Defaults.Exposed › Reports

End-of-Life Software Census: 6.6 Million Servers Admit It

Published 2026-08-18

Figures as of 16 August 2026 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade or name an individual registrant’s domain.

How much end-of-life software does the web admit to?

At least 6.6 million web servers announce end-of-life software in their own HTTP response headers. Not software we fingerprinted, guessed at, or inferred from behaviour. Software the server names about itself, version and all, in plain text, on every response it sends.

That figure is a floor, twice over. It comes from the top version strings only (the long tail is invisible to this cut), and it counts only software whose vendor has publicly, unambiguously ended support. The real number is larger.

The bulk of it is PHP. Among the 22,957,264 domains that send an X-Powered-By header, 5,966,473 name a PHP branch that no longer receives security fixes. That is 26.0% of everyone who sends the header at all. Narrow it to the domains whose banner names a PHP version, and 46% are on a dead branch. Flip a coin.

Key numbers

• 6,635,647 end-of-life software banners counted across Server and X-Powered-By headers on 376,928,781 responding domains — a floor, from top version strings only.
• 5,966,473 domains announce an end-of-life PHP branch via X-Powered-By — 26.0% of the 22,957,264 domains that send the header.
• PHP 7.4 alone accounts for 2,357,981 banners (39.5% of all end-of-life PHP), 3.7 years after its final security release (November 2022, vendor date).
• 463,374 domains announce an end-of-life Microsoft IIS version, including 20,954 still running IIS 6.0 — the Windows Server 2003 release, out of support since July 2015.
• 55,432 domains report PHP 5.2.17, a build last patched in January 2011 — more than 15 years ago.
• 76,047 domains identify as Sun ONE Web Server 6.1, a product line from the early 2000s whose original vendor no longer exists.
• 994,515 domains announce nginx/1.18.0 on Ubuntu — a version tied to Ubuntu 20.04, which reached end of life in April 2025.

Where these numbers come from

Two headers, one census. During the August 2026 round we captured the primary HTTPS response for each of 376,928,781 graded domains. 191,715,808 of them (50.9%) sent a Server header; 22,957,264 (6.1%) sent X-Powered-By. We then took the top 200 full Server strings and the top 60 X-Powered-By values and mapped each versioned string against public vendor end-of-support dates.

Two things follow from that design, and both push the count down, not up. Anything outside those top lists is uncounted, and anything that hides its version is unclassifiable. A server that says only nginx might be running a build from 2014; it contributes nothing to our total. The 6.6 million are just the ones that confess.

One honesty note on the arithmetic: the two headers travel on the same response, so a domain announcing dead PHP in X-Powered-By and dead Apache in Server appears in both components. 6.6 million is a count of end-of-life banners, not of distinct domains. Each component on its own — 5.97 million for PHP, 669 thousand for server products — is a clean domain-count floor for that header.

Which dead PHP versions still run the web?

Every PHP branch up to and including 8.1 was out of security support by 16 August 2026 (8.1’s support ended 31 December 2025 — vendor dates throughout this table are industry knowledge, not census data). Here is what the census found still announcing itself:

Counts are from the top-60 X-Powered-By values (rc basis, one primary response per graded domain); branch totals include suffix variants such as Plesk-tagged strings. Longer-tail versions exist below the cut and are not counted.

Read the table top to bottom and you are reading a decay curve. PHP 7.4 is the web’s largest single piece of announced dead software: 2.36 million domains, 39.5% of the end-of-life PHP total, almost four years after its last patch. It was the final PHP 7, it ran an enormous share of the WordPress era, and a lot of hosting simply stopped there.

The 8.1 row deserves a different reading. Those 1.3 million domains were fully supported seven months before our capture date. That is the conveyor belt in action: nobody migrated onto a dead branch, the branch died underneath them. On current vendor timelines, PHP 8.2 joins the dead list at the end of 2026, and its 2026 census footprint is north of two million banners. Next year’s edition of this table will likely be worse before it is better.

At the other end sits PHP 5.2.17: 55,432 domains announcing a build whose final release shipped in January 2011. A domain registered the day that patch came out would be old enough for secondary school. Add the whole PHP 5 family and 639,937 domains are running a major version that predates most of its operators’ current staff.

What about the servers themselves?

