Serverless is a way to run code without looking after your own server: the provider runs your small pieces of code when needed and keeps the machinery updated. You write a function, upload it, and the platform runs it whenever a request calls for it. The name is misleading, since servers still exist, but they are the provider’s concern and not yours.
What is serverless?
Serverless runs code as small functions on a provider’s platform, without managing or patching your own server.
On a classic host you rent or share a server, install PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. and a database, and keep all of it updated. In a serverless setup, the unit you manage is a function. It takes input, such as a form submission, does a job and returns a result. The platform starts the function when needed and handles where and how it runs.
Billing and limits depend on the provider, so check them before you build on one. Functions usually have limits on run time and memory, which suits short jobs. Serverless functions that run close to the visitor on a CDNA CDN is a network of servers around the world that keeps copies of your website close to your visitors, so pages load fast wherever they are. are called edgeEdge computing means running small bits of code on servers close to the visitor, instead of on one central server far away. functions.
What serverless means for your PHP site
A PHP site needs a server that runs PHP, with a version you must keep supported. That is the part that goes out of date and gets targeted when a new vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. appears. With serverless functions behind a static siteA static website is made of ready-made page files that the server hands over as they are, with no PHP code or database working behind the scenes., there is no PHP installation of your own to patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem.. A site with no PHP and no database running during a page view has a smaller attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server., though your function code, its keys and its access rights can still be wrong.
Think about what you give up. A function is good at one small thing. If your site has many features that share a database, splitting them into functions is more work than it sounds. Keep what must be dynamic small and clear.
How to tell what could be a function
Go through what your PHP site does on the server beyond showing pages. A contact form that sends an email is a classic case. So is a newsletter signup that calls a mailing service, a search that queries an index, or a check on a spam token such as TurnstileTurnstile is Cloudflare's privacy-friendly check that tells real people from bots on your forms, without making visitors solve puzzles.. Each can be a function. Features that need a user account, long-running processes or a complex database are harder.
Write down each function’s input, its output and the secrets it needs. Store secrets in the platform’s secret storage, never in the page code that visitors can read.
A typical setup
A JamstackJamstack is a way of building websites from pages that are made in advance and delivered from servers around the world, with small services for the live parts. site is a set of prebuilt pages on a CDN. The contact form posts to a function, which checks the submission, forwards it to your email service and returns a confirmation. No server of your own runs, and the pages are the same files for every visitor. We use this for the dynamic parts when we move from WordPress to a static site.
When to act
Look at serverless when you want to leave PHP behind but still need a few dynamic features, or when a server you manage is more effort than the site justifies. If your PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. is nearing its end of support and you are not sure which route to take, a conversation about our PHP migration service is a good first step.
Frequently asked questions
Does serverless mean there are no servers?
No. There are still servers, but the provider runs and patches them. You upload a function, the platform runs it when a request comes in, and you do not manage the machine underneath.
What is serverless used for on a website?
Typical jobs are handling a contact form, sending an email, checking a spam token, talking to an outside service or returning a small piece of data to a static page.
Is serverless safer than a normal server?
You no longer patch an operating system or a PHP installation yourself, which removes one type of work. Your own function code, its secrets and its permissions still need careful handling.
Can I move my PHP application to serverless?
Small parts, yes. A large application with a database and many features usually needs a redesign first. A common approach is to make the content static and move only the dynamic bits to functions.