Checklist for preparing a PHP application audit

Use this list to collect evidence and ask better questions. It does not produce an automatic score: it separates facts, assumptions and areas requiring specialist review.

How to use it

Mark only items supported by a path, document, query, screenshot or accountable owner. “We do not know” is a useful finding.

ContentsContext and ownership Code and dependencies Data and integrations Security Testing and delivery Operations

Context and ownership

Who decides, operates and understands the system.

Goals, users and critical flows are documented.Repositories, domains, infrastructure and suppliers have owners.Business, product, code, data and operations owners are known.Release windows and downtime tolerance are understood.

Code and dependencies

What can be changed safely.

PHP, framework, extension and Composer versions are inventoried.The project installs from a clean copy using verified instructions.Domain, infrastructure and interface boundaries are understandable.Abandoned dependencies and duplication are identified.

Data and integrations

Origin, quality and consistency.

Tables, volume, retention and sensitive data are identified.Schema migrations are versioned, reviewed and reversible.APIs, webhooks, imports and scheduled jobs are inventoried.Retries prevent duplicate operations.

Security

Controls related to actual risk.

Authentication, authorization and sessions follow a known policy.Input, queries, HTML and files are validated by context.Secrets and credentials are not embedded in the repository.Vulnerable dependencies have an assessment and response process.

Testing and delivery

Change without relying on memory.

Critical flows have automation or a verified test script.A representative environment validates changes.Release has steps, owners, checks and rollback.Definition of done includes review, tests and documentation.

Operations

Detect and recover.

Logs can follow a relevant request or operation.Metrics and alerts link impact to action.Backups run and restoration has been tested.Runbooks exist for incidents and recurring tasks.

Recommended use

Turn answers into decisions

Collect evidence links alongside each answer.
Separate immediate risk from structural improvement.
Assign an owner and next check to every unknown.
Turn findings into a phased plan, not a flat list.

Next step

Content connected to this decision

Continue with diagnosis, execution or related experience.

PHP audit

Technical audit of code, architecture, security, performance, data and operations with prioritized risks and an actionable plan.

View content Modernization guide

How to assess, protect and modernize a legacy PHP application in phases without stopping business evolution.

View content PHP upgrade plan

Phased template to inventory, test, upgrade, release and roll back a PHP version migration.

View content