4 ms·

That looks like bullshit, they don't say anything about their detection methods but looking for X-Powered headers is the only likely one. Modern installations s

That looks like bullshit, they don't say anything about their detection methods but looking for X-Powered headers is the only likely one. Modern installations simply don't expose that header anymore.

2000UltraDeluxe 4y ago
If you count all VPS'es and sites on shared hosting you'll se a large jump to PHP 8 when CentOS 7 goes EoL. Lots of people just use whatever version comes with the OS.
EGreg 4y ago
What would you recommend as a better source?
- pier25 4y ago
  There's no good source on back end tech market share. The simple truth is that there's no way to know what a server is running unless the server lets you know.
  - viraptor 4y ago
    I'd say instead that there's no guaranteed way. There are likely markers though. For example if you navigate the website and get a cookie set with name "..._laravel", you can safely assume it's a PHP app for stats purposes. There are also more subtle things like the format of csrf, format of error responses, behaviour for weird data passed in (especially name[]=value), etc.
    - ev1 4y ago
      PHPSESSID :)
      - md5madman 4y ago
        only if the site started a session
    - pier25 4y ago
      Indeed, but that's not really a good source to estimate market share as there will be a strong bias towards stacks that are more conspicuous.
- phillipseamore 4y ago
  There simply isn't any source. Headers can be removed or they can be modified to say a site is using X when it really uses Y. Any other detections have just as many problems, having files ending in php doesn't mean they are php, even a site that has something like phpversion.php could be just a saved HTML copy. The biggest PHP users on the linked list don't even expose that they use PHP, but it is publicly known (though Facebook uses [or used] their own fork of PHP called HHVM).
- ev1 4y ago
  There isn't one. PHP stopped sending X-Powered-By by default years ago.
- cestith 4y ago
  A more reliable source would be a well-conducted survey. Or, honestly, having worked for one of the big shared hosting providers, by the numbers small sites outnumber big sites to a staggering degree. One could get a pretty representative sample of overall share by asking the huge providers what appears to run the sites hosted on their services by percentage. I have no particular reason to doubt more than half of sites are run by PHP considering the portion of sites that are WordPress. However, I also have no particular reason to trust that 77% is an accurate proportion.
bguebert 4y ago
They talk about detection methods a little in their FAQ: https://w3techs.com/faq https://w3techs.com/faq PHP probably gets a lot of extra hits in places it might not be used a whole lot. For a long time web host providers had it pre-installed by default. Plus wordpress is used a lot and they can detect that from the admin/edit page.
- EGreg 4y ago
  How does Wordpress know it's powering 40% of all sites in the world? Where does it get the stats
  - bguebert 4y ago
    I'm not for sure about how wordpress would get their stats, but I imagine it's something like scan the internet and put "/wp-admin" behind the base url. If it comes back with the wordpress login page, then count it. At least that's how it seems like hackers find out if you have wordpress from my http server logs. Also someone posted this thing a while back that does some detection like this to find out what tech is powering the website you are on: https://www.wappalyzer.com/ https://www.wappalyzer.com/ I'm not related to them in any way and I don't know how accurate it is but it was interesting.
    - dawnerd 4y ago
      WordPress is pretty easy to detect even when wp-admin is hidden. People seem to not know theres a json api that exposes a lot of information. It's a good idea to disable showing authors since this can give an attacker information they can use to exploit in a few different ways. We had to do this for a high profile client a while back and wrote a little helpful plugin I bet they are undercounting a bit since the large content sites will keep their WordPress install outside of public view completely and the site is just headless. [0] https://github.com/firstandthird/wp-disable-authors https://github.com/firstandthird/wp-disable-authors

That looks like bullshit, they don't say anything about their detection methods but looking for X-Powered headers is the only likely one. Modern installations simply don't expose that header anymore.

2000UltraDeluxe 4y ago

If you count all VPS'es and sites on shared hosting you'll se a large jump to PHP 8 when CentOS 7 goes EoL. Lots of people just use whatever version comes with the OS.

EGreg 4y ago

What would you recommend as a better source?

pier25 4y ago
There's no good source on back end tech market share. The simple truth is that there's no way to know what a server is running unless the server lets you know.
- viraptor 4y ago
  I'd say instead that there's no guaranteed way. There are likely markers though. For example if you navigate the website and get a cookie set with name "..._laravel", you can safely assume it's a PHP app for stats purposes. There are also more subtle things like the format of csrf, format of error responses, behaviour for weird data passed in (especially name[]=value), etc.
  - ev1 4y ago
    PHPSESSID :)
    - md5madman 4y ago
      only if the site started a session
  - pier25 4y ago
    Indeed, but that's not really a good source to estimate market share as there will be a strong bias towards stacks that are more conspicuous.
phillipseamore 4y ago
There simply isn't any source. Headers can be removed or they can be modified to say a site is using X when it really uses Y. Any other detections have just as many problems, having files ending in php doesn't mean they are php, even a site that has something like phpversion.php could be just a saved HTML copy. The biggest PHP users on the linked list don't even expose that they use PHP, but it is publicly known (though Facebook uses [or used] their own fork of PHP called HHVM).
ev1 4y ago
There isn't one. PHP stopped sending X-Powered-By by default years ago.
cestith 4y ago
A more reliable source would be a well-conducted survey. Or, honestly, having worked for one of the big shared hosting providers, by the numbers small sites outnumber big sites to a staggering degree. One could get a pretty representative sample of overall share by asking the huge providers what appears to run the sites hosted on their services by percentage. I have no particular reason to doubt more than half of sites are run by PHP considering the portion of sites that are WordPress. However, I also have no particular reason to trust that 77% is an accurate proportion.

bguebert 4y ago

They talk about detection methods a little in their FAQ: https://w3techs.com/faq https://w3techs.com/faq PHP probably gets a lot of extra hits in places it might not be used a whole lot. For a long time web host providers had it pre-installed by default. Plus wordpress is used a lot and they can detect that from the admin/edit page.

EGreg 4y ago
How does Wordpress know it's powering 40% of all sites in the world? Where does it get the stats
- bguebert 4y ago
  I'm not for sure about how wordpress would get their stats, but I imagine it's something like scan the internet and put "/wp-admin" behind the base url. If it comes back with the wordpress login page, then count it. At least that's how it seems like hackers find out if you have wordpress from my http server logs. Also someone posted this thing a while back that does some detection like this to find out what tech is powering the website you are on: https://www.wappalyzer.com/ https://www.wappalyzer.com/ I'm not related to them in any way and I don't know how accurate it is but it was interesting.
  - dawnerd 4y ago
    WordPress is pretty easy to detect even when wp-admin is hidden. People seem to not know theres a json api that exposes a lot of information. It's a good idea to disable showing authors since this can give an attacker information they can use to exploit in a few different ways. We had to do this for a high profile client a while back and wrote a little helpful plugin I bet they are undercounting a bit since the large content sites will keep their WordPress install outside of public view completely and the site is just headless. [0] https://github.com/firstandthird/wp-disable-authors https://github.com/firstandthird/wp-disable-authors