How to Hire PHP Developers: Skills, Interviews, Rates and Timelines
The idea that PHP is dying doesn’t reflect how widely it’s still used. PHP powers more than half of websites with a known server-side language. That gives you a large talent pool, but it doesn’t necessarily make the right developer easy to find. Mobilunity can usually present the first relevant CV within five business days, so you can find qualified candidates quickly. From there, interviews and practical assessments help you determine which candidate is the strongest fit for your project.
Focus on modern PHP, framework decisions, database performance, security, testing, and production troubleshooting. Their recent projects should resemble the work you need done, particularly with legacy systems. A short practical task can then show how they approach real problems and whether their PHP practices are current.
What Kind of PHP Developer Does Your Project Need?
Before you craft a PHP developer job description, decide what the developer will actually work on. PHP projects range from new Laravel applications to platforms with years of legacy code. Each requires a different background.
For a greenfield Laravel or Symfony build, look for developers who have designed applications from the start. They should be comfortable making decisions about architecture, data access, APIs, testing, and deployment. Framework knowledge alone doesn’t show whether they can make those choices well.
A legacy upgrade or version migration requires a developer who knows how to work safely with older code. According to the official PHP Supported Versions documentation, each PHP release reaches end-of-life four years after its initial release. After that, it no longer receives security updates. Look for developers who can review legacy code, check dependencies, resolve deprecated features, and upgrade the application in stages. This approach reduces the risk of disrupting a system that’s already in production.
For team extension, prioritize experience with a stack similar to yours. The developer needs to understand your framework, PHP version, database, testing practices, and existing development process.
This distinction is useful whenever you hire developers by technology. A familiar language or framework can narrow your search, but it shouldn’t become the main selection criterion.
Don’t choose primarily on rate. PHP’s large global talent pool can make developers appear interchangeable, especially for routine coding tasks. Production systems still require judgment when architecture, security, performance, or legacy code creates problems.
Considering PHP compared with Python can help you choose a technology for a new project. Once the stack is established, however, the developer’s relevant project background becomes more important during hiring.
The same applies to Ruby compared with PHP. Both support mature web applications, but their ecosystems, frameworks, and common development practices differ.
For example, Ruby on Rails developers bring experience with Rails conventions that doesn’t automatically transfer to Laravel or Symfony. Start with your project’s requirements, then look for someone whose background fits the work.
Five PHP Skills to Check Before You Hire
A PHP resume can tell you how long someone has worked with the language, but years alone reveal little about current skills. PHP has changed considerably, and developers who started with PHP 5 may still rely on practices that no longer fit modern applications.
The PHP developer skills worth testing show how candidates use the language in real projects today. Each area below can be explored in about ten minutes with a targeted question and follow-up.
1. Modern PHP
Strong candidates should be comfortable with modern PHP features such as typed properties, enums, match, and readonly. More importantly, they should understand when these features make code safer or easier to maintain.
This distinction becomes useful when reviewing developers with extensive PHP backgrounds. Someone with ten years of PHP experience may have kept their skills current, while another developer may still approach new applications with older PHP patterns.
10-minute check: Show the candidate a small class written in an older PHP style. Ask what they would change for a modern PHP application and why. Listen for decisions about types, object design, error handling, and readability rather than a list of newer syntax.
2. Framework and ORM Decisions
Laravel and Symfony knowledge should show up in the problems a developer has solved, not just framework names on their CV. Strong candidates understand what happens underneath common framework abstractions.
Ask about database behavior rather than definitions. Someone who has worked extensively with Eloquent or Doctrine should recognize N+1 queries and know how to investigate them.
The same principle applies when assessing Zend developers who have worked with older enterprise PHP applications. Framework experience is most useful when candidates can explain the decisions and problems behind it.
10-minute check: Ask: “Tell me about an N+1 query you found in a PHP application.” Follow with how they detected it and verified the fix. Look for query inspection, profiling, or monitoring rather than an immediate framework-specific answer.
3. Application Security
PHP developers often work directly with web requests, databases, authentication, forms, and uploaded files. They should understand the security risks in each area.
Strong candidates should recognize SQL injection and cross-site scripting risks. They should also know how to validate file uploads and respond when Composer dependencies contain known vulnerabilities.
These principles aren’t unique to PHP. Perl developers working on web applications face many of the same input-validation and dependency risks, although the tools and ecosystems differ.
