The verdict in three sentences
An application running on PHP 5.6 has received no security patches since the end of 2018: every month of waiting raises the risk of intrusion and the difficulty of taking it over. The right sequence starts with a code audit at USD 3,500 to 9,000 (EUR 3,000 to 8,000), which decides between an upgrade and a rewrite based on facts, not intuition. In most SMBs, a progressive rewrite over 6 to 18 months, module by module, costs less and breaks less than a "big bang".
Fixes, upgrade or rewrite: the comparison
| Option | Indicative cost | Timeline | Business risk | Lifespan gained |
|---|---|---|---|---|
| Ad hoc fixes only | USD 550 to 1,600 per month | Immediate | High, vulnerabilities unpatched | A few months |
| Code audit | USD 3,500 to 9,000 | 1 to 3 weeks | None | Informed decision |
| Upgrade to PHP 8.3 and dependencies | USD 16,000 to 44,000 | 2 to 4 months | Medium, controlled by tests | 4 to 6 years |
| Progressive rewrite (module by module) | USD 44,000 to 130,000 spread out | 6 to 18 months | Low, old and new coexist | 8 to 10 years |
| Full rewrite in one block | USD 55,000 to 165,000 | 6 to 12 months before go-live | High, single cutover | 8 to 10 years |
A full rewrite looks simpler on paper. In practice, the old application holds years of undocumented business rules, and a single cutover often makes them vanish without anyone noticing until the books are closed.
What a serious audit must deliver
| Deliverable | Content | Indicative effort |
|---|---|---|
| Technical map | PHP version, framework, dependencies, database, server | 1 to 2 days |
| Security analysis | SQL injection, passwords, sessions, vulnerable dependencies | 1 to 3 days |
| Technical debt measurement | Duplication, complexity, dead code, missing tests | 1 to 2 days |
| Business rules inventory | Calculations, statuses, exports, scheduled jobs | 1 to 3 days |
| Costed recommendation | Upgrade and rewrite scenarios with budgets and schedule | 1 day |
A 5 to 10 day audit covers most SMB applications (50,000 to 200,000 lines of code). Require the audit to hand over access too: code repository, server, database, domain names. With a vanished vendor, recovering those credentials can take a week on its own.
Progressive rewrite in practice
The strangler pattern places a new application in front of the old one, then replaces screens one by one. Users only see one application. Each 4 to 8 week release replaces a module (customers, quotes, billing, reporting) and comes with regression tests that compare the outputs of old and new code on the same data. The budget is spread out, and you can stop or redirect the project after each release.
Mini case study
Michael, IT director of a distribution SMB in New York, inherits an order management application in PHP 5.6 used by 40 people. The vendor has vanished. He currently pays an emergency freelancer about 4 days a month at USD 820, i.e. USD 39,000 a year, with no improvement at all.
Chosen plan: audit at USD 6,500, upgrade to PHP 8.3 at USD 30,500, then progressive rewrite of two critical modules at USD 33,000 over 9 months. Total investment: USD 70,000. Maintenance then drops to USD 1,100 a month, i.e. USD 13,200 a year. Savings: USD 25,800 a year, plus the end of 3 to 4 monthly outages that blocked 40 people for an hour on average (about USD 6,300 a year at USD 33 per hour). Estimated payback: just over 2 years, with security risk brought to an acceptable level by month 4.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How much does a PHP code audit cost in 2026?
Budget USD 3,500 to 9,000 (EUR 3,000 to 8,000) for 5 to 10 days of analysis, depending on application size. The deliverable must include costed scenarios, not just a list of problems.
Can we go straight from PHP 5.6 to PHP 8.3?
Yes, but through internal technical steps (syntax fixes, replacing removed functions, updating libraries). Budget USD 16,000 to 44,000 depending on code size and existing tests.
What if we no longer have the source code?
If the application still runs, the PHP code is on the server, because it is not compiled. Recovering it and putting it under Git usually takes 1 to 3 days.
Should we write tests before touching the code?
Yes. Regression tests on the 20 to 30 critical user journeys take 5 to 10 days and prevent most regressions during migration.
Progressive or full rewrite: how do we decide?
If the audit finds over 60% of the code reusable, upgrade first and then rewrite progressively. Below 30%, a full rewrite can be justified, with a parallel run period.
Let's scope your project. Describe your application, its version and its users: we start with a costed audit, then an upgrade or progressive rewrite plan with a budget per release. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
