Server and PHP version disclosure by platform (top 1M homepages, Sept 2026)
| Platform | Server header shows version | Send PHP in X-Powered-By | PHP 5 or 7 among PHP versions | Homepages |
|---|---|---|---|---|
| WordPress | 7.4% | 22.1% | 18.0% | 113,791 |
| Shopify | 0.1% | 0.1% | n/a (37 sites) | 47,012 |
| Webflow | 5.5% | 2.2% | n/a (54 sites) | 2,500 |
| Wix | 0.0% | 0.0% | n/a | 892 |
| Squarespace | 0.4% | 0.0% | n/a | 513 |
| Other/custom | 17.7% | 7.9% | 50.3% | 617,837 |
| All | 14.8% | 9.5% | 39.4% | 782,570 |
Source: PageSpeed Matters, HTTP Archive, Sept 2026. The Server column uses homepages that send a Server header; the Homepages column counts all homepages.
Summary
Many web servers announce exactly which software and version they run in every response. That does not break anything, but it tells anyone scanning for old, unpatched software which sites to try first. We checked how often popular homepages give that information away.
14.8% of top 1M homepages that send a Server header (101,917 of 688,733) include a version number. 74,068 homepages also send their PHP version in the X-Powered-By header, and 29,155 of those report PHP 5 or 7.
What we measured
We looked at HTTP Archive's Sept 2026 mobile crawl of the top 1M sites by Chrome traffic, and read the response headers of each homepage's main document.
A Server header counts as showing a version when the software name is followed by a slash and a version number. A PHP version counts when the X-Powered-By header names PHP followed by a number. Platform is identified from the same page.
The bases differ. Server-version shares use homepages that send a Server header at all, while PHP shares use all homepages. We report results in aggregate only and do not name any site.
About one in seven Server headers shows a version
101,917 of 688,733 homepages with a Server header (14.8%) include a version number. Separately, 74,068 homepages announce a PHP version in X-Powered-By, and 29,155 of them are on PHP 5 or 7.
Of those 74,068, 60.5% (44,835) report PHP 8, 28.5% report PHP 7 and 10.8% (8,033) still report PHP 5. PHP 5 and PHP 7 no longer receive security updates from the PHP project, so those sites are both running old software and telling visitors about it.
Showing a version number is usually just a default setting nobody changed. Most server software and PHP installs send it unless it is turned off.
14.8%
Share of top 1M homepages sending a Server header whose header includes a software version number.
Less popular sites leak more
Disclosure rises as popularity falls. 15.0% of homepages ranked below the top 100K show a server version, against 12.9% of 56,208 Top 100K and 8.3% of 6,071 Top 10K homepages with a Server header.
PHP exposure follows the same pattern. 9.7% of 707,791 homepages ranked below the top 100K send a PHP version, against 7.1% of 67,281 Top 100K and 5.2% of 7,498 Top 10K homepages.
The most visited sites are likely to sit behind a CDN or a managed stack that replaces or strips these headers, and more likely to have someone reviewing server settings.
Hosted platforms almost never disclose
Where the platform controls the server, versions stay hidden. Only 0.1% of 46,929 Shopify homepages and none of 890 Wix homepages put a version in the Server header. On 109,147 WordPress homepages the share is 7.4%, and on 528,855 other or custom sites it is 17.7%.
PHP headers are most common on WordPress, which runs on PHP. 22.1% of WordPress homepages (25,112 of 113,791) send an X-Powered-By PHP header. Only 18.0% of those showing a version are on PHP 5 or 7, likely because many WordPress hosts keep PHP current. On other or custom sites, 50.3% of PHP versions on show (24,600 of 48,866) are PHP 5 or 7.
Disclosure clusters on older stacks
The protocol a homepage loads over is a rough guide to how modern its server setup is. 43.8% of homepages still served over HTTP/1.1 show a server version, against 13.3% on HTTP/2 and 0.2% on HTTP/3.
HTTP/3 usually arrives through a CDN or modern managed hosting, which tend not to pass a detailed Server header through. Sites still on HTTP/1.1 are probably more often self-managed servers left on default settings.
What this means for your site
Hiding version numbers does not fix old software, but it stops your site from advertising it. Do both.
- Check your own headers in the browser's network panel or with a header checker. Look at Server and X-Powered-By on the main document.
- On Apache, set ServerTokens Prod and ServerSignature Off. On nginx, set server_tokens off.
- In php.ini, set expose_php = Off to remove the PHP version from X-Powered-By.
- If the header shows PHP 5 or 7, plan an upgrade to a supported PHP 8 release. Ask your host first, since many let you switch versions from the control panel.
Sources
- HTTP Archive crawl of the top 1M sites by Chrome traffic, September 2026, mobile
- MDN Web Docs, Server header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server
Embed this research
Paste this on your site to embed the chart. It links back to the source automatically.
<iframe id="psm-server-version-disclosure" src="https://www.pagespeedmatters.com/embed/data-studies/server-version-disclosure" width="100%" height="600" style="width:100%;border:1px solid #E2E3E1;border-radius:12px" loading="lazy" title="Server Version Disclosure: 14.8% of Top 1M Sites - PageSpeed Matters"></iframe>
<script>window.addEventListener("message",function(e){if(e&&e.data&&e.data.psmEmbed==="server-version-disclosure"&&e.data.height){var f=document.getElementById("psm-server-version-disclosure");if(f){f.style.height=e.data.height+"px";}}});</script>
<p style="font:14px/1.5 system-ui,sans-serif">Source: <a href="https://www.pagespeedmatters.com/resources/data-studies/server-version-disclosure">Server Version Disclosure: 14.8% of Top 1M Sites - PageSpeed Matters</a></p>
Frequently asked questions
What percentage of websites expose their server version?
14.8% of top 1M homepages that send a Server header (101,917 of 688,733) include a version number. Shopify and Wix homepages almost never do, against 7.4% of WordPress homepages and 17.7% of other or custom sites.
How many websites still show PHP 5 or 7?
74,068 top 1M homepages announce a PHP version in X-Powered-By. 29,155 of them report PHP 5 or 7: 28.5% report PHP 7 and 10.8% (8,033) report PHP 5.
How do I hide my server and PHP version?
On Apache, set ServerTokens Prod and ServerSignature Off; on nginx, set server_tokens off. In php.ini, set expose_php = Off to drop the PHP version from X-Powered-By.
Hiding version headers takes a few lines of server config, and pairing it with a PHP upgrade closes the gap it advertises. Need help with this? See our website maintenance services.