10-minute check: Ask how they would secure a feature that accepts an image upload and stores user-provided metadata. Then ask what they would do if a dependency scan found a serious CVE without an immediate upgrade path.
4. Testing and Deployability
A strong PHP developer doesn’t treat PHPUnit as something added after development. They should know which behavior needs unit testing and which parts require integration tests.
Deployment is equally important. A mature application shouldn’t depend on someone remembering an undocumented manual step every time a release goes live.
10-minute check: Ask: “What needs to happen between merging PHP code and running it in production?” Listen for automated tests, dependency installation, configuration, database migrations, and deployment checks. Ask which steps they would automate and why.
5. Performance Under Real Traffic
Performance work should start with evidence rather than guesses. Experienced PHP developers should know how database queries, Opcache, external services, and application code can affect response times.
They don’t need to memorize profiling tools. They should know how to measure where the application spends its time before deciding what to optimize.
10-minute check: Tell the candidate that a PHP endpoint becomes slow as traffic increases. Ask what they would investigate first. Then ask whether they have profiled a production application before and what the results changed.
These checks tell you more than a PHP trivia test. They show whether candidates can apply their knowledge to the security, performance, maintenance, and deployment problems they’ll face on your project.
Seven PHP Interview Questions and What to Listen For
The best PHP developer interview questions focus on work the candidate has actually done. You don’t need deep PHP knowledge to assess their answers. Listen for specific problems, decisions, and results rather than definitions or lists of tools.
1. What Changed for You Between PHP 5 and PHP 8?
This question shows whether an experienced developer has kept their approach current as PHP has evolved.
What to listen for: Changes in how they structure and type code, test applications, and use modern tooling. They may mention typed properties, enums, attributes, or improved type handling.
Memorized-answer signal: A list of PHP 8 features without explaining how any changed their work.
2. Describe an N+1 You Found in an Eloquent or Doctrine Application
This tests whether the candidate understands what their ORM does behind the scenes.
What to listen for: How they noticed excessive queries, confirmed the cause, and measured whether their fix worked.
Memorized-answer signal: They define N+1 and immediately suggest eager loading without describing an actual case.
3. How Do You Handle File Uploads Safely?
File uploads expose applications to several security risks, so the candidate should treat them as untrusted input.
What to listen for: File-type validation, size limits, safe filenames, storage location, permissions, and restrictions on executable content.
Memorized-answer signal: “Validate the file” without explaining what they validate or how.
4. A Dependency Has a CVE and No Patched Release. What Do You Do?
There isn’t one automatic fix. You’re testing how the candidate responds when the obvious solution isn’t available.
What to listen for: They determine whether the application is affected before choosing a response. They may consider mitigation, replacement, removal, or temporary isolation.
Memorized-answer signal: “Update the package” despite there being no patched release.
5. Tell Me About a Legacy PHP Codebase You Improved Without Rewriting It
Legacy PHP work often requires patience and gradual change rather than starting again.
What to listen for: How they identified safe boundaries, added tests, isolated old components, and replaced parts incrementally.
Memorized-answer signal: They describe a complete rewrite without explaining why incremental improvement wasn’t possible.
6. When Is WordPress the Right Choice, and When Is It a Poor Fit?
This tests whether the candidate chooses technology around project requirements rather than personal preferences.
What to listen for: WordPress can suit content-heavy sites with established publishing needs. They should also recognize when custom application logic or architecture makes another approach more appropriate.
Memorized-answer signal: “WordPress is bad” or “WordPress works for everything,” without discussing the project.
7. When Is PHP the Wrong Choice?
A strong PHP developer should recognize situations where another technology fits the project better.
What to listen for: A reason tied to workload, architecture, existing infrastructure, team expertise, or technical constraints.
Memorized-answer signal: “PHP can build anything,” without considering whether it is the right tool for the specific project.
These questions aren’t about getting seven textbook answers. They help you see how candidates solve problems, question familiar approaches, and explain the reasoning behind their decisions.
A Practical 90-Minute PHP Assessment
This assessment works for mid-level and senior Laravel developers. It tests how candidates diagnose common application problems without asking them to build a feature from scratch.
Provide a small, working Laravel project with the database and test environment already configured. This keeps the task focused and makes 90 minutes a realistic limit.
