PHP versions exposed by 435,369 websites
Distribution of PHP versions across the public sites in our index whose servers leak the version in HTTP response headers.
Sample is biased. Most modern hosts hide the PHP version (PHP's expose_php = Off, CDN header stripping, security plugins). This page shows what's visible — typically less than 1% of all PHP-based sites — and skews toward installations without basic header hardening. Do not extrapolate these shares to "the web at large".
| Version | Status | Sites | Share |
|---|---|---|---|
| PHP 8.3 | security-only | 100,008 | 23.0% |
| PHP 8.2 | security-only | 80,436 | 18.5% |
| PHP 7.4 | end of life | 72,695 | 16.7% |
| PHP 8.1 | end of life | 46,532 | 10.7% |
| PHP 8.4 | supported | 45,944 | 10.6% |
| PHP 8.0 | end of life | 21,358 | 4.9% |
| PHP 5.6 | end of life | 13,716 | 3.2% |
| PHP 7.3 | end of life | 12,706 | 2.9% |
| PHP 8.5 | supported | 10,819 | 2.5% |
| PHP 7.2 | end of life | 9,713 | 2.2% |
| PHP 5.4 | end of life | 4,926 | 1.1% |
| PHP 7.0 | end of life | 4,651 | 1.1% |
| PHP 5.3 | end of life | 3,915 | 0.9% |
| PHP 7.1 | end of life | 3,468 | 0.8% |
| PHP 5.5 | end of life | 2,252 | 0.5% |
| PHP 5.2 | end of life | 1,873 | 0.4% |
| PHP 4.4 | end of life | 210 | 0.0% |
| PHP 4.3 | end of life | 67 | 0.0% |
| PHP 5.1 | end of life | 53 | 0.0% |
| PHP 4.1 | end of life | 7 | 0.0% |
| PHP 3.1 | end of life | 5 | 0.0% |
| PHP 5.0 | end of life | 4 | 0.0% |
| PHP 3.0 | end of life | 3 | 0.0% |
| PHP 6.4 | end of life | 2 | 0.0% |
| PHP 1.3 | end of life | 2 | 0.0% |
| PHP 4.8 | end of life | 1 | 0.0% |
| PHP 4.2 | end of life | 1 | 0.0% |
| PHP 4.0 | end of life | 1 | 0.0% |
| PHP 16.6 | — | 1 | 0.0% |
- End of life: 198,161 sites (45.5%) across 24 versions
- Security-only: 180,444 sites (41.4%) across 2 versions
- Supported: 56,763 sites (13.0%) across 2 versions
- Unclassified: 1 sites (0.0%) across 1 version
Method
Our crawler reads each site's homepage and records the X-Powered-By and Server response headers. When either contains a string like PHP/8.3.10, the version is stored as a plain fact (435,369 sites at last refresh). End-of-life status is computed at render time against today's date — never frozen in the database — using the official PHP branch support timeline.
Sites whose servers don't disclose the version (the vast majority) are not in the sample — we never guess.