PHPStan

Visit Website

Introduction

PHPStan discovers bugs in PHP code without running it. It reads code and PHPDoc types and reports errors such as calling undefined methods, passing wrong argument types, accessing possibly-null values and dead code.

Strictness is controlled by rule levels, from 0 (basic checks) up to 10 (the strictest). A baseline file records existing errors so new code is held to a higher standard while legacy errors are fixed over time. Extensions add framework knowledge for Symfony, Laravel (via Larastan), Doctrine and PHPUnit.

In the quality loop PHPStan is a core static gate for PHP projects.

The source code is at phpstan/phpstan on GitHub under the MIT licence, with about 14,200 stars; the most recent commit was on 11 November 2026.

Features

1. Rule levels: Levels 0 to 10.
2. Baseline: Ignore existing errors while blocking new ones.
3. Generics: Advanced PHPDoc types and generics.
4. Framework extensions: Symfony, Laravel, Doctrine and more.
5. Custom rules: Write project rules.
6. Result cache: Fast repeated runs.

Pros

1. Gradual adoption: Levels and baselines make it easy to start.
2. Free to use: Open source under the MIT licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 11 November 2026.
4. Community: About 14,200 GitHub stars.

Cons

1. PHPDoc reliance: Weakly typed code needs annotations.
2. Magic code: Framework magic needs extensions.
3. Memory use: Large projects need memory tuning.

Usage and Links (Example)

composer require --dev phpstan/phpstan
vendor/bin/phpstan analyse src --level 6
vendor/bin/phpstan analyse --generate-baseline

Resources:

• PHPStan website
• GitHub repository

Pricing

PHPStan is free and open source under the MIT licence.

Recommended for?

1. PHP teams wanting type-level bug detection.
2. Legacy PHP codebases improving gradually.

Conclusion

PHPStan is the leading static analyser for PHP.

Raise the level step by step and keep the baseline shrinking.

On CheckOps, PHPStan is filed under the Release & CI gates stage. Related tools listed here include Psalm, PHPUnit, Infection, SonarQube, Semgrep and Pest. Which one fits best depends mostly on your stack, your team’s size and skills, and whether you prefer to run tools yourself or pay for a managed service. This page reflects the official website, documentation and repository as they stood on 11 November 2026.