PHP screening task
We’ve provided a Laravel application with an existing endpoint. The endpoint works, but it has two problems:
- Loading records generates far more database queries than expected
- The endpoint accepts file uploads without sufficient validation
Your task:
- Identify and fix both problems
- Add one test that verifies an invalid upload is rejected
- Explain each problem and your fix in no more than two sentences
- Keep the existing API response unchanged
Please spend no more than 90 minutes on the task. Don’t add features or refactor unrelated code.
You can check whether the candidate followed the instructions. A PHP specialist should review the implementation and technical decisions.
| What to Check | What to Look For |
| Database queries | The N+1 is gone, and the candidate can show how they verified it |
| Upload validation | The application checks file type and size server-side, not only in the browser |
| Rejection test | The test confirms that an invalid upload is rejected |
| Explanation | Both fixes are clear enough for a nontechnical reader to understand |
Keep the assessment limited to a small sample project created specifically for hiring. Explain how you will evaluate the submission and avoid using candidate work in your production code.
What It Costs: Rates by Region and the Real In-house Comparison
A PHP developer salary depends on seniority, location, technical background, and the hiring model you choose. Salary alone doesn’t show what you’ll actually spend on the hire. Employer costs and provider fees can change the final number considerably.
The table below shows Mobilunity’s gross salary ranges and monthly hiring costs for PHP developers in Ukraine.
PHP Developer Gross Salary and Hiring Costs in Ukraine*
| Seniority | Net Monthly Salary | Monthly Hiring Cost |
| Junior | $1,000 – $2,000 | $2,450 – $3,500 |
| Middle | $2,000 – $4,000 | $3,450 – $5,500 |
| Senior | $4,000 – $5,500 | $5,450 – $7,000 |
*All rates are as of September 2026
The difference between the lowest and highest rates grows with seniority. Framework knowledge, legacy modernization, security expertise, and production troubleshooting can all influence where a developer falls within the range.
If you’re comparing PHP developer salaries and CVs, don’t treat the lowest rate as the strongest hiring opportunity. Check whether the candidate’s background matches your PHP version, framework, application type, and security requirements.
What Does a US In-House PHP Developer Really Cost?
Gross salary is only the starting point for an in-house cost calculation. Employer taxes, mandatory contributions, benefits, and recruitment increase what you spend on each developer.
These costs also differ significantly by country. The table below separates the main employment costs so you can compare markets on more than gross salary.
Estimated Annual In-House PHP Developer Cost*
| Average Annual Gross Salary | Employer Taxes / Contributions | Estimated Benefits | Estimated Annual In-House Cost | |
| US | $97,000 | $7,500 | $17,000 | $121,500 |
| Canada | $36,600 | $3,100 | $3,500 | $42,600 |
| Germany | $59,000 | $13,000 | $2,400 | $74,400 |
| UK | $50,500 | $6,600 | $1,300 | $58,400 |
| Switzerland | $94,500 | $6,100 | $7,000 | $107,600 |
| Denmark | $81,300 | $1,400 | $11,900 | $94,600 |
| France | $49,900 | $15,000 | $500 | $65,400 |
| Spain | $33,000 | $10,200 | $700 | $43,900 |
Sources: salary.com | ca.indeed.com | kununu.com | uk.indeed.com | jobs.ch | talentup.io | fr.indeed.com | es.indeed.com | irs.gov | bls.gov | canada.ca | statcan.gc.ca | gtai.de | destatis.de | gov.uk | bsv.admin.ch | businessindenmark.virk.dk | dst.dk | urssaf.fr | service-public.fr | seg-social.es | oecd.org
*All rates are as of September 2026
Recruitment creates another cost that the table doesn’t capture. Job advertising, recruiter time, interviews, and technical assessments all require resources before the developer starts.
You also pay the full employment cost during onboarding. A new developer may need time to understand your architecture, business rules, and deployment process before reaching normal productivity. For that reason, compare hiring models on total employment cost rather than salary alone.
Three Ways to Add PHP Expertise to Your Team
The right hiring model depends on the project length, security requirements, and how much product knowledge the developer needs to retain. IT staff augmentation gives you another option when you need external developers without adding permanent employees.
In-House PHP Developers
PHP gives you access to a large global talent pool, but candidates can have very different technical backgrounds. The challenge is finding developers whose skills reflect current PHP practices. Framework experience also doesn’t always mean someone can make sound engineering decisions.
An in-house hire makes sense when the role is long-term and you want project knowledge to stay within your team. In return, your company takes responsibility for recruitment, payroll, benefits, equipment, and retention.
