Custom PHP App Security Updates
In-house and legacy PHP applications rarely get vendor patches. We audit your PHP version, server setup and code paths, then patch or upgrade PHP and fix the risky parts with a backup and rollback plan.
Audit · PHP patching & upgrades · Code fixes · Rollback plan
Start With an Audit
We confirm the PHP version, the server setup and the attack surface before changing anything, so the fix matches the risk.
Upgrade Without Rewrites
Most upgrades are about compatibility fixes, not rewrites. We fix what's needed to run on a supported PHP version.
Clear Handover
You get a written record of changes and the remaining risks, so your team knows what to watch.
What's Included
Common Scenarios
Legacy App on Old PHP
The app is critical to the business and runs an end-of-life PHP version. We plan a safe path to a supported version.
Unknown Exposure
Nobody is sure what version runs where or which settings are in place. We map it and tell you what needs fixing first.
Suspected Compromise
You think the app may have been hit. We patch, review logs and file changes, and report what we could and couldn't confirm.
How a Custom App Upgrade Runs
£149 Check and Code Audit
We confirm the PHP version and exposure, then audit the codebase: deprecated functions, removed extensions (mysql_*, mcrypt, each()), dynamic property usage and anything PHP 8.x will fatal on.
Staging and Smoke Tests
The app is cloned to staging on the target PHP version. If you have no test suite, we write smoke tests for the critical flows — login, key forms, cron jobs — so the upgrade is verifiable, not guesswork.
Upgrade and Compatibility Fixes
PHP moves to a supported release and incompatible code is fixed in scope: up to 5 broken items included, extras at £95 each agreed first. Composer dependencies are updated or replaced where abandoned.
Production Deploy and Handover
The verified build ships in a low-traffic window with rollback ready. You get a written record of every change, remaining deprecations to watch, and a recommended maintenance path.
Pricing
Transparent, scope-based pricing. Every job includes a backup, a staging test and a post-change check.
Emergency Patch
£999
Same or next day
- ✓Safe PHP patch to a supported release
- ✓Backup before change
- ✓Staging check
- ✓Post-patch verification
Managed Maintenance
from £449 / month
from £4,499 billed annually
- ✓Ongoing PHP and dependency patching
- ✓Advisory monitoring
- ✓Monthly report
- ✓Backups and uptime checks
- ✓The £149 PHP check included to start
- ✓Scoped after the check — legacy and bespoke codebases vary
Version Upgrade
from £5,999
1–3 weeks
- ✓Move off end-of-life PHP
- ✓Compatibility testing
- ✓Staging QA
- ✓Rollback plan and post-upgrade support
Prices are indicative ranges based on project scope. Contact us for a tailored quote.
Frequently Asked Questions
Our app has no tests and few docs. Can you still help?+
Yes. The audit comes first, and we'll add smoke tests for the critical flows so we can check the change works before it goes live.
Do I need to rewrite the app?+
Usually not. Most PHP upgrades are about fixing deprecated functions and compatibility issues. If a rewrite is needed, we'll say so and quote it separately.
What if I can't patch straight away?+
Patching is the complete fix. If you can't do it yet, we can help apply temporary hardening, such as tightening upload and session settings, but that only reduces exposure.
How do you handle code written for PHP 5?+
PHP 5-era code usually can't be patched in place — removed functions (mysql_*, mcrypt, each(), create_function) need real replacements. The audit tells you exactly how much: often it's a few dozen call sites, not a rewrite. Where it is a rewrite, we say so before you spend anything.
Who wrote your custom PHP work?+
Our own senior developers, based in the UK. The £149 check report names who did the audit, and the upgrade quote comes with the same person available on a call if you want to talk it through.
Start With the £149 PHP Check
Tell us which application you run and which PHP version it's on. You get a written report of your exposure and the recommended next step.