48.1% of websites that publish their PHP version run PHP 8.1 or older, releases that no longer receive security fixes. That is more than a million homepages, and a third of them are still on PHP 7 or PHP 5.
Analysis of 2,198,139 homepages that show their PHP version · the public HTTP Archive crawl of 15.5 million websites, September 2026
Key Findings
- 1.48.1% of websites that show their PHP version run PHP 8.1 or older, versions that no longer get security fixes, against 51.9% on a supported release.
- 2.26.9% of websites that show their PHP version still run PHP 7, which stopped receiving security fixes in November 2022.
- 3.7.9% of websites that show their PHP version, 173,799 homepages, still run PHP 5, which lost security support in 2018.
- 4.1,056,527 homepages openly show a PHP version that no longer receives security fixes.
- 5.PHP runs 47.3% of the 15.5 million homepages in the HTTP Archive, and 70% of PHP websites keep their version number private.
Summary
A security researcher publishes details of a flaw in PHP 7. The PHP maintainers do not release a fix, because PHP 7 stopped getting security updates in November 2022. Every website still running it keeps that flaw for as long as its owner leaves the server alone, and anyone scanning the web can see which sites those are when the server announces its version.
PHP is the programming language behind WordPress, Drupal, Joomla, Magento and a large part of the web. Each PHP release gets security fixes for a set number of years and then reaches end of life, the point where its maintainers stop patching it. The version is usually chosen by the hosting company or set in a hosting control panel, so many site owners have never looked at it. The website keeps working after end of life, which is why nobody notices.
Nearly half of the websites that show their PHP version are past that point. 48.1% run PHP 8.1 or older, and 34.8% are on PHP 7 or PHP 5, releases that lost security support years ago. In absolute terms, 1,056,527 homepages tell every visitor and every automated scanner that they run a PHP version with no security fixes.
What we measured
We used the public HTTP Archive crawl of September 2026, which records the server software it detects on 15.5 million website homepages. PHP was detected on 7,319,064 of them, and 2,198,139 showed which PHP version they run. We grouped those versions by whether they still receive security fixes.
A PHP version is end of life when its maintainers no longer release security fixes for it. PHP 8.1 reached that point on December 31, 2025, so PHP 8.1 and every older release count as end of life, and PHP 8.2 and newer count as supported. PHP 7 lost security support in November 2022, and PHP 5 in 2018.
A third of websites that show their PHP version run PHP 7 or older
The single largest group is in good shape: 51.9% of websites that show their version run PHP 8.2 or newer. Behind them is a long tail of old releases. PHP 7 runs on 591,688 homepages, more than a quarter of the total, and PHP 5 still runs on 173,799, 7.9%, eight years after its last security fix. Together, PHP 5 and PHP 7 account for 765,487 homepages, 34.8% of all websites that show a version.
Another 13.2% run PHP 8.0 or 8.1. These are recent releases that reached end of life between 2023 and 2025, so these sites are one upgrade away from being current. The PHP 5 and PHP 7 sites are a different case: they have skipped at least one full generation of PHP, and upgrading them usually means updating old plugins, themes and custom code that were written for a language that has since changed.
Source: Suff Digital analysis of 2,198,139 homepages that show their PHP version · the public HTTP Archive crawl of 15.5 million websites, September 2026
More than a million websites advertise an unsupported PHP version
1,056,527 homepages run PHP 8.1 or older and say so in every response they send. Attackers use exactly this signal: automated tools scan the web for servers announcing an old version and try the published exploits for it. A server that announces PHP 7 or PHP 5 tells those tools where to start.
The absolute numbers are large. The 173,799 homepages on PHP 5 alone would make a sizable web platform of their own, and every one of them runs a language version that has not had a security fix since 2018. The 591,688 homepages on PHP 7 have gone almost four years without one.
Most PHP websites keep their version private
PHP runs 47.3% of the 15.5 million homepages in the HTTP Archive, 7,319,064 in all. Of those, 5,120,925, or 70%, do not reveal which PHP version they run. That is good practice: a server that keeps its version private gives automated scanners less to work with.
The other 30% publish their version, usually because nobody turned the setting off. The same settings panel that hides the version also sets which PHP release the site runs, so an owner who opens it once can fix both problems in one visit.
| PHP visibility | Homepages | Share |
|---|---|---|
| PHP detected | 7,319,064 | 47.3% of all homepages |
| Version visible | 2,198,139 | 30% of PHP websites |
| Version hidden | 5,120,925 | 70% of PHP websites |
| Visible and end of life | 1,056,527 | 48.1% of visible |
What this means for site owners on PHP platforms
Log in to your hosting control panel and find the PHP version setting, usually under a menu called PHP Manager, MultiPHP or Software. If your site runs anything below PHP 8.2, it is on a release with no security fixes. On WordPress, the Site Health page under Tools shows the PHP version and warns when it is out of date.
Do not switch versions on the live site first. Copy the site to a staging environment, change the PHP version there, and click through every page, form and checkout, because old plugins and themes are what usually break on a newer PHP. Update or replace anything that fails, then switch the live site. Sites on PHP 5 or 7 should expect more of this work than sites on PHP 8.0 or 8.1.
While you are in the control panel, turn off the setting that sends your PHP version in server responses, so your site stops advertising what it runs. PHP upgrades come around every year or two, so put the next end-of-life date in your calendar. Our wordpress maintenance services include PHP version checks and tested upgrades on a staging copy before anything changes on the live site.
Embed this research
Paste this on your site to embed the charts. It links back to the source automatically.
<iframe id="sd-end-of-life-php-versions" src="https://www.suffdigital.com/embed/data-studies/end-of-life-php-versions" width="100%" height="600" style="width:100%;border:1px solid #E5E7EB;border-radius:12px" loading="lazy" title="48.1% of Websites That Show Their PHP Version Run One With No Security Fixes - Suff Digital"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.sdEmbed==="end-of-life-php-versions"&&e.data.height){var f=document.getElementById("sd-end-of-life-php-versions");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.suffdigital.com/resources/data-studies/end-of-life-php-versions">48.1% of Websites That Show Their PHP Version Run One With No Security Fixes - Suff Digital</a></p>
Cite this study
Suff Digital. (2026). 48.1% of Websites That Show Their PHP Version Run One With No Security Fixes. https://www.suffdigital.com/resources/data-studies/end-of-life-php-versions
48.1% of Websites That Show Their PHP Version Run One With No Security Fixes - Suff Digital - https://www.suffdigital.com/resources/data-studies/end-of-life-php-versions
Frequently asked questions
Related studies
- Website MaintenanceNearly 3 in 10 Websites Load a JavaScript Library With a Known Security Flaw
- Website Maintenance61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections
- Website Maintenance27% of Drupal Websites Run a Version That No Longer Gets Security Fixes
- Website Maintenance83% of PrestaShop Websites Showing a jQuery Version Run One With Known Flaws vs 36.1% Web-Wide