How to Hire a PHP Developer in 2026: WordPress, Laravel, and What to Screen For

About 77% of all websites with a known server-side language run on PHP, according to W3Techs. WordPress alone powers roughly 43% of the entire web. Laravel is one of the most actively maintained frameworks in any language. PHP is not going anywhere, and the demand for capable PHP developers is real.

The challenge is not finding someone who knows PHP. It is finding someone who knows it well enough to build something that holds together. The hiring pool is enormous, and the gap between a modern PHP developer and someone who learned PHP in 2010 and has not updated their habits since is enormous. They look identical on a resume.

Why the legacy problem is worse for PHP than most languages

PHP’s history works against you as a hiring manager. The language was widely deployed before modern software engineering practices caught on, so there is a large population of developers who learned real-world PHP from codebases that used mysql_* functions, stored sessions in global variables, put business logic in templates, and concatenated SQL strings directly. Those patterns taught bad habits that are hard to shake.

The language has been substantially modernized across the PHP 7 and PHP 8 releases. PHP 8.0 brought named arguments, match expressions, union types, and constructor property promotion. PHP 8.1 added enums, readonly properties, and fibers. PHP 8.2 and 8.3 continued the push toward a typed, expressive language. PHP 8.4 arrived in November 2024. A developer who has tracked these changes writes PHP that looks nothing like what you will find in an old WordPress tutorial.

The point: you need a screen that tells the two apart.

Laravel and WordPress are different jobs

This distinction matters before you write the job description. Conflating them produces a posting that attracts neither group well.

A WordPress developer’s job is largely CMS work: building themes and plugins, working within the hooks system (add_action, add_filter), registering custom post types and meta boxes, and increasingly writing React components for Gutenberg blocks. They interact with WP_Query, WP_User, and a set of WordPress-specific APIs. The underlying PHP is real, but the mental model is shaped by WordPress conventions.

A Laravel developer builds applications on a full-stack framework. They work with Eloquent ORM, Artisan CLI, Blade templates, service providers, facades, middleware, and increasingly Livewire for reactive interfaces. The job requires understanding of how service containers work, how the ORM maps to database tables, and how to structure code for testability.

The PHP knowledge overlaps. The framework knowledge does not. Be specific in the posting.

What modern PHP looks like

Before you can evaluate a candidate, you need a picture of what competent PHP 8.x looks like.

Return types, parameter types, property types: all declared. In PHP 8.x, writing a function without a return type is a choice, not a necessity. Experienced developers make it deliberately when the type genuinely cannot be declared; otherwise they declare it.

PHP 8.1 brought backed enums. A developer who reaches for a class full of constants when an enum would work is using 2019 patterns.

Match expressions are exhaustive, do not fall through, and return a value. Many switch statements in modern code are cleaner as match. A developer who still writes every branching expression as a switch is working from old muscle memory.

Every serious PHP project uses Composer. A developer who still downloads libraries manually or copies code from Stack Overflow is not working in a modern codebase.

Any SQL that touches user input goes through PDO prepared statements or an ORM. This is not optional; it is the baseline. This is also the first thing the screen tests for.

On testing: either PHPUnit or Pest signals that the developer tests their code, which is the actual requirement. Pest is the Laravel community’s preferred choice and worth knowing if the role is Laravel-focused.

The screen that filters

A useful screen for a PHP position can be fairly short. Three things tell you most of what you need to know.

The first test: show them a function that uses mysql_query or concatenates $_GET variables directly into a SQL string and ask what is wrong. The candidate should explain the SQL injection risk, the deprecation of the mysql_ extension (removed entirely in PHP 7.0), and how to rewrite it with PDO prepared statements. Someone who has been writing PHP seriously for the past five years will find this obvious. Someone who learned PHP from legacy material and has not updated their mental model may not immediately see the problem. The reaction is the signal.

For the second test: pick a real architectural question. For Laravel: “You have a slow API endpoint. What do you check first?” The answer should go through query optimization (N+1 problems, missing indexes, eager loading in Eloquent), caching strategies, and maybe queue offloading for expensive operations. The sequence tells you how the developer thinks about production systems. For WordPress: “How do you add custom functionality without modifying a theme or plugin directly?” The answer should mention child themes and custom plugins, not editing core files.

Third: ask how they handle a security vulnerability in a Composer dependency. The answer should include running composer audit, updating the affected package, and running the test suite before deploying. A developer who does not run composer audit regularly is not managing their dependency surface.

Laravel-specific things to check

If the role is Laravel, the screen narrows. A few questions that sort real Laravel experience from tutorial knowledge:

How do they handle N+1 queries in Eloquent? The answer should mention eager loading with with() and the value of Laravel Debugbar or Telescope for catching the pattern in development.

Have they written a service provider? This separates developers who understand the framework from those who only work within it. Service providers are where the framework bootstraps itself, and writing a custom one requires understanding the container.

Do they know Livewire? Livewire v3 is the dominant choice for reactive interfaces in Laravel projects without a heavy JavaScript frontend. A developer who has never used it is not necessarily unqualified, but it signals where they sit in the Laravel ecosystem.

What is their testing setup? The answer should include either PHPUnit or Pest, factory definitions for test data, and some understanding of database transactions for test isolation.

WordPress-specific things to check

WordPress roles are different enough to warrant their own questions.

Ask them to explain the difference between a theme and a plugin. This sounds basic but developers who have only done surface work occasionally conflate the two. A theme controls presentation; a plugin adds functionality. Adding functionality in a theme makes upgrades fragile.

Ask about the REST API. Modern WordPress integrations often use the REST API to feed headless frontends or connect with other services. A developer who has only worked with rendered templates may not have experience here.

Ask about Gutenberg blocks. Block development in 2026 means React components and the @wordpress/scripts build tooling. A developer with no JavaScript skills may struggle here.

Rate context

PHP developer rates vary widely by specialization and region. A senior Laravel developer working in an agency or product context commands rates comparable to Node.js or Python backend developers at the same seniority level, because the work is genuinely equivalent in complexity. A WordPress developer doing custom theme and plugin work typically runs lower. Neither group is fungible with the other. You can find a comparison of total hiring cost models, including how to budget beyond the hourly rate, in what it costs to hire a developer in 2026.

The general vetting layer still applies

The PHP-specific screen sits on top of the general vetting process that applies to any developer hire: check their version control habits, understand what they think good code review looks like, and have them walk through a non-trivial piece of their own work. The framework for that is in how to hire a vetted software developer.

The PHP screen just adds the layer that filters out legacy patterns. Most other hiring failures in the PHP space come from confusing the WordPress and Laravel markets, writing a job description that attracts the wrong people, and not testing for the SQL injection reflex that tells you whether someone’s security habits are current.

PHP is not a dying language. It is a language with a large legacy population and a smaller modern population. Your job in the hire is to find the modern one.