Freelance PHP Developers
Freelancers can be a good fit for short projects with a clear scope and end date. This model can work particularly well for a framework upgrade or a standalone feature.
Security-sensitive work requires more careful screening. If the project involves authentication, payments, or file uploads, make sure the developer can explain how they manage these risks.
Dedicated PHP Developers
A dedicated development team model suits ongoing development where engineers need time to understand your application and business logic. When you hire dedicated PHP developers, they work with your team while the provider handles employment and administrative responsibilities.
The value isn’t simply access to more candidates. A provider can screen the market before candidates reach your interview process, which reduces the quality variance you need to handle yourself.
| Factor | In-House | Freelancer | Dedicated Team |
| Cost | Salary plus employment-related expenses | Hourly or fixed project pricing | Agreed monthly service fee |
| Ramp time | Longer recruitment and onboarding cycle | Quick for clearly scoped assignments | Varies with role and screening requirements |
| Retention | Built around permanent employment | Availability may change between projects | Supports consistent, long-term involvement |
| IP | Covered by employment terms | Defined in the contractor agreement | Governed by the service agreement |
| Management | Full HR and employment responsibility | Direct contractor coordination | Provider manages employment; you manage delivery |
A freelancer can fit a six-week project with a clearly defined scope and limited need for long-term involvement. For ongoing development, dedicated developers offer more continuity as they build knowledge of your application, business logic, and internal processes. This can reduce the time spent bringing new developers up to speed as the project evolves.
Red Flags to Watch for When Hiring a PHP Developer
A polished CV doesn’t always show how a PHP developer approaches real application problems. These six signals can help you decide where to ask more questions during the first interview.
1. Their Code Uses Outdated Database Practices
What you see: Code samples use mysql_* functions or build SQL queries through string concatenation.
What it usually means: Their database practices may not reflect current PHP security and development standards.
2. Their PHP Experience Stops at Older Versions
What you see: The CV doesn’t mention PHP versions, or their recent portfolio still centers on PHP 5.6.
What it usually means: They may have limited experience with modern PHP features and current development practices.
3. Their Background Is Limited to WordPress
What you see: A candidate applying for an application-development role has worked almost entirely with WordPress.
What it usually means: Their background may not cover the architecture, testing, and application design your role requires.
4. Testing Is Missing From Their Work
What you see: Their CV and projects contain no tests, and they can’t explain why.
What it usually means: Testing may not have been part of their regular development process.
5. They Can’t Describe a Security Issue They’ve Fixed
What you see: They discuss security principles but can’t recall a vulnerability or security problem they’ve handled themselves.
What it usually means: Their security knowledge may be more theoretical than production-based.
This is worth checking carefully with PHP staff augmentation candidates as well. External developers may start contributing quickly, so their security and testing practices should fit your existing standards.
6. Every Legacy System Needs a Rewrite
What you see: The candidate repeatedly recommends replacing legacy applications instead of improving them incrementally.
What it usually means: They may underestimate migration risks, hidden business rules, and the cost of replacing working software.
None of these signs should eliminate a candidate automatically. Use them to identify where you need more detail before making a hiring decision.
From PHP Hiring Request to Developer Start
PHP is one of the fastest technology stacks for us to staff. We typically match clients with suitable candidates within 3-5 business days. In most cases, we present the first relevant CV within five business days, and often sooner. Mobilunity’s candidates are high quality, with 97% successfully completing their trial period. Also, the retention rate for the developers we placed over the last 12 months is 94%.
Finding candidates usually isn’t the slowest part. Screening takes more time because PHP backgrounds vary widely across frameworks, application types, and language versions.
Week 1: Define the Role and Review Candidates
We discuss your codebase, PHP version, framework, project requirements, and seniority needs. Our recruiters then source and vet candidates and send the first suitable CVs for your review.
For offshore PHP development, we also clarify working hours, communication expectations, and how developers will work with your existing team.
Weeks 2-4: Interview and Select
You interview shortlisted developers and assess their technical skills and project fit. We coordinate the process and support technical screening when needed.
Legacy applications may require candidates with specific migration experience. Security-sensitive projects can also take longer when the interview process includes additional security review.
Weeks 5-6: Contract and Start
Once you select a developer, we handle the offer, contracting, and preparation for their start. The full process usually takes 3-6 weeks.
PHP’s large talent pool can make sourcing relatively fast. The bigger challenge is finding someone whose current skills match your codebase and the work they’ll actually do.
