Hacker News Reader

Comment by clone1018 | Hacker News Reader

I wonder how much the results of this are skewed because PHP reports via the server response header that it is being used. Other languages like Elixir, Go, etc aren't so public about their usage unless one of their web frameworks adds it.

I'd also love to see a study like this instead focused on "How much of the active web is wordpress?" and "How much of the inactive web is wordpress?".

View on HN

Still, you can use it to gauge PHP to non-PHP. And there is an unknown percentage of PHP sites which turn this header off.

Your second sentence is why the first is unreliable: in particular, advertising server software and versions will get you flagged by most security auditors so the PHP sites which don't advertise will often be the largest and/or most interesting — for example, neither Etsy nor Wikipedia advertise that header.

Still, if you change "78%" to "at least 78%", it's impressive nonetheless.

Do you think that's “at least 78% of all sites” or “at least 78% of sites which advertise what they're built with”? The latter case seems more likely and that will distort the numbers massively.

When I heard that question several years ago in the sense why haven't Java/C# replaced PHP the answer was simple: nearly every web host offered a pre-configured web stack with PHP, MYSQL, etc. and setting up anything else was neither cheap nor easy . Seems to be nearly the same today, the first few dozen hosting providers I can find on Google either have WordPress or a one click WordPress install.

The report looks at multiple variables, not only response headers, to figure out backend language.

Can you provide a source with information on what those variables are exactly?

It's a very common config change these days to turn off expose_php (stop reporting by X-Powered-By header that PHP is installed on the server). You'll see this suggestion across nearly all forums related to PHP. That has been true for a decade or more at this point.

It's not just PHP, turning off X-Powered-By (or similar) is part of any server hardening standard for any language I've ever seen (and implemented).

Reply on news.ycombinator.com