PHP is the loud one, but the Server header carries its own graveyard. Restricting to products with unambiguous public end-of-support dates:

(Windows Server 2012 and 2012 R2 had a paid Extended Security Update programme running to October 2026, so some of those IIS 8.x boxes may still have been receiving purchased patches at capture time. IIS 7.5 and 6.0 have no such asterisk.)

The nginx/1.18.0 entry is the largest single server-product cohort this census round. That version shipped with Ubuntu 20.04, whose standard support ended April 2025. Nearly a million domains are running it — meaning both the underlying OS and the nginx package are outside their support window. These are not simply old nginx builds: the Ubuntu 20.04 pairing identifies entire system stacks that stopped receiving OS security patches more than a year ago.

The Apache 2.2 rows are quietly the most dated: the visible strings map to CentOS 5 and 6 and Ubuntu 12.04-era systems — full operating system stacks frozen somewhere between 2012 and 2018. And Sun ONE 6.1 is a genuine fossil. It shipped when Sun Microsystems still existed; 76,047 domains report it by name today. Whether that string reflects the true binary or a proxy that never updated its banner, someone configured it and nobody has looked since.

Some version strings are archaeology in a single line. The census’s top-200 list includes 61,965 domains announcing Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.30 — one header, three end-of-life products (CentOS 7, OpenSSL 1.0.2, PHP 7.0, all past vendor support). Another 39,346 pair that same stack with PHP 5.4.16. These servers are not just old. They are time capsules, sealed and still serving traffic.

Does an old version number mean the server is hackable?

Not automatically, and this caveat is load-bearing: a header is a claim, not a verified runtime. Three things blunt the reading.

Backporting is the big one. Debian, Ubuntu and Red Hat routinely freeze a version number and keep patching the code behind it, so Apache/2.4.41 (Ubuntu) can be fully patched despite the 2019-era number. This is why our end-of-life table only counts branches the upstream vendor has ended — an OS vendor can backport a fix into a supported branch’s old build, but nobody is backporting anything into PHP 5.2 or IIS 6.0. For those, the branch itself is the finding. Even then, a third-party firm can in principle sell extended patches for a dead branch; a header cannot tell you whether anyone is paying for that.

Second, headers can lie in both directions. Proxies rewrite them, ancient banners sometimes front rewritten stacks, and a cloudflare or bare nginx banner can conceal something far worse than anything in our tables. Header data undercounts the old and occasionally mislabels the current.

Third, exposure is not exploitation. A dead PHP branch behind a static brochure site with no forms and no CMS is a smaller problem than the same branch under an unpatched WordPress install. The census measures announced posture, not incidents.

What the header does establish is cheap reconnaissance. An attacker scanning for targets reads the same 6.6 million banners we did, at the same near-zero cost, and version-matched exploits are the lowest-effort attacks that exist. Which raises the obvious question.

Why are servers announcing this at all?

Neither header does anything for visitors. X-Powered-By in particular is pure disclosure — a default that PHP and some frameworks emit unless someone turns it off, which is why security guidance has recommended removing it for years, and why only 6.1% of the responding web still sends it. The interesting cohort is that 6.1%: they are disproportionately stacks where nobody has touched the defaults, which is exactly the population least likely to be patching. The header selects for the problem it reveals. Our end-of-life percentages are measured on the self-announcing population and should not be extrapolated to the silent majority — the silent population is probably better-tended, though we cannot measure by how much.

Headers also leak more than versions. Sixteen of the census’s top-200 Server strings are AWS internal hostnames of the form ip-100-74-x-x.eu-west-2.compute.internal — a mass-hosting operation stamping its private EC2 machine names onto roughly 5.04 million domains’ responses. That leaks nothing about the domains’ owners, but it is a tidy demonstration of the theme: response headers say whatever the operator forgot to stop them saying.

Turning the banners off is a one-line change in every major server and language (expose_php = Off, ServerTokens Prod, and equivalents). It does not fix the underlying software, but it stops donating the target list. The actual fix — moving off the dead branch — is where the real cost lives, and for the PHP 7.4 cohort that usually means testing an application against PHP 8, not clicking a button. That migration debt, multiplied by 5.97 million domains, is what this table is really measuring.

