CMS, CDN and hosting
Where the 18.58M hosts with PHP evidence come from, and how often each group discloses its PHP version. Disclosure rates matter: a group that hides its version looks safer than it is.
How we know a site runs PHP
- PHP CMS fingerprint only9.01M · 48.5%
- PHP version in a response header6.87M · 37.0%
- PHPSESSID cookie only2.33M · 12.6%
- PHP framework cookie only328K · 1.8%
- X-Powered-By: PHP (no version)32K · 0.2%
Only hosts in the first group disclosed a version. The rest are the “unknown” box.
By CMS
CMS detection uses generator tags, CMS-specific headers and same-site asset paths. Only PHP applications are listed; static site builders and hosted platforms (Wix, Blogger, Webflow and similar) are excluded.
- WordPress n=13.59M34.1%
- Joomla n=400K36.9%
- Drupal n=273K23.5%
- TYPO3 n=137K15.6%
- PrestaShop n=88K34.9%
- Contao n=65K23.9%
- OpenCart n=44K40.6%
- 1C-Bitrix n=26K31.0%
- Concrete CMS n=20K30.1%
- MediaWiki n=19K46.4%
- Magento n=13K12.5%
- Silverstripe n=9,39224.0%
- DataLife Engine n=7,92648.1%
- DokuWiki n=7,82233.1%
Show as table
| CMS | Hosts | Strong evidence | Disclosed a version | Potentially affected | 95% CI (disclosure) |
|---|---|---|---|---|---|
| WordPress | 13,592,420 | 12,714,510 | 4,628,988 | 4,628,988 | 34.03–34.08% |
| Joomla | 400,388 | 400,388 | 147,638 | 147,638 | 36.7–37.0% |
| Drupal | 273,186 | 258,885 | 64,116 | 64,116 | 23.3–23.6% |
| TYPO3 | 137,489 | 137,489 | 21,427 | 21,427 | 15.4–15.8% |
| PrestaShop | 88,430 | 18,022 | 30,880 | 30,880 | 34.6–35.2% |
| Contao | 64,638 | 64,638 | 15,452 | 15,452 | 23.6–24.2% |
| OpenCart | 43,588 | 20 | 17,690 | 17,690 | 40.1–41.0% |
| 1C-Bitrix | 26,057 | 55 | 8,066 | 8,066 | 30.4–31.5% |
| Concrete CMS | 20,026 | 20,026 | 6,030 | 6,030 | 29.5–30.8% |
| MediaWiki | 18,718 | 18,718 | 8,693 | 8,693 | 45.7–47.2% |
| Magento | 13,296 | 13,296 | 1,663 | 1,663 | 12.0–13.1% |
| Silverstripe | 9,392 | 9,392 | 2,252 | 2,252 | 23.1–24.9% |
| DataLife Engine | 7,926 | 7,926 | 3,814 | 3,814 | 47.0–49.2% |
| DokuWiki | 7,822 | 7,822 | 2,590 | 2,590 | 32.1–34.2% |
| ProcessWire | 3,869 | 3,869 | 45 | 45 | 0.9–1.6% |
| vBulletin | 2,891 | 2,891 | 917 | 917 | 30.0–33.4% |
| WooCommerce | 1,439 | 1,439 | 306 | 306 | 19.2–23.5% |
| MODX | 321 | 321 | 120 | 120 | 32.3–42.8% |
| osCommerce | 121 | 121 | 49 | 49 | 32.2–49.4% |
Strong evidence is a generator tag or CMS header; the rest come from asset paths or cookies.
CDNs hide the version
25.4% of all hosts sit behind a CDN or WAF. Many of them strip or rewrite the
X-Powered-By header, so these sites disclose their PHP version far less often.
Their real exposure is not lower; it is less visible.
- No CDN detected n=16.07M39.9%
- Cloudflare n=2.28M18.7%
- Amazon CloudFront n=85K22.0%
- Sucuri n=50K0.4%
- Fastly n=39K1.1%
- QUIC.cloud n=16K48.1%
- Bunny CDN n=15K16.0%
- DDoS-Guard n=8,42227.9%
- Imperva n=7,96020.4%
- Azure Front Door n=5,81545.1%
- Akamai n=4,9514.8%
Show as table
| CDN / WAF | PHP hosts | Disclosed a version | Share | 95% CI |
|---|---|---|---|---|
| No CDN detected | 16,069,216 | 6,412,686 | 39.9% | 39.88–39.93% |
| Cloudflare | 2,275,474 | 425,359 | 18.7% | 18.64–18.74% |
| Amazon CloudFront | 84,799 | 18,631 | 22.0% | 21.7–22.3% |
| Sucuri | 49,822 | 214 | 0.4% | 0.38–0.49% |
| Fastly | 39,487 | 427 | 1.1% | 1.0–1.2% |
| QUIC.cloud | 16,338 | 7,866 | 48.1% | 47.4–48.9% |
| Bunny CDN | 14,633 | 2,337 | 16.0% | 15.4–16.6% |
| DDoS-Guard | 8,422 | 2,349 | 27.9% | 26.9–28.9% |
| Imperva | 7,960 | 1,623 | 20.4% | 19.5–21.3% |
| Azure Front Door | 5,815 | 2,620 | 45.1% | 43.8–46.3% |
| Akamai | 4,951 | 238 | 4.8% | 4.2–5.4% |
| Gcore | 260 | 90 | 34.6% | 29.1–40.6% |
By hosting network
Networks (autonomous systems) with the most potentially affected hosts. Large hosting companies rank high because they host many sites, not because they are less secure; many leave the PHP version to the customer.
