How do you make up for less static typing in a backend?

First, this is mostly a static versus dynamic typing question. Strong and weak typing refer to a different distinction, and the terms get mixed together a lot.

You can still get a fair amount of static checking in a dynamic language. For JavaScript, TypeScript plus a linter is one option. For Python, add type hints and run a checker such as Pyright. Put the checks in CI so they don't depend on everyone remembering to run them locally. Editor integration helps catch mistakes earlier too.

That won't make external data trustworthy, though. A type annotation isn't proof that an incoming request actually has the expected shape.

Validate data where it enters the application, especially request bodies and responses from other services. Check the shape and the constraints your code relies on, then handle invalid input explicitly rather than waiting for a confusing failure deeper in the backend.

For particularly complicated data, runtime validation can be worthwhile even if the project also uses static types. A static checker can't establish that arbitrary input from outside the program is valid.

Tests and careful reviews still do a lot of work. Type checks can reject certain mistakes, but they won't tell you whether the business rule is right or whether you forgot a validation altogether. I'd focus tests on those behaviors and on error cases, not just whether a function accepts the expected types.

For an existing PHP app, you don't necessarily have to fix every issue before turning on analysis. Set up rules in CI, use a baseline for existing findings, and tighten things as the code improves. Autofixers can help with some changes, though they still need review.

There is setup work involved, but configurations can be reused across projects. PHP also has type declarations, so it isn't simply a choice between no types and rewriting the backend.

There's also a practical reason teams stick with dynamic languages: the surrounding packages and tooling can be a big draw. A language change might buy stronger compile-time checks, but it can also mean giving up parts of an ecosystem the team relies on.