Legacy System Assessment
Find out what you actually have, before you decide what to do about it.
A structured, fixed-price investigation of your legacy PHP application and the environment it runs in. You receive a prioritised, plain-English assessment and a practical plan, not a pile of tool output.
From £2,500. Larger or more complex systems are typically £4,000-£7,500+, and I'll quote a fixed price after a free initial conversation.
Who this is for
An assessment makes sense if:
- The developer or agency who built it has gone, and nobody fully understands it.
- You've been told it needs a rewrite, and you want an independent view before spending £50,000+.
- Your host is dropping your PHP version, or your framework is out of support.
- You've failed, or expect to fail, a security questionnaire, Cyber Essentials check or cyber insurance renewal.
- You're buying, selling or inheriting a business that depends on the application (technical due diligence).
- Every change is slow, expensive or frightening, and you want to know why.
You don't need organised source code, documentation or tests. Starting from nothing is normal.
What I look at
Depending on scope, the assessment covers:
| Area | What I establish |
|---|---|
| Application architecture | How it's structured, where the important logic lives, how the parts connect |
| PHP and framework versions | What you're running, support status, and what an upgrade would involve |
| Third-party dependencies | Outdated or abandoned packages, known vulnerabilities, licence concerns |
| Database | Structure, relationships, engine version, indexing, obvious integrity problems |
| Server and hosting | Operating system, web server, configuration, SSL/TLS, DNS, resource limits |
| Deployment process | How changes reach production, and whether that can be done safely |
| External integrations | Payment, email, APIs and scheduled jobs, and which of them are fragile |
| Security risks | Authentication, authorisation, input handling, credentials, file uploads, sessions, logging |
| Backups and recovery | Whether backups exist, whether they work, and how long recovery would take |
| Documentation | What exists, what's missing, what's wrong |
| Technical debt | The debt that is costing you money or creating risk, separated from the debt that's just old |
| Performance | Likely bottlenecks in code, queries, caching and infrastructure |
| Upgrade constraints | What blocks you from moving forward, and in what order to remove it |
What you receive
- A prioritised risk register. Each issue is rated by seriousness and urgency, so you can see what must be fixed now and what can safely wait.
- A plain-English summary for owners and non-technical decision-makers.
- A technical report for whoever maintains the system next, including architecture notes and a map of the critical workflows.
- A recommended path: repair, document, secure, upgrade, refactor, replace, or leave alone, with reasoning for each.
- Costed options for the next stage, so you can compare approaches before committing.
- A walkthrough call where I explain the findings and answer questions.
You own all of it. There's no obligation to hire me for the follow-on work.
How it works
1. Free conversation
A short call to understand what the system is, why it's become a problem, and whether I'm likely to be able to help. No charge, no obligation.
2. Scope and fixed price
I confirm what's in scope and give you a fixed price in writing, plus a deposit invoice. Work starts once the deposit is paid and access is in place.
3. Secure access
You provide read-only access wherever possible: source code, a database copy, and server access if needed. I follow least-privilege practice, and I'll agree how credentials are shared and removed. How I handle access and client data
4. Investigation
I map the application and its environment, using AI-assisted analysis to cover ground that would once have taken days of manual searching. Findings are checked against the real running system, not taken on trust.
5. Report and walkthrough
You receive the written assessment and a call to go through it.
How AI fits in
AI-assisted analysis is why an assessment like this is now practical and affordable: searching, tracing and documenting a large codebase is dramatically faster than it used to be.
It provides speed. The judgement is mine. Every finding in your report has been reviewed by a person with 25 years of PHP experience. Before work starts, I'll explain how your code and data are handled with AI tools, and I'll agree that in writing. How I use AI
Data protection
Legacy applications often contain customer, employee, financial and commercially sensitive data. The assessment treats that data carefully:
- Production data isn't needed in most cases. A sanitised or limited copy is preferred.
- Confidentiality and a data processing agreement can be put in place before I see anything.
- Credentials and copies are removed when the work ends.
I provide technical assessment and remediation planning, not legal advice or outsourced Data Protection Officer services. Data protection and security
Pricing
| Scope | Price |
|---|---|
| Standard assessment | From £2,500 |
| Larger or more complex systems | Typically £4,000-£7,500+ |
| Agency / white-label | Quoted separately; see agency terms |
What moves the price: size of the codebase, number of integrations, whether multiple servers are involved, how much is undocumented, and how deep a security review you need.
If you go ahead with follow-on work, the assessment gives you a clear scope and price for it. See the full pricing page.
Frequently asked questions
How long does an assessment take?
It depends on the size and complexity of the system. I'll confirm a timeline when I give you the fixed price, once I've seen what's involved.
Will you change anything in my application?
No. An assessment is investigation only. I work on copies and read-only access, so there's no risk to your live system.
Is this a penetration test?
No. It's a code, configuration and architecture review that identifies security risks. If you need a formal penetration test for compliance reasons, I can say so in the report and help you scope one.
What if the report says I need a rewrite?
Then I'll say so, and explain why. I don't assume a rewrite is necessary, and I don't assume it isn't. Most systems turn out to be better candidates for staged stabilisation and upgrade, but the assessment gives you evidence either way. Read more in rewrite vs refactor vs upgrade.
Do I have to hire you afterwards?
No. The report is yours. You can use it with your own team, another supplier, or me.
Can you work on a system built with a framework I haven't mentioned?
Almost certainly. I work with custom and framework-based PHP applications of all ages. If it's something unusual, tell me on the first call.
Can my agency commission this for a client?
Yes. See agency partnerships.
Tell me what you've inherited.
You don't need to know exactly what's wrong. If an old PHP application has become important, expensive, risky or difficult to understand, that's enough to start.