The pitch hasn't changed much in fifteen years: a good PHP framework saves you from writing the dull parts of every web app and gives the next developer something they already recognise. The pitch is still true. The list of credible frameworks, on the other hand, has compressed dramatically.
The 2026 short list
If you take on PHP contract work this year, you will almost certainly be working on one of three stacks. Anything else is a curiosity, a legacy maintenance gig, or a red flag.
Laravel
Still the dominant choice for new PHP apps. The ecosystem (Forge, Vapor, Nova, Livewire) has converged on a coherent story for the full lifecycle of an app — build, deploy, scale, observe. Most agencies default to it for a reason: hiring is easy, the docs are first-rate, and the framework keeps shipping pragmatic features.
Symfony
Where Laravel optimises for developer happiness, Symfony optimises for boring, durable, enterprise correctness. The component model means you can pull in just the routing or just the messenger queue. We reach for it on long-lived projects where five years of stability matters more than five days of velocity.
Slim / vanilla PSR-15
For genuinely small services — internal tools, glue APIs, single-purpose endpoints — a micro framework or just a PSR-15 middleware stack is the right size. Don't reach for Laravel to expose three routes.
Why a framework still earns its keep
- Hand-off. When you finish a contract, the client's next developer reads your code without a tour. A framework is half the documentation, free.
- Security defaults. CSRF, XSS, mass-assignment guards, SQL parameterisation — frameworks make the easy way the safe way. Most security incidents we've seen on raw-PHP projects came from skipping one of these defaults.
- Migrations and schema evolution. A schema you can replay on a fresh database is the difference between a project that survives and one that calcifies.
- Background work. Modern PHP apps need queues, scheduled jobs, and idempotent retries. Building this from scratch is a year of subtle bugs.
What we ignore now
Some advice that mattered in 2018 has aged badly:
- "PHP frameworks are slow." Modern PHP-FPM with opcache is fast enough for almost any web workload. If your app is slow, the framework is rarely the culprit.
- "Pick the framework with the most stars." Github stars don't deploy your app at 2am. Maturity of release process, security advisories, and LTS commitments matter more.
- "Avoid magic." Reasonable advice in 2014. Today, Laravel-style facades and Symfony-style autowiring are well-understood and well-debugged. The remaining downside is googleable.
How we choose, in practice
For a typical client conversation in 2026:
- Will the client own the codebase long-term? → Symfony.
- Will the client want to hire affordably and ship features fast? → Laravel.
- Is this an API that does one specific thing and has clear boundaries? → Slim or PSR-15.
- Is the client already on a different stack? → Use what they have unless there is a clear reason not to.
The contract reality
The hardest part of contract PHP work in 2026 is not picking a framework. It is convincing a client whose project is on a pre-7.4 PHP version and an abandoned framework that the cost of staying is now higher than the cost of moving. We see this conversation every quarter. The numbers usually win, eventually.
If you are inheriting a project: spend a day inventorying the framework version, the PHP version, the dependency lockfile and the test coverage before you commit to a delivery date. That single day saves the next twelve.