A custom PHP framework is the foundation code that handles routing, requests, database access, templates and security for a PHP application, written for that application instead of taken from Laravel or Symfony. Businesses come to us with one of two needs: they want a lean framework built for a specific job, or they already run on a hand-built PHP framework from years ago and need it audited, upgraded or replaced safely. We handle both, and we will tell you plainly when a standard framework is the better choice.
This work sits within our web development services, and it is personal to us. The CMS that runs this website and Boiler Decoder is a custom PHP and SQLite system our team wrote and maintains, so we know what it takes to own a framework for years, not only to launch one.
Should You Build a Custom PHP Framework or Use Laravel or Symfony?
Most projects should use Laravel or Symfony. They come with years of security fixes, documentation, packages and developers who already know them. A custom PHP framework earns its place only when the application has needs a general framework makes harder, and when someone will own the code long term.
| Situation | Our usual recommendation |
|---|---|
| A typical business app with logins, forms, admin screens and integrations | Laravel or Symfony. A custom framework adds cost without adding value. |
| A read-heavy content or publishing system with a narrow, well-understood request flow | A lean custom framework can be simpler, faster and cheaper to host. |
| A product that must run with very few dependencies, for example on restricted servers or inside another system | A small custom core built from selected Symfony components. |
| A long-lived product where yearly framework upgrades cause real churn | A custom core can work, if it follows PHP standards and has tests. |
| An existing hand-built PHP framework that works but is aging | Audit first, then upgrade in place or move to Laravel route by route. |
| A team with no PHP developer to maintain the code later | A standard framework, because finding help later is far easier. |
Our Custom PHP Framework Development Services
- PHP codebase audit. A review of your Laravel, Symfony, CodeIgniter or hand-built PHP application covering structure, security against the OWASP Top 10, PHP 8 compatibility, dependencies, test coverage and hosting. You get a ranked list of risks and a recommended path.
- Custom PHP MVC framework builds. A small, documented core with a router, middleware, a dependency injection container, controllers, a data layer and templates, built to PHP standards so any experienced PHP developer can work on it.
- Framework cores from Symfony components. Rather than writing everything from scratch, we often compose a framework from proven pieces such as Symfony HttpFoundation, Routing and Console, plus Twig for templates.
- Custom PHP and MySQL data layers. Repository classes over PDO with prepared statements, migrations, and query logging, for MySQL, MariaDB, PostgreSQL or SQLite.
- API layers. JSON APIs on a custom MVC framework, with token authentication, rate limiting, versioning and OpenAPI documentation.
- Add-on and plugin systems. Hook and event systems that let you add features as separate modules without editing the core.
- Legacy upgrades to PHP 8.3 and later. Old PHP 5 and PHP 7 applications brought onto a supported PHP version, with automated refactoring and tests.
- Ports to Laravel. CodeIgniter, CakePHP or hand-rolled code moved to Laravel gradually, with old and new code running side by side until the move is complete.
How a Lean Custom PHP MVC Framework Is Put Together
A well-built custom framework is small and boring in the best sense. It follows the PHP-FIG standards (PSRs), so its parts are familiar to any PHP developer and can be swapped for well-known libraries later. This is the structure we use.
| Layer | Standard or library | Why it matters |
|---|---|---|
| Autoloading and packages | Composer with PSR-4 autoloading | Classes load predictably, and outside packages install and update with one command. |
| Front controller | A single public entry file behind Nginx or Apache | Every request passes through the same security and error handling. |
| Requests and responses | PSR-7 messages or Symfony HttpFoundation | Clean, testable objects instead of reading globals throughout the code. |
| Middleware | PSR-15 middleware | Authentication, CSRF checks, caching and logging are added in one place. |
| Routing | FastRoute or Symfony Routing | Readable URLs mapped to controllers, with route caching for speed. |
| Dependency injection | A PSR-11 container | Services are wired once and replaced easily in tests. |
| Data access | PDO with prepared statements, or Doctrine DBAL | Protection against SQL injection by default, and support for several databases. |
| Templates | Twig or plain PHP templates with automatic escaping | Output is escaped unless a developer deliberately says otherwise. |
| Logging and events | PSR-3 logging with Monolog, PSR-14 event dispatching | Errors are recorded properly, and add-ons can hook into the core without editing it. |
| Command line | Symfony Console | Migrations, cache clearing and scheduled jobs run as proper commands. |
Building a custom MVC framework in PHP for an API
An API-only framework is simpler than a full web framework, because it has no templates or sessions. The core is a router, JSON request parsing, token authentication, input validation, consistent error responses and rate limiting. We document every endpoint in OpenAPI so your front end, mobile app or partners can build against it without guessing.
