Hacker News Reader

Comment by phillipseamore | Hacker News Reader

That looks like bullshit, they don't say anything about their detection methods but looking for X-Powered headers is the only likely one. Modern installations simply don't expose that header anymore.

View on HN

They talk about detection methods a little in their FAQ:

https://w3techs.com/faq

PHP probably gets a lot of extra hits in places it might not be used a whole lot. For a long time web host providers had it pre-installed by default. Plus wordpress is used a lot and they can detect that from the admin/edit page.

How does Wordpress know it's powering 40% of all sites in the world? Where does it get the stats

I'm not for sure about how wordpress would get their stats, but I imagine it's something like scan the internet and put "/wp-admin" behind the base url. If it comes back with the wordpress login page, then count it. At least that's how it seems like hackers find out if you have wordpress from my http server logs.

Also someone posted this thing a while back that does some detection like this to find out what tech is powering the website you are on:

https://www.wappalyzer.com/

I'm not related to them in any way and I don't know how accurate it is but it was interesting.

WordPress is pretty easy to detect even when wp-admin is hidden. People seem to not know theres a json api that exposes a lot of information. It's a good idea to disable showing authors since this can give an attacker information they can use to exploit in a few different ways. We had to do this for a high profile client a while back and wrote a little helpful plugin

I bet they are undercounting a bit since the large content sites will keep their WordPress install outside of public view completely and the site is just headless.

[0] https://github.com/firstandthird/wp-disable-authors

If you count all VPS'es and sites on shared hosting you'll se a large jump to PHP 8 when CentOS 7 goes EoL. Lots of people just use whatever version comes with the OS.

What would you recommend as a better source?

There's no good source on back end tech market share. The simple truth is that there's no way to know what a server is running unless the server lets you know.

I'd say instead that there's no guaranteed way. There are likely markers though. For example if you navigate the website and get a cookie set with name "..._laravel", you can safely assume it's a PHP app for stats purposes. There are also more subtle things like the format of csrf, format of error responses, behaviour for weird data passed in (especially name[]=value), etc.

PHPSESSID :)

only if the site started a session

Indeed, but that's not really a good source to estimate market share as there will be a strong bias towards stacks that are more conspicuous.

There simply isn't any source. Headers can be removed or they can be modified to say a site is using X when it really uses Y. Any other detections have just as many problems, having files ending in php doesn't mean they are php, even a site that has something like phpversion.php could be just a saved HTML copy.

The biggest PHP users on the linked list don't even expose that they use PHP, but it is publicly known (though Facebook uses [or used] their own fork of PHP called HHVM).

There isn't one. PHP stopped sending X-Powered-By by default years ago.

A more reliable source would be a well-conducted survey. Or, honestly, having worked for one of the big shared hosting providers, by the numbers small sites outnumber big sites to a staggering degree. One could get a pretty representative sample of overall share by asking the huge providers what appears to run the sites hosted on their services by percentage.

I have no particular reason to doubt more than half of sites are run by PHP considering the portion of sites that are WordPress. However, I also have no particular reason to trust that 77% is an accurate proportion.

Reply on news.ycombinator.com