PHP 5.x - the old (here) place

The hosting industry is inextricably linked with PHP, which is fully or partially written over 80% of siteson the Internet. This greatly affects the development of any software designed to work with hosting - including such as the Plesk control panel. We are making a product for automating server management, creating and configuring websites and applications, and therefore for using PHP. One of our key tasks is the need to support already outdated versions of PHP - the hosting services industry, like any major market, is rather inert, and the transition to the new PHP is extremely slow. Despite the fact that Plesk provides users with the latest versions of PHP within 48 hours after their release, millions of sites continue to work on older versions, so the demand for solutions that can provide their support remains high. For this reason, Plesk continues to support EOLed brunches up to and including PHP 5.2.

At the same time, we are aware that the risk of using outdated versions of PHP is not only poor performance and poor functionality, but also potential vulnerabilities that can arise at any time and cost the site owner very expensive. If you do not push your customers to upgrade to at least PHP 5.6, then in the event of a vulnerability, for example, in PHP 5.2, it may be followed by hacking of thousands of sites and accusations of using unsafe software. Therefore, starting with the new version of Plesk Onyx 17.8, which was released in early March 2018, outdated versions of PHP are marked in the interface as Outdated.


We decided that you can completely stop supporting old PHP only by making sure that the percentage of sites working on it is negligible - in this case, this step will not cause frustration among an arbitrarily significant part of the user audience. To this end, we conducted a statistical study designed to determine which versions of PHP are most popular among Plesk users. We want to share his results, which, in our opinion, are very interesting.

We started analyzing the information on which PHP the sites of our clients work on relatively recently. It is collected for the last two releases of Plesk Onyx and covers about 15% of sites running on these versions of Plesk. The statistics did not include older versions of Plesk, where perhaps the older PHP is used, but this does not seem to us a big problem. The information gathered about the preferences of people using the latest versions of Plesk (which means that they are the most loyal to the product part of the audience) is extremely indicative in itself. We cannot force those who use unsupported versions of the product on unsupported axes to update - moreover, in their situation, the old PHP is most likely not the biggest trouble. Sooner or later, these users will switch to new versions of Plesk, and then their sites will be available for our analytics.

Currently, the latest versions of PHP are versions 7.1 and 7.2. They are actively supported by the manufacturer, which means regular updates with bug fixes and fixes for detected vulnerabilities. Versions 5.6 and 7.0 are marked by the vendor as security fixes only - only critical security problems are fixed. Finally, PHP 5.4 and 5.5 have not been supported in any form since 2016, their users are advised to switch to more recent versions as soon as possible in order to avoid possible problems with site security. Let's see how these recommendations are followed and what users are more afraid of - updating PHP or becoming a victim of another vulnerability.

The ratio of PHP versions for all sites running on the Plesk sampled at the beginning of March 2018 looked like this:


As you can see, in general, things are not brilliant - the versions recommended by the vendor did not get into the top - moreover, they generally ended up in the tail. The next logical question is: how much does this picture differ from country to country? The largest countries where Plesk is traditionally high are Germany, the USA and Spain. Let's start with them.

Germany

Germany is in no hurry with updating PHP - the top three leaders in this country are PHP 5.5 (33% of sites), PHP 5.6 (24%) and PHP 7.0 (13%). Only 8% of sites work on recommended versions 7.1 and 7.2.

USA

The United States at first glance may seem even more conservative. PHP 5.4 came in first place (28%), but PHP 5.6 breathes in the back, its comparative share is higher than in Germany - 27%. Interestingly, the most popular in Germany version 5.5 in the USA is used only on 7% of sites.

Spain

In Spain, everything is somewhat more energetic: 36% of sites run on PHP 5.6 - not the latest, but at least the supported version. PHP 5.4 (22%) is in second place, third is traditionally behind version 7.0 (14%).


It is curious that in each of these three countries, the first place in the popularity ranking belonged to different versions. This led us to compile a summary table, where each country in the sample corresponds to the most popular version of PHP in it. Results in front of you:

Country	Most popular PHP version
Australia	5.6
Austria	5.6
Belarus	5.6
Brazil	5.6
Canada	5.6
China	4.4
Czech Republic	5.6
Denmark	7.0
Estonia	5.6
Finland	5.3
France	5.6
Germany	5.5
Great britain	5.6
Greece	5.3
India	5.4
Iran	5.6
Italy	5.6
Japan	5.3
Kazakhstan	5.5
Korea	7.0
Latvia	5.4
Lithuania	7.1
Mexico	5.4
Netherlands	5.6
Norway	5.6
Poland	5.6
Romania	5.6
Russia	5.4
Spain	5.6
Sweden	5.6
Turkey	5.4
Ukraine	5.4
United states	5.4

Lithuania won the nomination "The most advanced country" - most of the sites (38%) work on version 7.1! PHP 7.1 has not yet been able to repeat its success elsewhere - in all other countries, neither version 7.1 nor version 7.2 has risen above 4 places.

Next in the “advancement” rating are South Korea and Denmark, where the most popular version of PHP is 7.0 (51% and 34% respectively). This version of PHP was in second place in the Netherlands (19%), Austria (17%) and the Czech Republic (13%), second only to PHP 5.6 (by the way, as many as 65% of websites work in 5.6 in the Czech Republic).

What is going on in Russia? Alas, outdated and insecure PHP is a reality in our country. Championship with a wide margin for PHP 5.4 (45%), a similar situation with Ukrainian sites (24%), but Belarus turned out to be more modern - in the first place PHP 5.6 (40%). In Kazakhstan, PHP 5.5 takes the first place (32%).


Things are even worse in Japan and Greece - PHP 5.3 leads the way (30% and 37% of all sites, respectively). But China turned out to be the most conservative: 44% of sites here work on PHP 4.4! This we have not seen in any other country.


In total, 77% of sites operate on outdated PHP versions in China. By this indicator, only Mexico is ahead of it - 78%. Russia is in third place (67% of sites), with Kazakhstan (65%) and Japan (63%) closing the top 5 fans of the old PHP.

The ranking of the most conscious countries with the largest share of sites in fresh PHP (5.6 and newer) is headed by South Korea - 85% of sites. The Czech Republic is second (84%), Sweden is third (83%), further the gap begins to grow - Iran is fourth (73%), Denmark is fifth (69%).

The above statistics clearly indicate that it is too early to talk about phasing out support for versions of PHP older than 5.6 - and not only in Russia. At the same time, as mentioned at the beginning of the article, it is definitely worthwhile to gently push people in this direction. For its part, Plesk is trying to make the transition to the new PHP as comfortable and painless as possible. By warning of obsolete PHP, we do the following:

• take into account in the default settings which PHP is supplied by the operating system vendor;
• if the OS manufacturer does not provide the latest version of PHP, we complement the set of PHP handlers and provide a complete set, including old and new versions;
• on new installations we offer current versions of PHP (but do not automatically switch to them when upgrading from older versions of Plesk, so as not to break working sites).

These steps are already beginning to bear fruit - in the month that this article was written, PHP 7.0 came out in third place in the general sample for all countries, displacing PHP 5.5 from the top three. This means that we are going in the right direction - we hope that everyone else will move towards a safe web'a with us. If you have reasons why you prefer the old PHP to the new, please share them in the comments.