Unused Private Method

ID

php.unused_private_method

Severity

low

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Code Smell

Language

Php

Tags

CWE:561, code_smell, dead-code

Description

Reports a private method that is never called within its declaring class. A private method is only reachable from inside its own class, so one whose name never appears in a $this→name(…​), self::name(…​) or static::name(…​) call — nor as a [$this, 'name'] array callable — is dead code.

Rationale

An uncalled private method is logic that no path can reach. It inflates the class, invites readers to maintain code that does nothing, and usually marks a helper left behind after its only caller was removed. Deleting it keeps the class focused on the behaviour that is actually wired up.

<?php
class Report
{
    public function render(): string
    {
        return $this->header();    // calls header()
    }

    private function header(): string { return '...'; }  // OK — called above
    private function footer(): string { return '...'; }  // FLAW — never called
}

Magic methods (construct, toString, __get, …) are invoked implicitly by the runtime and are never reported. When the class dispatches dynamically ($this→$method()), the whole class is skipped because a method could be reached through a name that cannot be resolved statically.

Remediation

Delete the method if it is genuinely unreachable. If it was meant to be called, add the missing call site; if it implements an external or inherited contract, widen its visibility.

References