The argument about PHP is unusually unproductive, because the two sides are describing different things. One side is describing PHP 8.5 — typed, fast, with a mature ecosystem and two of the best web frameworks in existence. The other is describing a codebase written in 2011 that they had to maintain, and their objection is not really about the language.
We build in PHP and in Node.js and we have no stake in the answer. This is what we actually tell clients when they ask whether they should be worried about the platform their business runs on.
Current at the time of writing: PHP 8.5 is the stable release, 8.4 is the previous stable, 8.3 is in security-only support, and PHP 8.2's security support ends on 31 December 2026. Verify these dates before you plan against them — they move.
What Actually Changed
The PHP that deserved its reputation and the PHP that ships today are separated by a decade of work that most of the language's critics have not looked at.
- A real type system. Scalar types, return types, union types, readonly properties, enums. Combined with static analysis at a high level, a modern PHP codebase catches at build time what used to be found in production.
- Performance. PHP 7 roughly doubled throughput over 5.6, and 8.x added a JIT and continued incremental gains. For a request-response web workload — which is what commerce is — it is comfortably fast enough that the language is rarely the constraint.
- Frameworks that shaped their competitors. Laravel and Symfony are genuinely excellent, and much of what is now standard elsewhere started in one of them.
- Modern tooling. Composer, PHPStan and Psalm, PHPUnit and Pest, and a container story that is unremarkable in a good way.
None of that makes PHP the right answer to every question. It makes the reputation a poor input to the decision.
Where PHP Is Still the Right Answer
1. You Are Already Running Commerce on It
The largest commerce platforms in the world — Magento, WooCommerce, Shopware, PrestaShop — are PHP applications with mature ecosystems, thousands of extensions and a deep pool of specialists. Leaving PHP means leaving that ecosystem, which is a much larger decision than changing a language.
2. Hiring Matters More Than Benchmarks
The talent pool is enormous, geographically distributed, and priced sensibly. For most businesses this is the single most decisive factor and it is the one that gets the least attention in stack debates. A theoretically superior stack you cannot staff is not superior.
3. The Workload Is Request-Response
A shopper requests a page, the server builds it, the connection closes. PHP's process model is a natural fit for this, and its historic weakness — no persistent state between requests — is largely irrelevant when the work is stateless anyway.
4. You Need Speed of Delivery
Laravel in particular is extremely fast to build in, and the deployment story is simple. For a business that needs working software this quarter rather than an elegant architecture next year, that is a real commercial advantage.
Where PHP Genuinely Loses
Three criticisms that are still fair, and pretending otherwise is how you lose a technical audience.
1. Long-Lived Connections and High Concurrency
Real-time features — websockets, live tracking, collaborative interfaces, chat — fit PHP's process model badly. Solutions exist and are genuinely good, but you are working against the grain rather than with it. Node.js was designed for exactly this shape of problem and it shows.
2. The Machine Learning and Data Ecosystem
If your product involves model training, data pipelines or scientific computing, Python's ecosystem is not merely ahead, it is where the entire field lives. Calling a model API from PHP is fine; building the model in PHP is not a decision anyone should defend.
3. Legacy Codebases Are Genuinely Awful
This is the criticism that fuels all the others, and it is true. PHP's long history of low barriers to entry produced an enormous quantity of untyped, untested, structurally chaotic code, much of which is still running. An engineer whose only PHP experience is maintaining one of those is not wrong about their experience — they are wrong about generalising it to the language.
A useful distinction in any stack argument: is the objection to PHP, or to this PHP codebase? The remedies are completely different, and the second is usually the real complaint.
How to Actually Decide
Ignore the reputation in both directions and answer six questions.
- What is your team's actual capability, today? Not what they could learn. A stack migration is a retraining programme with a software project attached.
- Who can you hire, at what cost, in your market? Get real figures rather than impressions.
- What shape is the workload? Request-response favours PHP. Persistent connections, streaming and high concurrency favour Node.js. Data and modelling favour Python.
- What ecosystem do you need? If you need Magento's extension market or WordPress's content tooling, the language question is already answered.
- How long will you own this? A three-year product and a fifteen-year platform deserve different answers.
- What is the actual cost of the alternative? Including migration, retraining, lost roadmap time and the risk of the project failing. This number is routinely omitted.
The Version Question Is More Urgent Than the Language Question
For most businesses asking should we still be on PHP, the honest reframing is are we on a supported version of PHP. Those are very different problems and only one of them is urgent.
Running an unsupported PHP version means no security patches, incompatibility with current library versions, and an upgrade path that lengthens every month you wait. It is also, unlike a language migration, a bounded piece of work with a predictable cost.
- Find out what you are running, in every environment, including the forgotten cron server.
- Check it against the official support timeline and note the date support ends.
- Cost the upgrade to the current stable version, not to the next one — the effort difference is usually small and the runway difference is years.
- Do it before you have a language debate. A modern PHP codebase on a current version is a genuinely different thing to argue about.
We wrote about the assessment side of this in inheriting a legacy PHP codebase, and about migrating one incrementally in the strangler-fig approach to Laravel.
The Position We Actually Hold
PHP is a good, boring, well-supported choice for commerce, and boring is a compliment in infrastructure. It is not the right choice for real-time systems or for anything where models are the product. And the strongest argument against it in any specific case is almost never about the language — it is about a codebase, a version, or a team.
We build on it through our PHP development practice and our Laravel work, we modernise the difficult inherited ones through our custom PHP practice, and when the honest answer is a different stack we say so — that comparison is in Node.js platform economics.
Frequently asked questions
Is PHP dying?
No — it runs a very large share of the web and of commerce specifically, and the language has improved substantially since the version most of its critics remember. What is dying is the untyped, framework-free style of PHP that gave it its reputation, and that is a good thing.
Is PHP fast enough for a large eCommerce site?
Yes. Since PHP 7 the language is rarely the bottleneck in a commerce stack — the database, the front end and third-party scripts almost always are. Performance problems in PHP stores are overwhelmingly architectural rather than linguistic.
Should we migrate from PHP to Node.js?
Only if the workload genuinely calls for it — persistent connections, high concurrency, or a team that is already JavaScript-native across the stack. Migrating for reputation costs a year of roadmap and delivers the same features. Cost the alternative honestly, including retraining and lost delivery time.
What PHP version should we be on?
The current stable release, or at minimum one still in active support. Check the official support timeline, note when your version's security support ends, and cost the upgrade — it is a bounded, predictable project, unlike a language migration.
Is PHP secure?
The language is not the risk. Outdated versions, unmaintained dependencies and the coding practices of an earlier era are. A current PHP version with a governed dependency estate and static analysis in CI is as defensible as anything else you would run.
Get an Honest Read on Your Stack
Tell us what you are running, what your team can maintain and what you are trying to build, and we will tell you whether the language is genuinely your problem. It usually is not. Talk to our team; we reply within a business day.