How we measured this

• Population: 376,928,781 graded domains from the August 2026 census round (figures as of 16 August 2026, methodology v9); one primary HTTPS response captured per domain.
• Header coverage: 191,715,808 responses carried a Server header (50.9%); 22,957,264 carried X-Powered-By (6.1%). All percentages state their denominator inline.
• Cut: top 200 full lowercased Server strings and top 60 X-Powered-By values, matched against public vendor end-of-support dates. All end-of-life dates (PHP branch dates, Microsoft/Apache support windows, product discontinuations) are industry knowledge, not census data, and are labelled as vendor dates where they appear.
• Floors, not totals: version strings below the top-list cutoffs are uncounted, and versionless banners (nginx, cloudflare, apache) are unclassifiable. Every end-of-life count here is a minimum.
• Banner counts vs domain counts: the 6,635,647 headline sums two headers that can co-occur on one response; it is a count of end-of-life announcements. The per-header components (5,966,473 PHP; 669,174 server products) are each domain-count floors on their own basis.
• Header claims ≠ verified runtime. We did not fingerprint binaries or test exploits. Distribution backporting, paid extended-support programmes, proxy rewriting and stale banners all mean an individual header can misstate the software behind it, in either direction. We count what servers announce.
• Vantage: all captures from our EU measurement infrastructure.
• Aggregate only. We report counts and shares; we never name, grade or publish data about an individual registrant’s domain.
• Data is stored and processed within the EU.

What this means

For IT managers and security teams, the headline figure — 6.6 million end-of-life banners — is a floor on externally visible technical debt, not a ceiling. The census only counted version strings in the top 200 Server and top 60 X-Powered-By values; the long tail is invisible. Any organisation relying on a self-assessment of “we don’t have this problem” needs to verify from the outside, not from memory, because the vast majority of these domains belong to organisations that do not know what their servers are advertising. PHP 7.4 running on 2.36 million domains is not an obscure legacy edge case — it is the mainstream PHP estate, running on hosting packages that were set up during the WordPress boom and never upgraded. If your organisation hosts WordPress sites, runs CMS-driven web properties, or manages customer-facing apps on shared hosting, the odds are non-trivial that at least one of them appears in this table.

For business owners, the practical risk is not theoretical. Version-matched exploits are the lowest-effort attacks available: a scanner finds PHP 7.4, checks a public vulnerability database, and has a target list in minutes. The question is not whether old software is theoretically exploitable — it is whether your domain is making itself easy to find. Every domain sending an X-Powered-By: PHP/7.4.x header is opting into that target list for free. Turning the banner off costs nothing and takes a single configuration line. Moving to a supported PHP version costs more, but for most hosting environments it means a conversation with your host, not a rewrite.

For security teams assessing third-party or supply-chain risk, the server-header data surfaces a proxy for overall security hygiene. The X-Powered-By header is enabled by default and has been recommended for removal since at least the mid-2010s. An organisation that has not turned it off in a decade is unlikely to have a mature patch management programme. The same correlation applies to ServerTokens: a server announcing Apache/2.2.34 (Unix) is not just old, it is a server whose operator has not reviewed its defaults since Obama was in office. Use header disclosure as a first-pass hygiene signal, not as a definitive exploit indicator.

Data to cite

• “At least 6,635,647 end-of-life software banners were counted across Server and X-Powered-By headers on 376,928,781 responding domains in August 2026.” — defaults.exposed August 2026 Domain Security Census (432M domains)

• “5,966,473 domains announce an end-of-life PHP branch via X-Powered-By — 26.0% of the 22,957,264 domains that send the header at all.” — defaults.exposed August 2026 Domain Security Census (432M domains)

• “PHP 7.4 alone accounts for 2,357,981 banners, 39.5% of all end-of-life PHP, nearly four years after its final security release in November 2022.” — defaults.exposed August 2026 Domain Security Census (432M domains)

• “994,515 domains announce nginx/1.18.0 on Ubuntu 20.04 — an OS platform past end of life since April 2025, meaning both the web server and the underlying system are outside their support windows.” — defaults.exposed August 2026 Domain Security Census (432M domains)

• “55,432 domains report PHP 5.2.17, a build last patched in January 2011 — more than 15 years before the August 2026 census capture date.” — defaults.exposed August 2026 Domain Security Census (432M domains)

• “20,954 domains are still running Microsoft IIS 6.0, the Windows Server 2003 release, which exited support in July 2015 — over 11 years before this census round.” — defaults.exposed August 2026 Domain Security Census (432M domains)

FAQ

Is it safe to run PHP 7.4 in 2026? Not on any supported basis. PHP 7.4 received its last security fix in November 2022 (vendor date), so any vulnerability found since ships unfixed unless you buy third-party extended support. The census counted 2,357,981 domains still announcing PHP 7.4 in August 2026 — the largest single end-of-life cohort on the web.

