PHP versions exposed by 454,999 websites
Distribution of PHP versions across the public sites in our index whose servers leak the version in HTTP response headers.
Sample is biased. Most modern hosts hide the PHP version (PHP's expose_php = Off, CDN header stripping, security plugins). This page shows what's visible — typically less than 1% of all PHP-based sites — and skews toward installations without basic header hardening. Do not extrapolate these shares to "the web at large".
| Version | Status | Sites | Share |
|---|---|---|---|
| PHP 8.3 | security-only | 105,159 | 23.1% |
| PHP 8.2 | security-only | 83,326 | 18.3% |
| PHP 7.4 | end of life | 74,948 | 16.5% |
| PHP 8.4 | supported | 49,041 | 10.8% |
| PHP 8.1 | end of life | 48,125 | 10.6% |
| PHP 8.0 | end of life | 21,575 | 4.7% |
| PHP 8.5 | supported | 14,064 | 3.1% |
| PHP 5.6 | end of life | 14,062 | 3.1% |
| PHP 7.3 | end of life | 12,910 | 2.8% |
| PHP 7.2 | end of life | 9,926 | 2.2% |
| PHP 5.4 | end of life | 5,006 | 1.1% |
| PHP 7.0 | end of life | 4,784 | 1.1% |
| PHP 5.3 | end of life | 3,960 | 0.9% |
| PHP 7.1 | end of life | 3,567 | 0.8% |
| PHP 5.5 | end of life | 2,280 | 0.5% |
| PHP 5.2 | end of life | 1,897 | 0.4% |
| PHP 4.4 | end of life | 217 | 0.0% |
| PHP 4.3 | end of life | 69 | 0.0% |
| PHP 5.1 | end of life | 54 | 0.0% |
| PHP 4.1 | end of life | 7 | 0.0% |
| PHP 3.1 | end of life | 5 | 0.0% |
| PHP 5.0 | end of life | 4 | 0.0% |
| PHP 3.0 | end of life | 3 | 0.0% |
| PHP 6.4 | end of life | 3 | 0.0% |
| PHP 1.3 | end of life | 2 | 0.0% |
| PHP 4.8 | end of life | 1 | 0.0% |
| PHP 4.2 | end of life | 1 | 0.0% |
| PHP 4.0 | end of life | 1 | 0.0% |
| PHP 16.6 | — | 1 | 0.0% |
| PHP 9.3 | — | 1 | 0.0% |
- End of life: 203,407 sites (44.7%) across 24 versions
- Security-only: 188,485 sites (41.4%) across 2 versions
- Supported: 63,105 sites (13.9%) across 2 versions
- Unclassified: 2 sites (0.0%) across 2 versions
Method
Our crawler reads each site's homepage and records the X-Powered-By and Server response headers. When either contains a string like PHP/8.3.10, the version is stored as a plain fact (454,999 sites at last refresh). End-of-life status is computed at render time against today's date — never frozen in the database — using the official PHP branch support timeline.
Sites whose servers don't disclose the version (the vast majority) are not in the sample — we never guess.