be reported to the supervisory authority within 72 hours.
Incremental migration or rewrite: the comparison
| Criterion | Incremental migration | Full rewrite |
|---|---|---|
| Budget excl. VAT | EUR 60,000 to 150,000 | EUR 120,000 to 250,000 |
| Duration | 9 to 12 months | 12 to 18 months |
| Go-live | Module by module, every 6 to 8 weeks | All at once, at the end |
| Risk of business disruption | Low | High at cutover |
| Critical vulnerabilities secured | From the first month | At final delivery |
| Business rules preserved | All, documented along the way | Must be fully re-specified |
| Internal team effort | 2 to 4 days per month | 8 to 12 days per month on specifications |
Incremental migration follows the strangler fig pattern: a new PHP 8 application built on Symfony or Laravel sits in front of the old one, and each module (members, contributions, claims, document output) is rewritten and switched over one at a time. The old code is retired step by step.
Budget breakdown of an incremental migration
| Phase | Content | Budget excl. VAT | Duration |
|---|---|---|---|
| Audit and emergency hardening | Fix the 3 vulnerabilities, backups, monitoring | EUR 8,000 to 15,000 | 1 month |
| Foundation and regression tests | New architecture, 60% of rules tested | EUR 12,000 to 25,000 | 2 months |
| Members module | Records, search, history | EUR 10,000 to 25,000 | 2 months |
| Contributions module | Calculations, schedules, SEPA direct debits | EUR 15,000 to 40,000 | 3 months |
| Claims and document output module | Reimbursements, PDF letters | EUR 12,000 to 35,000 | 2 to 3 months |
| Decommissioning | Old code shut down, documentation | EUR 3,000 to 10,000 | 1 month |
The contributions module is almost always the most expensive: it holds 15 years of accumulated rules, often documented nowhere but in the code.
Mini case study
Stefan, CIO of a regional health insurer in Frankfurt (42,000 members, 60 staff), depends on a PHP 5 application built in 2011 by a freelance contractor who has since closed his business. Emergency maintenance costs him EUR 2,400 a month on time and materials, i.e. EUR 28,800 a year, with no improvements at all.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
He opts for an incremental migration quoted at EUR 110,000 over 11 months. After cutover, maintenance drops to EUR 900 a month (EUR 10,800 a year) and processing time per claim falls from 12 to 7 minutes, saving about 1,400 hours a year across 17,000 claims. Valued at EUR 35 an hour, that is EUR 49,000. Total annual gain: EUR 67,000. Payback: 20 months, excluding the avoided cost of a data breach.
FAQ
Can we simply upgrade from PHP 5 to PHP 8 without a rebuild?
On a small, well-written application, yes, for EUR 10,000 to 25,000. On 100,000 lines without tests, the upgrade usually breaks 15 to 30% of screens and ends up costing almost as much as an incremental migration.
Do we have to freeze changes during the migration?
No, that is the advantage of the incremental approach. Changes are built directly into the new modules, with 10 to 15% of the budget reserved for them.
How do we avoid depending on one person again?
Require in the contract up-to-date documentation, test coverage of at least 60% and code delivered to your own Git repository. At least 2 developers should work on the project.
Which framework should we choose?
Symfony and Laravel are the two standards in 2026; Symfony is often preferred in regulated sectors for its 3-year support cycle per LTS version. The cost difference between them is under 5%.
How much does maintenance cost after the rebuild?
Allow 12 to 18% of the rebuild cost per year, i.e. EUR 10,000 to 20,000 for a EUR 110,000 project, security updates included.
Let's scope your project. Describe your application, its PHP version and modules: we will propose a scoped audit, a migration scenario and a budget envelope. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
