5 ms·

I wonder how much the results of this are skewed because PHP reports via the server response header that it is being used. Other languages like Elixir, Go, etc

I wonder how much the results of this are skewed because PHP reports via the server response header that it is being used. Other languages like Elixir, Go, etc aren't so public about their usage unless one of their web frameworks adds it. I'd also love to see a study like this instead focused on "How much of the active web is wordpress?" and "How much of the inactive web is wordpress?".

WesolyKubeczek 5y ago
Still, you can use it to gauge PHP to non-PHP. And there is an unknown percentage of PHP sites which turn this header off.
- acdha 5y ago
  Your second sentence is why the first is unreliable: in particular, advertising server software and versions will get you flagged by most security auditors so the PHP sites which don't advertise will often be the largest and/or most interesting — for example, neither Etsy nor Wikipedia advertise that header.
  - WesolyKubeczek 5y ago
    Still, if you change "78%" to "at least 78%", it's impressive nonetheless.
    - acdha 5y ago
      Do you think that's “at least 78% of all sites” or “at least 78% of sites which advertise what they're built with”? The latter case seems more likely and that will distort the numbers massively.
adventured 5y ago
It's a very common config change these days to turn off expose_php (stop reporting by X-Powered-By header that PHP is installed on the server). You'll see this suggestion across nearly all forums related to PHP. That has been true for a decade or more at this point.
- astura 5y ago
  It's not just PHP, turning off X-Powered-By (or similar) is part of any server hardening standard for any language I've ever seen (and implemented).
josefx 5y ago
When I heard that question several years ago in the sense why haven't Java/C# replaced PHP the answer was simple: nearly every web host offered a pre-configured web stack with PHP, MYSQL, etc. and setting up anything else was neither cheap nor easy . Seems to be nearly the same today, the first few dozen hosting providers I can find on Google either have WordPress or a one click WordPress install.
tored 5y ago
The report looks at multiple variables, not only response headers, to figure out backend language.
- gr__or 5y ago
  Can you provide a source with information on what those variables are exactly?

WesolyKubeczek 5y ago

Still, you can use it to gauge PHP to non-PHP. And there is an unknown percentage of PHP sites which turn this header off.

acdha 5y ago
Your second sentence is why the first is unreliable: in particular, advertising server software and versions will get you flagged by most security auditors so the PHP sites which don't advertise will often be the largest and/or most interesting — for example, neither Etsy nor Wikipedia advertise that header.
- WesolyKubeczek 5y ago
  Still, if you change "78%" to "at least 78%", it's impressive nonetheless.
  - acdha 5y ago
    Do you think that's “at least 78% of all sites” or “at least 78% of sites which advertise what they're built with”? The latter case seems more likely and that will distort the numbers massively.

adventured 5y ago

It's a very common config change these days to turn off expose_php (stop reporting by X-Powered-By header that PHP is installed on the server). You'll see this suggestion across nearly all forums related to PHP. That has been true for a decade or more at this point.

astura 5y ago
It's not just PHP, turning off X-Powered-By (or similar) is part of any server hardening standard for any language I've ever seen (and implemented).

josefx 5y ago

When I heard that question several years ago in the sense why haven't Java/C# replaced PHP the answer was simple: nearly every web host offered a pre-configured web stack with PHP, MYSQL, etc. and setting up anything else was neither cheap nor easy . Seems to be nearly the same today, the first few dozen hosting providers I can find on Google either have WordPress or a one click WordPress install.

tored 5y ago

The report looks at multiple variables, not only response headers, to figure out backend language.

gr__or 5y ago
Can you provide a source with information on what those variables are exactly?