Adding HMVC to a custom-built PHP framework
HMVC (hierarchical model view controller) splits an application into modules, each with its own controllers, models, views and routes. To add it to a custom framework, you give each module a folder with a small service provider that registers its routes and services with the core, then let the router load modules from configuration. Modules should talk to each other through service interfaces rather than internal sub-requests, which add overhead and make debugging harder. In practice, a clear module structure gives you most of the benefits of HMVC without the complexity.
Add-on and plugin systems
A custom add-on framework for PHP needs three things: a manifest for each add-on that declares its version and requirements, an event or hook system so add-ons can respond to core events, and a stable internal API that you promise not to break without notice. Without that promise, every core update breaks your add-ons.
What Running Our Own Custom PHP Framework Taught Us
Our team wrote and runs a custom PHP and SQLite CMS. It powers Boiler Decoder, a UK boiler fault-code reference site, and the website you are reading now. It handles drip-feed publishing, IndexNow pings, JSON-LD schema, llms.txt, cookie-free analytics and Search Console keyword reporting. Owning it has shaped how we build frameworks for clients.
- Keep the core small. Every feature in the core is code you maintain forever. Features that only some sites need belong in modules.
- Choose the database for the workload. SQLite suits read-heavy content systems and removes a database server from the bill. Apps with many people writing at once need MySQL or PostgreSQL.
- Test the dangerous parts first. Routing, output escaping, authentication and anything that writes data get automated tests before anything else.
- Write it down. A custom framework without documentation becomes a liability the day its author is unavailable.
If you are weighing a custom content system against WordPress, our article on custom CMS vs WordPress covers the trade-offs in more detail.
How We Deliver Custom PHP Framework Projects
- Audit or discovery (1 to 2 weeks). For existing code, we review the codebase, run static analysis and check PHP compatibility. For new builds, we map the request flow, data and integrations. Either way you get a written report and a recommendation.
- Architecture decision (a few days). We document the choice of standard framework, custom core or hybrid, with the reasons and the long-term maintenance cost. You approve it before any build work starts.
- Core build (4 to 8 weeks). Routing, middleware, container, data layer, templates, error handling and logging, with tests and a developer guide.
- Features in two-week cycles. Application features are built on top of the core, each cycle ending with a working release on staging that you can test.
- Security review and launch. We check the OWASP Top 10 risks, run dependency audits, rehearse the deployment and set up error monitoring and backups.
- Handover or ongoing care. You receive the repository, documentation and a recorded walkthrough. Updates and new features can continue on a monthly plan.
Rescuing Legacy and Hand-Built PHP Frameworks
Many businesses run on a PHP application written ten or more years ago by a developer who has long moved on. It still works, but it runs on an old PHP version, uses removed functions and has no tests. PHP 7.4 stopped receiving security fixes in November 2022, and applications still on PHP 5 have been unsupported far longer. These are the issues we see most when moving old code to PHP 8:
- The old mysql_* functions, removed in PHP 7.0, still used for database access.
- Functions such as each() and create_function(), removed in PHP 8.0.
- Dynamic properties on classes, deprecated in PHP 8.2.
- Passing null to internal functions that expect a string, deprecated in PHP 8.1 and common in older code.
- Hand-built SQL with string concatenation, which is both an upgrade problem and a security risk.
We use Rector to automate much of the code change, PHPStan to find type problems, and the PHPCompatibility rules for PHP_CodeSniffer to flag version issues. Then we add tests around the most important workflows before upgrading the server.
| Approach | When it fits | Trade-off |
|---|---|---|
| Upgrade in place | The structure is sound and the main problem is the PHP version. | Fastest and cheapest, but keeps the original design. |
| Gradual port to Laravel | The code is hard to change and the app keeps growing. | Old and new code run side by side for a while, which needs careful routing. |
| Full rebuild | The app is small, or its logic is so tangled that porting costs more than rewriting. | Highest risk of missing a hidden business rule, so we document rules first. |
Custom PHP Framework Security Checklist
Some articles claim a custom framework is safer because attackers do not know its code. Obscurity is not security. A custom framework is safe only when it handles the basics as well as Laravel or Symfony do. We check every custom PHP framework against this list:
- Every database query uses prepared statements or a query builder that does.
- Template output is escaped by default to prevent cross-site scripting.
- Forms that change data check a CSRF token.
- Passwords are stored with password_hash() using bcrypt or Argon2, never with MD5 or SHA-1.
- Session cookies are set with Secure, HttpOnly and SameSite flags, and the session ID is regenerated at login.
- File uploads are checked by type and size and stored outside the public web folder.
- Error details are logged, not shown to visitors in production.
- Dependencies are checked with composer audit, and secrets live outside the repository.
