The verdict in three sentences
Taking over an undocumented legacy web app always starts with a takeover audit at USD 3,500 to 9,000, which prevents paying for an unnecessary rewrite. In 6 cases out of 10, a progressive upgrade at USD 16,000 to 50,000 is enough, while a full rewrite costs USD 65,000 to 130,000. A three-phase, six-month plan secures operations, quantifies technical debt and gives the CEO back control of the tool.
The situation: a vanished vendor, a critical app
Marc, CEO of a Toronto industrial supplies distributor (45 employees), has used a custom web app since 2017 for quotes, orders and delivery routes. His vendor has closed. He inherits PHP 7.2 code with no automated tests, no documentation, on a server he only partly controls. PHP 7 has had no security patches since late 2022, and any outage blocks invoicing.
The priority is recovering access: code repository, server, database, domain name, transactional email accounts. Without them, no serious agency can commit.
The takeover audit: what it measures and what it costs
| Audit area | What is checked | Deliverable |
|---|---|---|
| Inventory and access | Code, servers, database, domain, backups | Signed inventory, access transferred |
| Code quality | Duplication, complexity, outdated dependencies | Maintainability score per module |
| Security | OWASP flaws, vulnerable versions, passwords | Prioritised list of flaws |
| Data | Schema, integrity, volume, privacy compliance | Documented schema |
| Real usage | Features used or abandoned | Functional map |
| Technical debt | Estimate in remediation days | Costing and scenarios |
For an app of 30,000 to 80,000 lines of code, the audit takes 5 to 12 days and costs USD 3,500 to 9,000. It produces one key number: technical debt, expressed in work days needed to bring the code back to a maintainable state.
Upgrade or rewrite: the numbers
| Criterion | Progressive upgrade | Full rewrite |
|---|---|---|
| Budget | USD 16,000 to 50,000 | USD 65,000 to 130,000 |
| Duration | 2 to 4 months | 5 to 9 months |
| Disruption risk | Low, staged releases | High at cutover |
| Data migration | None | Full migration |
| User training | Minimal | 1 to 3 days per role |
| Relevant when | Sound business logic, debt below 40% of rewrite cost | Blocking architecture, debt above 60% |
| Lifespan gained | 4 to 6 years | 8 to 10 years |
The rule of thumb: if technical debt exceeds 60% of the cost of a rewrite, rewriting becomes rational. Below 40%, upgrading clearly wins. In between, the roadmap decides: many planned changes tip toward a rewrite.
The three-phase, six-month plan
| Phase | Month | Actions | Indicative budget |
|---|---|---|---|
| 1. Secure | 1 | Recover access, tested backups, urgent security fixes, monitoring | USD 4,500 to 10,000 |
| 2. Stabilise | 2 to 4 | Move to PHP 8.3, framework update, tests on critical flows, documentation | USD 13,000 to 33,000 |
| 3. Evolve | 5 to 6 | First requested changes, monthly maintenance contract in place | USD 5,500 to 13,000 |
Afterwards, an application maintenance contract at USD 900 to 2,700 a month covers bug fixes, security updates and a volume of changes. The contract should set response times, for example 4 business hours for a blocking incident.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Marc's audit costs USD 6,000 and puts technical debt at 55 days, about USD 36,000 at USD 650 a day, versus USD 103,000 for a rewrite. Ratio: 35%, so upgrade. The full plan totals 6,000 + 36,000 = USD 42,000, then maintenance at USD 1,300 a month. A single day of blocked invoicing costs him about USD 19,500 in delayed revenue; avoiding two incidents a year is enough to justify the maintenance contract. Compared with the rewrite, he saves USD 61,000 and 4 months.
FAQ
How much does a web app takeover audit cost?
Between USD 3,500 and 9,000 for 5 to 12 days of analysis, depending on code size. It delivers an inventory, a list of flaws and a technical debt estimate.
Can an app be taken over without documentation?
Yes, the audit rebuilds minimum documentation from the code and database. Allow 15 to 20% of the upgrade budget for documentation and first tests.
Should a PHP 7 app be rewritten?
Not necessarily: moving to PHP 8.3 often costs USD 16,000 to 50,000, versus USD 65,000 to 130,000 for a rewrite. It all depends on the ratio of technical debt to rewrite cost.
What if the former vendor withholds access?
A formal demand based on the contract often works. Failing that, the host and domain registrar can transfer access to the legal owner on proof, within 1 to 4 weeks.
How much does maintenance cost after takeover?
USD 900 to 2,700 a month for an SME, with committed response times. Major changes are quoted separately.
Let's scope your project. We audit your inherited app in 5 to 12 days (USD 3,500 to 9,000), then price the upgrade or rewrite with a six-month plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
