Cet article est aussi disponible en français.

You can follow me @pascal_martin, and there is an RSS feed of the posts I write in English.

I have collected data and written about usage of each PHP versions a few times already – up until now, always in French: this is the first time I’m doing this in English. The first time I’ve done this was in September 2011 and the most recent one was almost one year ago, in November 2013. At that time, PHP 5.2 was still representing 34.4% of PHP installations, with PHP 5.3 ahead with 48.7%.

The data presented in this post have been collected during the week-end of October 2014 18th. Stable versions of PHP are PHP 5.4.34 (which is called old-stable), PHP 5.5.18 and PHP 5.6.2. PHP 5.3 is not maintained anymore, since August 2014 14th and PHP 5.2 has been out of support for almost 4 years.

Web Servers

Before talking about PHP versions, here’s the list of web-servers I identified the most often while collecting data:

• Apache: 5,644,243 – 58.65%
• IIS: 1,496,967 – 15.56%
• nginx: 1,410,170 – 14.65%
• Others: 456,985 – 4.75%
• GSE: 312,448 – 3.25%
• cloudflare-nginx: 134,131 – 1.39%
• LiteSpeed: 107,378 – 1.12%
• Oversee Turing v1.0.0: 61,127 – 0.64%

As a graph only representing the first few results:

Apache is still in the first place – and by far – but it loses ground bit by bit, especially to nginx, which rose in one year from 7.9% to 14.8%. IIS remains at the second place, but could very well fall down one step before my next post!

Major versions of PHP

When it comes to major versions of PHP, there is no real surprise:

• PHP 3: 415 – 0.02%
• PHP 4: 106,866 – 4.15%
• PHP 5: 2,470,731 – 95.84%
• PHP 6: 36 – 0.00%
• PHP 7: 3 – 0.00%

PHP 5 is first in line, far from the other versions¹ – which is, let’s admit it, quite logical.

Still, a great number of servers are still running PHP 4 – its last version having been released in August 2008.

Minor versions of PHP

Going on with minor versions of PHP, for PHP >= 3.x and PHP <= 7.x and only keeping versions that have been detected at least 10 times, we’d get the following data:

• PHP 3.0: 402 – 0.02%
• PHP 3.2: 12 – 0.00%
• PHP 4.0: 834 – 0.03%
• PHP 4.1: 1,823 – 0.07%
• PHP 4.2: 1,967 – 0.08%
• PHP 4.3: 22,537 – 0.87%
• PHP 4.4: 79,702 – 3.09%
• PHP 5.0: 2,500 – 0.10%
• PHP 5.1: 39,144 – 1.52%
• PHP 5.2: 586,490 – 22.75%
• PHP 5.3: 1,141,116 – 44.26%
• PHP 5.4: 583,423 – 22.63%
• PHP 5.5: 113,582 – 4.41%
• PHP 5.6: 4,464 – 0.17%
• PHP 6.0: 34 – 0.00%

And, as a graph:

The first interesting thing is that PHP 5.3, which has not been supported anymore for a few month, is still the most used PHP version with 44.3%, far ahead of PHP 5.2 and 5.4 which are pretty much each as used as the other, with 22.8% and 22.6%.

PHP 5.5, released in June 2013, only gets the fourth place, far behind the other three versions. And PHP 5.6, the stable version released at the end of August 2014, is pretty much invisible on this chart, with a really small 0.2% of all identified versions.

With more than 2/3 of all servers running versions of PHP that are no longer officially maintained², I’m coming back to what I say each time I take a look at those numbers: recent versions of PHP really are not adopted fast enough and too many servers aren’t updated often enough!

Patch versions of PHP

Finally, if we take a look at patch versions of PHP 5.x, only displaying in this list the versions that are used the most³, we get the following data:

• Pour PHP 5.0: the most used version is 5.0.4, with 0.06%.
• Pour PHP 5.1: PHP 5.1.6 gets the first place, at 1.40%.
• Pour PHP 5.2: here are versions with more than 0.5%:
• 5.2.4: 16,109 – 0.65%
• 5.2.5: 12,966 – 0.52%
• 5.2.6: 58,772 – 2.38%
• 5.2.9: 24,504 – 0.99%
• 5.2.10: 19,529 – 0.79%
• 5.2.13: 16,225 – 0.66%
• 5.2.14: 15,734 – 0.64%
• 5.2.17: 376,304 – 15.23%
• Pour PHP 5.3: here too, versions with more than 0.5%:
• 5.3.2: 36,505 – 1.48%
• 5.3.3: 249,448 – 10.10%
• 5.3.6: 16,333 – 0.66%
• 5.3.8: 30,140 – 1.22%
• 5.3.10: 108,865 – 4.41%
• 5.3.13: 33,579 – 1.36%
• 5.3.15: 12,839 – 0.52%
• 5.3.23: 16,950 – 0.69%
• 5.3.26: 28,704 – 1.16%
• 5.3.27: 91,395 – 3.70%
• 5.3.28: 210,465 – 8.52%
• 5.3.29: 195,469 – 7.91%
• Pour PHP 5.4: here are versions at more that 0.5% (and the last released version):
• 5.4.4: 82,126 – 3.32%
• 5.4.23: 13,759 – 0.56%
• 5.4.24: 13,475 – 0.55%
• 5.4.25: 13,650 – 0.55%
• 5.4.26: 17,978 – 0.73%
• 5.4.27: 24,689 – 1.00%
• 5.4.28: 20,568 – 0.83%
• 5.4.29: 27,846 – 1.13%
• 5.4.30: 43,200 – 1.75%
• 5.4.31: 66,772 – 2.70%
• 5.4.32: 104,195 – 4.22%
• 5.4.33: 77,474 – 3.14%
• 5.4.34: 2,023 – 0.08%
• Pour PHP 5.5:
• 5.5.0: 953 – 0.04%
• 5.5.1: 691 – 0.03%
• 5.5.2: 309 – 0.01%
• 5.5.3: 7,059 – 0.29%
• 5.5.4: 1,005 – 0.04%
• 5.5.5: 913 – 0.04%
• 5.5.6: 1,561 – 0.06%
• 5.5.7: 1,710 – 0.07%
• 5.5.8: 1,374 – 0.06%
• 5.5.9: 31,366 – 1.27%
• 5.5.10: 2,287 – 0.09%
• 5.5.11: 2,969 – 0.12%
• 5.5.12: 3,031 – 0.12%
• 5.5.13: 3,059 – 0.12%
• 5.5.14: 5,117 – 0.21%
• 5.5.15: 5,343 – 0.22%
• 5.5.16: 23,864 – 0.97%
• 5.5.17: 19,893 – 0.81%
• 5.5.18: 1,054 – 0.04%
• Et pour PHP 5.6:
• 5.6.0: 2,743 – 0.11%
• 5.6.1: 1,026 – 0.04%
• 5.6.2: 692 – 0.03%