| Network | ASN | PHP hosts | Potentially affected | Share of PHP hosts |
|---|---|---|---|---|
| Hostinger International Limited | 47583 | 926,335 | 851,937 | 92.0% |
| OVH SAS | 16276 | 899,720 | 577,468 | 64.2% |
| Cloudflare, Inc. (CDN edge) | 13335 | 1,681,491 | 422,169 | 25.1% |
| IONOS SE | 8560 | 793,131 | 361,934 | 45.6% |
| Strato AG | 6724 | 363,862 | 347,193 | 95.4% |
| GoDaddy.com, LLC | 398101 | 246,354 | 201,891 | 82.0% |
| Hetzner Online GmbH | 24940 | 615,188 | 171,093 | 27.8% |
| GMO Internet Group, Inc. | 7506 | 247,158 | 165,633 | 67.0% |
| One.com A/S | 51468 | 165,491 | 160,143 | 96.8% |
| Beget LLC | 198610 | 154,079 | 133,953 | 86.9% |
| Amazon.com, Inc. | 16509 | 495,090 | 120,099 | 24.3% |
| Host Europe GmbH | 21499 | 147,466 | 111,983 | 75.9% |
| Namecheap, Inc. | 22612 | 193,927 | 84,755 | 43.7% |
| A2 Hosting, Inc. | 55293 | 72,091 | 61,169 | 84.8% |
| GoDaddy.com, LLC | 26496 | 58,628 | 50,510 | 86.2% |
| GoDaddy.com, LLC | 400754 | 49,628 | 47,239 | 95.2% |
| Loopia AB | 39570 | 48,245 | 45,042 | 93.4% |
| Internap Holding LLC | 32475 | 47,917 | 37,517 | 78.3% |
| SYNERGY WHOLESALE PTY LTD | 45638 | 38,471 | 35,583 | 92.5% |
| Netsons s.r.l. | 60087 | 37,702 | 34,600 | 91.8% |
| Amazon.com, Inc. | 14618 | 121,016 | 32,172 | 26.6% |
| WorldStream B.V. | 49981 | 33,772 | 30,904 | 91.5% |
| Hangzhou Alibaba Advertising Co.,Ltd. | 37963 | 101,978 | 30,123 | 29.5% |
| Microsoft Corporation | 8075 | 69,679 | 29,514 | 42.4% |
| Your Hosting B.V. | 48635 | 51,967 | 28,944 | 55.7% |
By server country
Country is where the server's IP address is located (DB-IP), not where the site owner is. Hosts behind a CDN are left out, because a CDN address says nothing about the origin server. Base: 30,935,637 hosts not behind a CDN. Countries with at least 100 PHP hosts; the top 25 by PHP hosts are shown.
| Country | PHP hosts | Disclosed a version | Potentially affected | Share of PHP hosts | 95% CI |
|---|---|---|---|---|---|
| United States | 3,724,379 | 1,811,594 | 1,811,594 | 48.6% | 48.59–48.69% |
| Germany | 2,802,514 | 1,085,162 | 1,085,162 | 38.7% | 38.66–38.78% |
| Japan | 1,108,934 | 302,244 | 302,244 | 27.3% | 27.17–27.34% |
| France | 1,033,383 | 565,524 | 565,524 | 54.7% | 54.63–54.82% |
| Russia | 652,376 | 306,792 | 306,792 | 47.0% | 46.9–47.1% |
| Netherlands | 615,161 | 234,756 | 234,756 | 38.2% | 38.0–38.3% |
| United Kingdom | 536,173 | 158,692 | 158,692 | 29.6% | 29.5–29.7% |
| Italy | 464,846 | 102,892 | 102,892 | 22.1% | 22.0–22.3% |
| Poland | 361,692 | 71,417 | 71,417 | 19.7% | 19.6–19.9% |
| Spain | 351,567 | 140,199 | 140,199 | 39.9% | 39.7–40.0% |
| Denmark | 276,490 | 175,476 | 175,476 | 63.5% | 63.3–63.6% |
| Canada | 247,158 | 96,940 | 96,940 | 39.2% | 39.0–39.4% |
| Switzerland | 231,011 | 23,326 | 23,326 | 10.1% | 10.0–10.2% |
| Czechia | 217,852 | 41,078 | 41,078 | 18.9% | 18.7–19.0% |
| Singapore | 216,078 | 108,630 | 108,630 | 50.3% | 50.1–50.5% |
| Australia | 199,481 | 94,071 | 94,071 | 47.2% | 46.9–47.4% |
| China | 197,981 | 57,794 | 57,794 | 29.2% | 29.0–29.4% |
| Brazil | 176,302 | 92,669 | 92,669 | 52.6% | 52.3–52.8% |
| India | 167,728 | 97,784 | 97,784 | 58.3% | 58.1–58.5% |
| Finland | 150,431 | 56,887 | 56,887 | 37.8% | 37.6–38.1% |
| Hong Kong | 147,043 | 42,441 | 42,441 | 28.9% | 28.6–29.1% |
| Türkiye | 135,386 | 74,384 | 74,384 | 54.9% | 54.7–55.2% |
| South Korea | 133,879 | 36,953 | 36,953 | 27.6% | 27.4–27.8% |
| Sweden | 128,884 | 79,301 | 79,301 | 61.5% | 61.3–61.8% |
| Vietnam | 106,507 | 48,580 | 48,580 | 45.6% | 45.3–45.9% |
A low share can mean better patching or simply that local hosts hide the version more often. Compare with the disclosure rates above before ranking countries.