Download websites that use PHP

About PHP

PHP is the layer almost nobody chooses deliberately and almost everybody ends up running. As of September 2026 we detect it on 38,049,217 sites, and the overwhelming majority of those sites made no decision about it at all. Their owners chose a platform, and the platform came with an interpreter.

That indirection is what makes it useful as data. Because it sits underneath the content layer rather than beside it, its presence correlates with a whole family of things you might actually want to target: a category of hosting, a class of platform, a maintenance posture, a price point. On its own it is close to meaningless. Cross-referenced against what runs above it, it becomes a reliable segmenter.

The version distribution is the sharpest instrument here. We currently see 692 distinct version strings in production and 7.4.33 is the one the largest number of sites report. The gap between what upstream still supports and what is actually running is wide, and unlike most things in this space it is directly measurable rather than inferred. A site on an unsupported interpreter is not receiving security fixes, and that is a factual statement about risk rather than an opinion about quality.

That fact has commercial weight in several directions at once. Hosting companies use it to size migration campaigns. Security vendors use it to scope exposure. Agencies use it to find properties whose owners are about to have a problem they do not yet know about. Each of those is the same underlying query with a different filter attached, and each of them needs the full population rather than a sample.

Geography adds context rather than a target. United States carries 13,971,465 of the total and the .com zone leads the split, both of which track where volume hosting is concentrated rather than where the language is favoured.

There is one more thing the version string makes possible, which is inference about the stack above it. Certain interpreter versions are incompatible with certain platform releases, so an old interpreter running under a current application usually means the application is misreporting, and a current interpreter under an old application usually means someone upgraded the floor and left the building alone. Both are informative, and both require the two facts on the same row.

The webatla export is built that way. Every domain we detect it on, with the version we observed, the hosting country, the TLD and everything else we fingerprinted on the same site, in one file rebuilt daily and filtered locally.

The absence of the signal is informative too. A site in a category where this interpreter is near-universal that does not report it is usually either running something deliberately different or suppressing the header, and both are small, unusual populations that reward a closer look. Broad technologies are most useful at their edges.

It is also worth being explicit about how we know. The version is taken from what the server chooses to disclose, and a hardened configuration discloses nothing. So the population with a visible version is biased toward the less carefully configured end of the estate, in the same direction as every other self-reported field on the web. That bias is stable and therefore workable, but it should be stated rather than assumed away, and it is why we publish the raw string we observed instead of a normalised guess.

The PHP Group maintains it under the PHP License, and it has been in the open since 1994. The language has never had a registration step, so there has never been a list of who runs it.