PHP › Static Analysis (PHPStan & Psalm)

What are analysis levels in PHPStan, and why would a project typically start at a lower level before gradually increasing strictness?

Beginner

Answer

PHPStan organizes its checks into numbered levels, starting from a lenient level zero that only catches the most obvious, clear cut errors, up to a very strict maximum level that enforces comprehensive type correctness throughout the entire codebase, and a project with a large amount of existing code that was not originally written with static analysis in mind typically starts at a lower level to avoid being immediately overwhelmed by a huge number of reported issues, then gradually increases the level over time as the team fixes existing issues and becomes more comfortable with stricter type discipline.
# phpstan.neon
parameters:
    level: 5
    paths:
        - src
Real-world example A team inheriting a large, older codebase configures PHPStan to start at level two, gradually raising it to level six over several months as they progressively fix the issues uncovered at each successive level.

Common follow-ups: What kinds of checks are enforced only at the very highest PHPStan levels?;How can a team gradually adopt static analysis without it blocking every single existing pull request immediately?