As a chart presenting all 5.x.y versions at more than 0.5% or with a version number greater than 5.4.0⁴, we’d get:

Looking at this chart and the corresponding data, a few versions seem used more than the others:

• PHP 5.1.6 (released in August 2006) is still here, probably because it was the version available for some entreprise (or derived) distributions (Redhat Entreprise, or CentOS 5).
• For PHP 5.2:
  • PHP 5.2.17 (released in January 2011) is still the most used patch version of PHP, even considering all minor versions, with 15.23%.
  • PHP 5.2.6 (released in May 2008) comes on second place amongst 5.2.x versions. It was the default version of Debian Lenny and is still at 2.38%.
• For PHP 5.3:
  • PHP 5.3.3 is the most used 5.3 version, with 10.10%. It’s the version of Debian Squeeze or CentOS 6.
  • PHP 5.3.10 came down from 7.2% to 4.41% in the last year: it was the default version of Ubuntu Precise (12.04LTS).
  • The three most recent versions of PHP 5.3 come after that, at 3.70% for PHP 5.3.27, 8.52% for PHP 5.3.28 and 7.91% for PHP 5.3.29 – updates to these versions probably correspond to hosting services that tend to use the most recent patch version available, but don’t want to update to the next (and maintained) minor version.
• For PHP 5.4:
  • PHP 5.4.4 is number two for the 5.4 branch, with 3.32%. It’s the version of PHP of Debian Wheezy.
  • The last four releases of 5.4 are at 2.70% for PHP 5.4.31, 4.22% for PHP 5.4.32 and 3.14% for PHP 5.4.33 – PHP 5.4.34, which has been released only a few days ago, is for now only at a pretty shy 0.08%.
• For PHP 5.5:
  • 5.5.3 is at 0.29%. It’s the default version of Ubuntu Saucy (13.10).
  • The first place, for the 5.5 branch, goes to 5.5.9 with its 1.27%: it’s the version used by Ubuntu Trusty (14.04LTS)
  • The most recent versions are at 0.97% for PHP 5.5.16, 0.81% for PHP 5.5.17 and 0.04% for PHP 5.5.18.
• PHP 5.6 makes a shy debut here, with 0.11% for PHP 5.6.0, 0.04% for PHP 5.6.1 and 0.03% for PHP 5.6.2.

It’s nice to see that, for each minor version, the most recent releases are, in general, the ones used the most – even if many servers keep using the default versions provided by their distributions (which, for some, backport security fixes of later versions, without changing the version number of PHP).

Evolution

I will not try to write a long analysis of “why” those numbers are what they are: it’s up to you, if you want to comment on the fact that old and obsolete versions are still used and that updates are not applied often enough…

That being said, as this is not the first time I do this kind of collection of data about installed PHP versions, I thought it might be interesting to draw a chart showing the evolution of these versions. As a consequence, the following chart presents the evolution of all minor versions of PHP, since September 2011⁵:

PHP 5.5 and PHP 5.6, the current stable releases of PHP, are barely visible on this chart… It’s up to us to ensure this changes!

Method and amounts of data

To finish this post, here are a few notes about the way I got the data presented here:

• I started with a list of more than 12 million domain names (from Alexa’s top 1M, wikipedia dumps, …).
• Of those 12M domains, 10.4M have been resolved to IP addresses – the remaining 1.6M were probably too old and not valid anymore.
• Amongst the 10.4 millions of HTTP requests I’ve done, around 25% of all responses have been identified as generated by PHP. More precisely, I’ve identified 2,578,278 responses as corresponding to some kind of PHP.

With this relatively high amount of data, statistics presented earlier should be quite correct, or, at least, give results and numbers close to reality…

The informations about software and PHP versions have been obtained from the X-Powered-By and Server headers of HTTP responses, after a HEAD request, for each one of the 10.4M domains, on domain.tld, with a fallback on www.domain.tld in case the first one failed.

If you want more informations, you can take a look at the two long comments – in French – I posted a while back, to answer to a few questions that had been asked to me: the first one, and the second one.

And, you, are you using an up-to-date version of PHP?