Companies Using PHP

I run the detection systems at TechnologyChecker.io, after five years on crawling and indexing at Google, and PHP is the profile where I most want readers to check the method before the number. As of our September 2026 crawl we detect PHP on 5,337,408 domains and matched 3,104,809 of them to a company record, a 58.17% match rate. Every detection depends on PHP identifying itself, which our guide to technology detection methods explains. For sales teams, the count is a floor and the header behind it is the best prospecting signal here.

5.3 million is a floor, not a market size

Our PHP rule matches an X-Powered-By or Server header naming PHP, a PHPSESSID cookie, a URL ending in .php, or a login form posting to login_process.php. PHP sends the header by default (expose_php is On even in the production php.ini that ships with PHP), but administrators switch it off and proxies strip it.

To size the gap I used platforms that can't run without PHP as instruments. Every live domain running PHP or one of WordPress, Joomla, Drupal, Laravel, CodeIgniter, TYPO3, Yii or Symfony adds up to 12,305,917 domains, and PHP announces itself on 43.5% of them. By platform the rate runs from about 41.9% on CodeIgniter and 34.5% on WordPress down to 17.0% on TYPO3 (approximate, since each sets a live-state overlap against a monthly count). Even 12.3 million is a floor, since a custom PHP application that hides its header appears in neither set.

The rise from 4,120,847 domains in June 2026 to 5,337,408 in September reflects changes on our side, both the domains we cover and the signals we detect PHP with, rather than a surge in adoption.

"PHP announces itself on 43.5% of the 12.3 million domains we can show are running it. The other 6.9 million run PHP without saying so." - David Thomson, CTO at TechnologyChecker

Sales Signal: Size any PHP-dependent offer (managed hosting, upgrade services, application monitoring) against 12.3 million, not 5.3 million. Build lists from the announced set, then add the platform installs, because a WordPress site that hides its header needs the same PHP runtime as one that doesn't.

The version header is the prospecting signal

Because 77.97% of recent PHP detections carry a version number, we can see which release a site runs. Of the 3,773,579 domains that announced one in the 30 days to 15 September 2026, 47.56% announce a branch php.net lists as end of life, 19.68% are on PHP 7.4 alone, and only 11.19% run 8.4 or 8.5, the branches still in active support.

Two limits keep that from being a security audit. The versioned set is the less hardened part of the base, since hiding the header is standard advice. And Linux distributions backport fixes without changing the version string: jobs.universityofcalifornia.edu, one of the largest names in our list, answers from Apache on Red Hat Enterprise Linux, whose vendor backports security fixes into the PHP it packages.

Sales Signal: A 7.4 or 5.6 header is a timing signal, not an accusation. The owner faces an upgrade that can force theme, plugin or framework work, which is billable for agencies and a migration trigger for hosts. Lead with the php.net support date. Don't tell a prospect they're exposed, because the header can't prove it.

Small firms at volume, enterprises on side properties

Companies of 1 to 10 employees hold 66.61% of matched domains with a known headcount, and firms above 1,000 employees just 0.91%, which is still 24,817 domains. The 2010s are the largest founding decade at 38.74%, yet 23.48% of matched companies predate 2000.

The enterprise rows need careful reading. 33 of the 46 named organisations are detected on a subdomain, typically a press room, career site or microsite. Orange, Accor and Crédit Agricole serve their French press sites with identical session cookie settings and the same language redirect, which suggests a shared newsroom platform rather than three in-house builds. With no vendor case studies to check against, every name comes from detection.

Sales Signal: For small-business offers the PHP base is a volume channel best reached through hosts and agencies. For enterprise the buyer is rarely central IT: target the communications, HR and recruitment teams that own the subdomain, and check whether a platform vendor runs it before pitching a rebuild.

Construction first, and a European tilt

Construction leads industries at 4.45% and the top ten cover only 29.4%. Local trades (construction, real estate, medical practices, family services, hospitality) make up 13.33%. The United States is just 14.14% of matched domains, against 24.22% on our WordPress profile, while the eight EU countries in PHP's top 15 total 32.90%.

Sales Signal: Localise before you scale. Germany, France, the Netherlands and Spain hold 799,595 matched PHP domains between them, more than the United States, and the stack data includes European hosts OVHcloud (4.27%) and IONOS (2.81%).

Why this page has no migration table

PHP's profile has no competitor switching table, deliberately. Companies don't swap programming languages the way they swap an email tool, and when a PHP signal vanishes the crawler can't tell why: a header switched off, a proxy added in front and a lapsed domain all look the same, and none names a successor. The likely destinations are also the hardest to see, because Python, Node.js and Go applications rarely announce their language.

What we can publish is the count of disappearances. Since we began tracking PHP on 16 March 2026, 505,100 domains have stopped showing a PHP signal, equal to 9.46% of today's base. That isn't lifetime churn, and it isn't a count of sites that left PHP.

"When PHP disappears from a site, it may simply be PHP with the header turned off. A crawler can't tell that apart from a rebuild, so we don't publish one as the other." - David Thomson, CTO at TechnologyChecker

Sales Signal: Treat a dropped PHP signal as a reason to re-check the domain, not as a lost customer. If you sell to sites moving off PHP, look for a new framework or platform detection arriving on the same domain.

Hosting decides the rest of the stack

WordPress runs on 63.73% of the 5,357,720 live domains that announce PHP. Apache serves 32.58%, Nginx 22.64% and LiteSpeed 21.50%. Hostinger hosts 16.35%, and it advertises LiteSpeed servers on its web hosting plans, which fits LiteSpeed sitting this high. Frameworks such as Laravel (0.53%) look thin for the same reason the headline count is low.

Sales Signal: The hosting column is the channel map. Hostinger alone sits under 16.35% of announced PHP sites, with GoDaddy on 8.07%, OVHcloud on 4.27% and IONOS on 2.81%, and on shared plans the host decides which PHP versions a customer can select.

Key takeaways

1. PHP is detected on 5,337,408 domains, but at least 12,305,917 run PHP or a platform that requires it.
2. 47.56% of versioned PHP domains announce an end-of-life branch, though backports mean a version string can't confirm patch status.
3. Enterprise detections are mostly press, career and microsites, so the buyer is the team that owns the subdomain.

Sales applications

Outreach template: "Hi [Name], [domain] announces PHP [version], which php.net lists as end of life since [date]. Moving off that branch can touch themes, plugins and custom code. If an upgrade is on your roadmap, I can share how other [industry] sites in [country] have scoped it."

Targeting strategy: Filter the PHP base on TechnologyChecker.io to companies of 11 to 200 employees in Germany, France, the Netherlands or the United Kingdom, then read the version each site announces. Send 7.x, 8.0 and 8.1 sites upgrade messaging, and tell 8.2 sites that security support ends on 31 December 2026.

Competitive angle: Hosts compete on PHP support. A 7.4 site on a host that still offers 7.4 is a prospect for any host selling managed upgrades, and the 788,308 domains on 8.2 become the next such pool on 1 January 2027.

The full PHP base is on TechnologyChecker.io: 5,337,408 domains, with 3,104,809 matched to a company record carrying industry, size, location and tech stack data.