PHP versions exposed by 10,110 websites
Distribution of PHP versions across the public sites in our index whose servers leak the version in HTTP response headers.
Sample is biased. Most modern hosts hide the PHP version (PHP's expose_php = Off, CDN header stripping, security plugins). This page shows what's visible — typically less than 1% of all PHP-based sites — and skews toward installations without basic header hardening. Do not extrapolate these shares to "the web at large".
| Version | Status | Sites | Share |
|---|---|---|---|
| PHP 8.3 | security-only | 2,259 | 22.3% |
| PHP 8.2 | security-only | 1,855 | 18.3% |
| PHP 7.4 | end of life | 1,845 | 18.2% |
| PHP 8.1 | end of life | 1,088 | 10.8% |
| PHP 8.4 | supported | 1,006 | 10.0% |
| PHP 8.0 | end of life | 435 | 4.3% |
| PHP 5.6 | end of life | 388 | 3.8% |
| PHP 7.3 | end of life | 308 | 3.0% |
| PHP 7.2 | end of life | 203 | 2.0% |
| PHP 8.5 | supported | 173 | 1.7% |
| PHP 5.4 | end of life | 120 | 1.2% |
| PHP 7.1 | end of life | 104 | 1.0% |
| PHP 5.5 | end of life | 101 | 1.0% |
| PHP 5.3 | end of life | 91 | 0.9% |
| PHP 7.0 | end of life | 89 | 0.9% |
| PHP 5.2 | end of life | 40 | 0.4% |
| PHP 5.1 | end of life | 2 | 0.0% |
| PHP 4.4 | end of life | 2 | 0.0% |
| PHP 4.3 | end of life | 1 | 0.0% |
- End of life: 4,817 sites (47.6%) across 15 versions
- Security-only: 4,114 sites (40.7%) across 2 versions
- Supported: 1,179 sites (11.7%) across 2 versions
Method
Our crawler reads each site's homepage and records the X-Powered-By and Server response headers. When either contains a string like PHP/8.3.10, the version is stored as a plain fact (10,110 sites at last refresh). End-of-life status is computed at render time from php.net's branch table against today's date, never frozen in the database.
Sites whose servers don't disclose the version (the vast majority) are not in the sample — we never guess. See also the domain lookup for the full per-site fingerprint.