PHP versions exposed by 337,050 websites
Distribution of PHP versions across the public sites in our index whose servers leak the version in HTTP response headers.
Sample is biased. Most modern hosts hide the PHP version (PHP's expose_php = Off, CDN header stripping, security plugins). This page shows what's visible — typically less than 1% of all PHP-based sites — and skews toward installations without basic header hardening. Do not extrapolate these shares to "the web at large".
| Version | Status | Sites | Share |
|---|---|---|---|
| PHP 8.3 | security-only | 78,286 | 23.2% |
| PHP 8.2 | security-only | 61,361 | 18.2% |
| PHP 7.4 | end of life | 57,904 | 17.2% |
| PHP 8.1 | end of life | 37,109 | 11.0% |
| PHP 8.4 | supported | 33,571 | 10.0% |
| PHP 8.0 | end of life | 15,877 | 4.7% |
| PHP 5.6 | end of life | 10,854 | 3.2% |
| PHP 7.3 | end of life | 10,098 | 3.0% |
| PHP 8.5 | supported | 7,723 | 2.3% |
| PHP 7.2 | end of life | 7,538 | 2.2% |
| PHP 5.4 | end of life | 3,757 | 1.1% |
| PHP 7.0 | end of life | 3,636 | 1.1% |
| PHP 5.3 | end of life | 2,972 | 0.9% |
| PHP 7.1 | end of life | 2,705 | 0.8% |
| PHP 5.5 | end of life | 1,899 | 0.6% |
| PHP 5.2 | end of life | 1,468 | 0.4% |
| PHP 4.4 | end of life | 178 | 0.1% |
| PHP 4.3 | end of life | 51 | 0.0% |
| PHP 5.1 | end of life | 42 | 0.0% |
| PHP 4.1 | end of life | 5 | 0.0% |
| PHP 5.0 | end of life | 4 | 0.0% |
| PHP 3.1 | end of life | 3 | 0.0% |
| PHP 3.0 | end of life | 2 | 0.0% |
| PHP 6.4 | end of life | 2 | 0.0% |
| PHP 1.3 | end of life | 2 | 0.0% |
| PHP 4.0 | end of life | 1 | 0.0% |
| PHP 4.8 | end of life | 1 | 0.0% |
| PHP 4.2 | end of life | 1 | 0.0% |
- End of life: 156,109 sites (46.3%) across 24 versions
- Security-only: 139,647 sites (41.4%) across 2 versions
- Supported: 41,294 sites (12.3%) across 2 versions
Method
Our crawler reads each site's homepage and records the X-Powered-By and Server response headers. When either contains a string like PHP/8.3.10, the version is stored as a plain fact (337,050 sites at last refresh). End-of-life status is computed at render time against today's date — never frozen in the database — using the official PHP branch support timeline.
Sites whose servers don't disclose the version (the vast majority) are not in the sample — we never guess. See also the domain lookup for the full per-site fingerprint.