Tools and Standards for Custom PHP Framework Work
| Category | Tools |
|---|---|
| Language and packages | PHP 8.3 and later, Composer, PSR standards |
| Components | Symfony HttpFoundation, Routing and Console, FastRoute, Twig, Monolog, Doctrine DBAL |
| Databases | MySQL, MariaDB, PostgreSQL, SQLite, Redis |
| Quality and upgrades | PHPStan, Rector, PHP_CodeSniffer with PHPCompatibility, PHPUnit, Pest |
| Servers and delivery | Nginx, Apache, PHP-FPM, Docker, GitHub Actions, Laravel Forge |
| Monitoring | Sentry, uptime checks, server logs |
Custom PHP Framework Pricing
We price this work in three ways. An audit of an existing PHP codebase is a fixed-price project. A new application on Laravel, Symfony or a custom core is quoted after a short planning phase, with the price driven by the number of features, user roles, integrations and how much data must be migrated. Legacy upgrades and rebuilds are quoted after the audit, because the cost depends on how much of the old code can be kept.
PHP Code Audit
$950 one-time
One-time, paid upfront
- Review of your Laravel, Symfony, CodeIgniter or custom PHP codebase
- Security check against the OWASP Top 10
- PHP 8.x and dependency compatibility report
- Database and performance profiling
- Prioritized fix list and a fixed quote for the work
- Delivered in 7 business days
Custom PHP Application
From $7,500 project
One-time, milestone billing
- Built on Laravel or Symfony (or your existing framework)
- Core features scoped in a short planning phase
- Logins, roles and admin panel
- REST API and third-party integrations
- Automated tests and CI/CD deployment
- 60 days support
- 6 to 10 weeks
- Add-on
- Ongoing development: $45/hour. Discovery Sprint for larger builds: $1,500 (credited to the build)
Legacy Upgrade or Rebuild
From $5,000 project
One-time, milestone billing
- Old PHP 5 or 7 apps moved to PHP 8.3+
- CodeIgniter, CakePHP or hand-rolled code ported to Laravel
- Database cleanup and data migration
- Security fixes and modern authentication
- Side-by-side testing before switchover
- 60 days support
All prices in USD. Need something different? Ask for a custom quote.
If your codebase or idea does not fit these plans, send us a short description and we will suggest a scope and a custom quote.
Laravel, Symfony, CodeIgniter or a Custom PHP Framework?
| Option | Strengths | Best for |
|---|---|---|
| Laravel | Fast development, large package ecosystem, built-in queues, auth scaffolding and testing tools | Most business apps, SaaS products and APIs |
| Symfony | Reusable components, long-term support releases, strong for large and long-lived systems | Complex enterprise apps and teams that value strict structure |
| CodeIgniter 4 | Small, quick to learn, light on server resources | Smaller apps and teams already using CodeIgniter |
| Slim | A micro framework with routing and middleware only | Small APIs and services |
| Custom PHP framework | Only the code you need, full control over the request flow | Narrow, long-lived systems with an owner who will maintain the core |
Between Laravel and CodeIgniter, we recommend Laravel for most new projects because of its ecosystem, testing tools and the number of developers who know it. CodeIgniter remains a reasonable choice for small apps and for teams with existing CodeIgniter code.
Is PHP Still a Good Choice for a Custom Framework?
Yes. PHP ships a new major or minor release every year, and modern PHP 8 brings typed properties, enums, readonly properties, attributes, match expressions and a JIT compiler. WordPress, Drupal, Magento and Laravel all run on PHP, which means hosting is everywhere and experienced developers are easy to find. The language is not the risk in an old PHP application. The risk is an unsupported version and code nobody has tested.
Why Choose 95 Solutions for Custom PHP Framework Work
- We own a custom PHP framework ourselves. Our CMS runs our own sites in production, so our advice comes from maintaining one, not from reading about it.
- Senior-led. Mustafa, our founder, holds a BS in Computer Science and leads every engagement, including the architecture decision.
- Honest recommendations. If Laravel or Symfony will serve you better, we say so, even though a custom build would be a larger project for us.
- You own the code. Repositories, servers and documentation stay in your accounts, with contracts and invoices in USD from our US LLC.
Who Our Custom PHP Framework Services Are For
A good fit
- Businesses running a hand-built PHP application that needs to move to a supported PHP version.
- Product teams with a narrow, long-lived system where a lean core will be cheaper to run.
- Companies that need an independent audit before deciding whether to upgrade or rebuild.
- Teams moving CodeIgniter or CakePHP code to Laravel.
Probably not a fit
- Standard websites that a CMS such as WordPress handles well.
- Teams who want a custom framework only because it sounds more exclusive. That choice costs more for years.
- Projects with no plan or budget for someone to maintain the code after launch.
Related PHP and Custom Development Services
For new PHP builds on standard frameworks, see our PHP development company page. If the system you need is mainly about publishing content, our custom CMS development team builds on the same foundations as our own CMS. Larger browser-based tools are covered by custom web application development, and ongoing care for any of these is handled through our software maintenance services.