What is the most common end-of-life software on the web? PHP, by a wide margin. Of at least 6.6 million end-of-life banners we counted, 5,966,473 name a dead PHP branch, and one build — PHP 7.4.33 — appears on over 2.2 million domains by itself. The largest non-PHP server cohort is nginx/1.18.0 on Ubuntu 20.04 at 994,515 domains, running on an OS platform past end of life since April 2025.

Does an old version in the Server header mean a site can be hacked? Not by itself. Linux distributions backport security fixes without changing the advertised version, so an old-looking banner on a supported OS branch can be fully patched. The reliable signal is a branch the vendor has ended entirely — nothing is being backported into PHP 5.6 or IIS 6.0. Even then a banner proves exposure to reconnaissance, not a successful attack.

Should I remove the X-Powered-By header? Yes — it serves no function for visitors and hands attackers your stack and version for free. In PHP set expose_php = Off; most frameworks and servers have an equivalent one-liner. Only 6.1% of responding domains still send the header, and 26.0% of those announce an end-of-life PHP branch, which suggests the header mostly survives where defaults go untouched.

When does the next big wave of end-of-life PHP arrive? 31 December 2026, when PHP 8.2 reaches end of security support on the published vendor schedule. The August 2026 census shows well over two million domains announcing PHP 8.2 builds, so on current behaviour the end-of-life PHP population is set to grow substantially in next year’s edition — exactly as the 1.3 million newly-dead PHP 8.1 banners did this year.

What should I do about this? Start with visibility: run an external header check on every domain your organisation owns or manages — not a self-reported inventory, an actual live scan. For any domain sending X-Powered-By, disable it immediately (expose_php = Off in php.ini, or your framework’s equivalent). For any domain on an end-of-life PHP branch or server platform, open a ticket with your host or infrastructure team to schedule a supported version upgrade. Neither fix requires a budget: the header suppression is one config line, and most managed hosting providers can move PHP versions without touching application code.

How does this compare to the July 2026 census? This report covers the August 2026 census round, which measured a substantially larger population than July — 432,127,908 domains scanned versus the prior round, with 376,928,781 graded. PHP 8.1 moved from a live branch to an end-of-life branch between rounds (vendor support ended 31 December 2025), which added 1.3 million newly-dead banners to the end-of-life PHP total. The end-of-life PHP population grew not because operators downgraded but because the vendor timeline caught up with them. Expect the same pattern in the December 2026 round when PHP 8.2 exits support.

Why does this matter for website operators running WordPress or CMS platforms? WordPress runs on PHP, and the PHP 7.4 cohort — 2.36 million domains — tracks almost exactly with the era when managed WordPress hosting was packaged on PHP 7 and left there. If you run a WordPress site on shared or managed hosting that you set up between 2019 and 2022 and have not actively upgraded since, there is a meaningful chance your PHP version is end-of-life. Your hosting control panel will show your PHP version; your host can usually upgrade it in minutes. The risk is not that old PHP immediately breaks your site — it is that unpatched vulnerabilities accumulate silently until a scanner or a real attacker reads your X-Powered-By header and already knows your version.

Check what your own headers admit

Your web server may be announcing its software stack — and its patch status — to anyone who asks. Our census grades real, live domains across externally observable security checks, and most fixes (including silencing these banners) are free and quick; the barrier is almost never cost, it’s that nobody told the owner it mattered.

Check your domain free at defaults.exposed — see exactly what your server headers are advertising and whether your domain appears in any end-of-life software cohort. Takes 30 seconds. No account needed.

Read the PHP-only predecessor report: End-of-Life PHP on the Web →

Related: The HTTP Security Header Report Card · Weak and Outdated TLS · The State of Domain Security 2026

Aggregate data only. Data stored and processed in the EU.

How to cite this report

Press / blog: defaults.exposed (2026). End-of-Life Software Census: 6.6 Million Servers Admit It. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/end-of-life-software-census

Academic: defaults.exposed. (2026, August 18). End-of-Life Software Census: 6.6 Million Servers Admit It. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/end-of-life-software-census

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,781 graded domains)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Aggregate data only. Data stored and processed in the EU.