---
title: "Server Version Disclosure: 14.8% of Top 1M Sites"
url: https://www.pagespeedmatters.com/resources/data-studies/server-version-disclosure
description: "14.8% of top 1M homepages with a Server header show a version number, and 74,068 send their PHP version in X-Powered-By, 29,155 of them on PHP 5 or 7."
lang: en
---
Data Study ยท Website Maintenance
# Server Version Disclosure: 14.8% of Top 1M Sites
14.8% of top 1M homepages that send a Server header (101,917 of 688,733) include a version number, and 74,068 send their PHP version in X-Powered-By, 29,155 of them on PHP 5 or 7.
- 782,570 homepages
- HTTP Archive, Sept 2026
Matt Suffoletto: https://www.pagespeedmatters.com/resources/author/matt-suffoletto
Founder, PageSpeed Matters Published Oct. 19, 2026 7 min read
## Key Findings
1. **101,917** of 688,733 top 1M homepages with a Server header (**14.8%**) include a version number; 74,068 send a PHP version in X-Powered-By, 29,155 of them on PHP 5 or 7. Copy stat
2. Less popular sites leak more: **15.0%** of homepages ranked below the top 100K show a server version, against 12.9% of 56,208 Top 100K and **8.3%** of 6,071 Top 10K homepages with a Server header. Copy stat
3. PHP exposure follows the same pattern: **9.7%** of 707,791 homepages ranked below the top 100K send a PHP version, against 7.1% of 67,281 Top 100K and **5.2%** of 7,498 Top 10K homepages. Copy stat
4. Of the 74,068 homepages announcing a PHP version, **60.5%** (44,835) report PHP 8, 28.5% report PHP 7 and **10.8%** (8,033) still report PHP 5. Copy stat
5. Hosted platforms almost never disclose: **0.1%** of 46,929 Shopify homepages and none of 890 Wix homepages put a version in the Server header, against 7.4% of 109,147 WordPress homepages and **17.7%** of 528,855 other or custom sites. Copy stat
6. **22.1%** of WordPress homepages (25,112 of 113,791) send an X-Powered-By PHP header, but only 18.0% of those showing a version are on PHP 5 or 7; on other or custom sites it is **50.3%** (24,600 of 48,866). Copy stat
7. Disclosure clusters on older stacks: **43.8%** of homepages still served over HTTP/1.1 show a server version, against 13.3% on HTTP/2 and **0.2%** on HTTP/3. Copy stat
Share of homepages with a Server header that show a version, by tier
Top 10K 8.3%
Top 100K 12.9%
Rest of top 1M 15%
Source: PageSpeed Matters. HTTP Archive top 1M crawl, Sept 2026, mobile.
Base is homepages that send a Server header; each tier excludes the tiers above it.
In this study
## Server and PHP version disclosure by platform (top 1M homepages, Sept 2026)
| Platform | Server header shows version | Send PHP in X-Powered-By | PHP 5 or 7 among PHP versions | Homepages |
| --- | --- | --- | --- | --- |
| WordPress | 7.4% | 22.1% | 18.0% | 113,791 |
| Shopify | 0.1% | 0.1% | n/a (37 sites) | 47,012 |
| Webflow | 5.5% | 2.2% | n/a (54 sites) | 2,500 |
| Wix | 0.0% | 0.0% | n/a | 892 |
| Squarespace | 0.4% | 0.0% | n/a | 513 |
| Other/custom | 17.7% | 7.9% | 50.3% | 617,837 |
| All | 14.8% | 9.5% | 39.4% | 782,570 |
Source: PageSpeed Matters, HTTP Archive, Sept 2026. The Server column uses homepages that send a Server header; the Homepages column counts all homepages.
## Summary
Many web servers announce exactly which software and version they run in every response. That does not break anything, but it tells anyone scanning for old, unpatched software which sites to try first. We checked how often popular homepages give that information away.
14.8% of top 1M homepages that send a Server header (101,917 of 688,733) include a version number. 74,068 homepages also send their PHP version in the X-Powered-By header, and 29,155 of those report PHP 5 or 7.
## What we measured
We looked at HTTP Archive's Sept 2026 mobile crawl of the top 1M sites by Chrome traffic, and read the response headers of each homepage's main document.
A Server header counts as showing a version when the software name is followed by a slash and a version number. A PHP version counts when the X-Powered-By header names PHP followed by a number. Platform is identified from the same page.
The bases differ. Server-version shares use homepages that send a Server header at all, while PHP shares use all homepages. We report results in aggregate only and do not name any site.
