Download websites that use HHVM

About HHVM

Meta built HHVM to solve a problem that has since solved itself. Facebook's PHP codebase had outgrown the interpreter running it, so the company wrote a virtual machine in C++ that compiled the same code just in time and executed it far faster. Released publicly in 2013, HHVM offered high-traffic PHP operators a way to buy performance without rewriting their applications, and for a while it was a serious option for anyone whose bottleneck was the language runtime itself.

Then the PHP project closed most of the gap inside its own engine, and the case for a separate virtual machine weakened. HHVM's direction moved toward Hack, the typed language Meta designed to run on it, and away from stock PHP compatibility. What we detect today is largely what that history left behind rather than a live migration trend.

As of October 2026 we see HHVM on 46 sites, and the shape of the version data says more than the count does. We record 17 distinct versions across the group, with 3.10.1 recurring more than any other build in our data. A runtime with spread that wide, headed by a release from the era before the split with PHP, is not a runtime people are actively upgrading. Each install is a server somebody stood up, tuned and then stopped touching.

Finding this runtime on a site tells you something quite specific about the operator. Somebody there once cared enough about request latency to replace the standard engine, which implies real traffic, in-house operations skill and a codebase old enough to predate the fix. Whether that skill is still on staff is a separate question, and the version distribution suggests that in many cases it is not. The engine is also a deployment detail rather than a product choice, so managed hosts and platform providers account for part of what we count, with the site owner unaware of which runtime serves the request.

Detection is inferential and it undercounts. A runtime identifies itself in response headers or error output only when the operator leaves that exposed, and it vanishes the moment a proxy strips the header or a cache sits in front of the origin. Our figure is therefore a lower bound on installs and a much lower bound on traffic, because a busy site behind a content delivery network can be invisible while a quiet one announces its build on every request.

The people who want this list are migration consultancies, PHP shops and security researchers. The code ships under the PHP License, so the source is open to study and the failure modes are documented, and our Web servers classification places the finding at the infrastructure layer rather than in the marketing stack, which is where remediation and modernisation work actually gets sold. A per-domain lookup can confirm a suspicion about a single host. Only the full export answers who is still running an unmaintained runtime in production, what else those operators have in common, and how fast the group is shrinking.