The verdict in three sentences
A PHP 5 business application with no tests or documentation costs between £50,000 and £180,000 to rewrite in London in 2026, after an audit of £3,000 to £9,000 that shapes everything else. The right approach is almost always an incremental rewrite over 6 to 12 months, module by module, rather than a big-bang rewrite delivered in one go. The real financial risk is not the price of the rewrite but the cost of doing nothing: an exploited vulnerability or the departure of the only developer who understands the code.
Why PHP 5 has become a business risk
PHP 5.6 has received no security fixes since 31 December 2018, PHP 7.4 since November 2022. In 2026, an application on these versions often runs on a server whose operating system is also out of support, with abandoned libraries. For a UK SME subject to UK GDPR, and increasingly to Cyber Essentials requirements from public sector and enterprise clients, this is something insurers and procurement teams now check.
| Risk | Likelihood over 3 years (2026 order of magnitude) | Cost of an incident for an SME |
|---|---|---|
| Exploited vulnerability, data breach | high without updates | £25,000 to £120,000 (forensics, ICO notification, downtime) |
| Departure of the only developer | 30 to 50% | 6 to 12 months with no changes possible |
| Host drops PHP 5 support | near certain | emergency migration at 1.5 to 2 times the price |
| Enterprise client rejects you (security questionnaire) | medium | loss of a £50,000 to £300,000 contract |
| Cyber insurance cancelled or surcharged | medium | +20 to 40% premium |
| Blocking bug that cannot be fixed | medium | 2 to 10 days without invoicing |
Rewrite price ranges
Price depends on codebase size, database quality and the number of implicit business rules. A management application of 30,000 to 80,000 lines of PHP, typical of a manufacturing or distribution SME, sits mid-range.
| Item | Content | 2026 budget (GBP) |
|---|---|---|
| Code and architecture audit | Mapping, technical debt, vulnerabilities, rewrite plan | 3,000 to 9,000 |
| Simple version upgrade (PHP 8.3) | If code is sound, no architecture change | 14,000 to 40,000 |
| Regression tests | Tests on critical journeys before touching the code | 7,000 to 20,000 |
| Incremental rewrite (Laravel or Symfony) | Module by module, old and new side by side | 50,000 to 180,000 |
| Data migration | Cleaning, deduplication, migration scripts, rehearsals | 6,000 to 22,000 |
| Training and documentation | User guide, technical documentation | 2,000 to 7,000 |
| Post-launch maintenance | Fixes, updates | 15 to 20% of project per year |
Day rates of £600 to £850 are common for a senior London team in 2026, so a full 200-day rewrite quickly reaches £140,000 or more.
Incremental rewrite or big-bang rewrite
The big-bang rewrite is tempting because it promises a clean slate. It often fails for a simple reason: for 9 months the old application keeps changing, and business rules nobody documented reappear as bugs on go-live. The incremental rewrite, also called the strangler pattern, puts a new application in front of the old one and replaces screens one at a time.
| Criterion | Big-bang rewrite | Incremental rewrite |
|---|---|---|
| First visible gain | 9 to 12 months | 6 to 10 weeks |
| Regression risk | high, concentrated at cutover | low, spread out |
| Budget committed before validation | 100% | 15 to 25% per release |
| Business downtime at cutover | 1 to 3 days | none |
| Ability to stop midway | no | yes, after each release |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Claire, IT director of a 120-person building supplies distributor in London, runs a quoting and ordering application written in PHP 5.4 in 2011. The original developer retires in 10 months. The audit (£7,000) prices the incremental rewrite at £115,000 over 9 months. She compares it with doing nothing: an emergency migration estimated at 1.7 times the price, about £195,000, plus 5 days of order intake downtime on revenue of £55,000 per day, so £275,000 of delayed or lost orders. Investing £122,000 now avoids a risk estimated at over £470,000, and the first module (quoting) is live in 8 weeks.
FAQ
Can we just move to PHP 8 without rebuilding everything?
Yes, if the code is structured and dependencies still exist, for £14,000 to £40,000. The audit tells you within 2 to 3 weeks; in about 40% of the cases we see, it is enough.
How long does the audit take?
From 5 to 12 days depending on codebase size, delivered with a module map, the list of vulnerabilities and a rewrite plan priced per release.
How do we avoid losing data during migration?
We run 2 to 3 full migration rehearsals on a production copy, with consistency checks (customer count, invoiced totals). The final cutover happens over a weekend.
Do we have to stay on PHP?
Not necessarily, but staying on modern PHP (Laravel, Symfony) makes hiring in London easier and lets you reuse 20 to 30% of the business logic.
Is there any funding available?
R&D tax relief can apply to parts of a technically uncertain modernisation, and some local growth hubs fund digital projects. Amounts vary; allow 2 to 4 months for any application.
Let's scope your project. Start with an audit of £3,000 to £9,000 that gives you a rewrite plan priced release by release, before committing to a budget of £50,000 to £180,000. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