## About one in seven Server headers shows a version
101,917 of 688,733 homepages with a Server header (14.8%) include a version number. Separately, 74,068 homepages announce a PHP version in X-Powered-By, and 29,155 of them are on PHP 5 or 7.
Of those 74,068, 60.5% (44,835) report PHP 8, 28.5% report PHP 7 and 10.8% (8,033) still report PHP 5. PHP 5 and PHP 7 no longer receive security updates from the PHP project, so those sites are both running old software and telling visitors about it.
Showing a version number is usually just a default setting nobody changed. Most server software and PHP installs send it unless it is turned off.
14.8%
Share of top 1M homepages sending a Server header whose header includes a software version number.
## Less popular sites leak more
Disclosure rises as popularity falls. 15.0% of homepages ranked below the top 100K show a server version, against 12.9% of 56,208 Top 100K and 8.3% of 6,071 Top 10K homepages with a Server header.
PHP exposure follows the same pattern. 9.7% of 707,791 homepages ranked below the top 100K send a PHP version, against 7.1% of 67,281 Top 100K and 5.2% of 7,498 Top 10K homepages.
The most visited sites are likely to sit behind a CDN or a managed stack that replaces or strips these headers, and more likely to have someone reviewing server settings.
## Hosted platforms almost never disclose
Where the platform controls the server, versions stay hidden. Only 0.1% of 46,929 Shopify homepages and none of 890 Wix homepages put a version in the Server header. On 109,147 WordPress homepages the share is 7.4%, and on 528,855 other or custom sites it is 17.7%.
PHP headers are most common on WordPress, which runs on PHP. 22.1% of WordPress homepages (25,112 of 113,791) send an X-Powered-By PHP header. Only 18.0% of those showing a version are on PHP 5 or 7, likely because many WordPress hosts keep PHP current. On other or custom sites, 50.3% of PHP versions on show (24,600 of 48,866) are PHP 5 or 7.
## Disclosure clusters on older stacks
The protocol a homepage loads over is a rough guide to how modern its server setup is. 43.8% of homepages still served over HTTP/1.1 show a server version, against 13.3% on HTTP/2 and 0.2% on HTTP/3.
HTTP/3 usually arrives through a CDN or modern managed hosting, which tend not to pass a detailed Server header through. Sites still on HTTP/1.1 are probably more often self-managed servers left on default settings.
## What this means for your site
Hiding version numbers does not fix old software, but it stops your site from advertising it. Do both.
- Check your own headers in the browser's network panel or with a header checker. Look at Server and X-Powered-By on the main document.
- On Apache, set ServerTokens Prod and ServerSignature Off. On nginx, set server_tokens off.
- In php.ini, set expose_php = Off to remove the PHP version from X-Powered-By.
- If the header shows PHP 5 or 7, plan an upgrade to a supported PHP 8 release. Ask your host first, since many let you switch versions from the control panel.
## Sources
- HTTP Archive crawl of the top 1M sites by Chrome traffic, September 2026, mobile
- MDN Web Docs, Server header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server
## Embed this research
Paste this on your site to embed the chart. It links back to the source automatically.
Source: Server Version Disclosure: 14.8% of Top 1M Sites - PageSpeed Matters
## Frequently asked questions
### What percentage of websites expose their server version?
14.8% of top 1M homepages that send a Server header (101,917 of 688,733) include a version number. Shopify and Wix homepages almost never do, against 7.4% of WordPress homepages and 17.7% of other or custom sites.
### How many websites still show PHP 5 or 7?
74,068 top 1M homepages announce a PHP version in X-Powered-By. 29,155 of them report PHP 5 or 7: 28.5% report PHP 7 and 10.8% (8,033) report PHP 5.
### How do I hide my server and PHP version?
On Apache, set ServerTokens Prod and ServerSignature Off; on nginx, set server_tokens off. In php.ini, set expose_php = Off to drop the PHP version from X-Powered-By.
Hiding version headers takes a few lines of server config, and pairing it with a PHP upgrade closes the gap it advertises. Need help with this? See our website maintenance services (https://www.pagespeedmatters.com/services/website-maintenance).
Share
How we measured
## Methodology & Source
Data source
HTTP Archive crawl of the top 1M sites by Chrome traffic: homepage response headers
Collection date
September 2026
Sample
782,570 homepages
Release
HTTP Archive, Sept 2026
Main document response headers for top 1M homepages, Sept 2026, mobile. A Server header shows a version when the software name is followed by a slash and a number; a PHP version is X-Powered-By naming PHP followed by a number. The server-version base is homepages sending a Server header, while PHP shares use all homepages. Results are reported in aggregate only.
Using this data?
## Cite this study
Link back to the study when you cite it.
APA
Matt Suffoletto. (2026). Server Version Disclosure: 14.8% of Top 1M Sites. PageSpeed Matters. https://www.pagespeedmatters.com/resources/data-studies/server-version-disclosure
Plain link
Server Version Disclosure: 14.8% of Top 1M Sites - PageSpeed Matters - https://www.pagespeedmatters.com/resources/data-studies/server-version-disclosure
## Related studies
- Website Maintenance WordPress Version Exposure: 52.8% of WordPress Sites Show It: https://www.pagespeedmatters.com/resources/data-studies/wordpress-version-exposure
- Website Maintenance XML-RPC Statistics 2026: 76.0% of WordPress Sites Advertise It: https://www.pagespeedmatters.com/resources/data-studies/xml-rpc-statistics
- Website Maintenance WordPress Version Statistics 2026: 18.7% Run Old Releases: https://www.pagespeedmatters.com/resources/data-studies/wordpress-version-statistics
- Website Maintenance HTTP/3 Adoption 2026: 21.6% of Top 1M Sites: https://www.pagespeedmatters.com/resources/data-studies/http-3-adoption
## Ready to Get Started?
Get your site optimized in as little as 3 days. From $500.
See Plans & Pricing: https://www.pagespeedmatters.com/pricing
## Structured data
```json
[
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "Server Version Disclosure: 14.8% of Top 1M Sites",
"datePublished": "2026-10-19",
"dateModified": "2026-10-19",
"author": {
"@type": "Person",
"name": "Matt Suffoletto",
"jobTitle": "Performance Optimization Expert",
"url": "https://www.pagespeedmatters.com/resources/author/matt-suffoletto"
}
},
{
"@context": "https://schema.org",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"name": "Home",
"item": "https://www.pagespeedmatters.com/"
},
{
"@type": "ListItem",
"position": 2,
"name": "Resources",
"item": "https://www.pagespeedmatters.com/resources"
},
{
"@type": "ListItem",
"position": 3,
"name": "Data Studies",
"item": "https://www.pagespeedmatters.com/resources/data-studies"
},
{
"@type": "ListItem",
"position": 4,
"name": "Server Version Disclosure: 14.8% of Top 1M Sites"
}
]
},
{
"@context": "https://schema.org",
"@type": "Dataset",
"name": "Server Version Disclosure: 14.8% of Top 1M Sites",
"description": "14.8% of top 1M homepages with a Server header show a version number, and 74,068 send their PHP version in X-Powered-By, 29,155 of them on PHP 5 or 7.",
"url": "https://www.pagespeedmatters.com/resources/data-studies/server-version-disclosure",
"creator": {
"@type": "Organization",
"name": "PageSpeed Matters",
"url": "https://www.pagespeedmatters.com"
},
"datePublished": "2026-10-19",
"dateModified": "2026-10-19",
"license": "https://creativecommons.org/licenses/by/4.0/",
"isAccessibleForFree": true,
"creativeWorkStatus": "Published",
"variableMeasured": "Core Web Vitals pass rate and web performance metrics",
"measurementTechnique": "HTTP Archive crawl of the top 1M sites by Chrome traffic: homepage response headers"
},
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "What percentage of websites expose their server version?",
"acceptedAnswer": {
"@type": "Answer",
"text": "14.8% of top 1M homepages that send a Server header (101,917 of 688,733) include a version number. Shopify and Wix homepages almost never do, against 7.4% of WordPress homepages and 17.7% of other or custom sites."
}
},
{
"@type": "Question",
"name": "How many websites still show PHP 5 or 7?",
"acceptedAnswer": {
"@type": "Answer",
"text": "74,068 top 1M homepages announce a PHP version in X-Powered-By. 29,155 of them report PHP 5 or 7: 28.5% report PHP 7 and 10.8% (8,033) report PHP 5."
}
},
{
"@type": "Question",
"name": "How do I hide my server and PHP version?",
"acceptedAnswer": {
"@type": "Answer",
"text": "On Apache, set ServerTokens Prod and ServerSignature Off; on nginx, set server_tokens off. In php.ini, set expose_php = Off to drop the PHP version from X-Powered-By."
}
}
]
}
]
```