Live · , data updated 23 October 2026, 6:21 pm NZDT

Hosting

Hosting stacks, hosts and CDNs

What the response headers tell us about where each tracked New Zealand site is hosted, and whether its host could have fixed PHP without changing the version number. The CDN section at the end uses the census figures for both countries.

NZ tracker · Hosting stacks

Could the host have fixed it without changing the number?

At the tracker’s check on 23 October 2026, 6:17 to 6:21 pm NZDT, 79.5% of the 17,611 New Zealand sites showing a PHP version were not visibly patched. The true unpatched share is likely lower, and it can’t be measured from outside. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes without changing the version number. Plesk (on Linux) and CloudLinux say they have released fixed builds of PHP 7.4, 8.0 and 8.1 that keep the old version number (Plesk, CloudLinux). The response headers give a clue about the hosting stack, and the stack tells us where a hidden fix is possible.

Hosting stack signal in each version group

  • Plesk
  • Hostinger hPanel
  • LiteSpeed
  • Linux distribution build
  • Other
  • Unknown

PHP 7.3 or older2,455 sites

PHP 7.43,216 sites

PHP 8.0420 sites

PHP 8.11,317 sites

PHP 8.2+, version doesn’t show the fix6,600 sites

Visibly patched3,603 sites

View as table
Hosting stack signal by PHP version group
Version groupPleskHostinger hPanelLiteSpeedLinux distribution buildOtherUnknownSites
PHP 7.3 or older15.7% (385)1.6% (40)17.5% (430)10.6% (260)1.7% (42)52.9% (1,298)2,455
PHP 7.413.1% (421)8.5% (272)26.8% (861)1.2% (39)0.5% (16)50.0% (1,607)3,216
PHP 8.021.7% (91)14.5% (61)22.9% (96)1.9% (8)0.2% (1)38.8% (163)420
PHP 8.118.0% (237)34.1% (449)22.6% (298)1.2% (16)0.2% (3)23.8% (314)1,317
PHP 8.2+, version doesn’t show the fix2.7% (176)34.4% (2,268)21.7% (1,435)0.6% (39)0.2% (14)40.4% (2,668)6,600
Visibly patched42.9% (1,544)0.2% (7)24.9% (898)1.9% (70)1.2% (45)28.8% (1,039)3,603
Each bar is 100% of the tracked sites in that version group. The stack comes from the same response headers as the PHP version. LiteSpeed is a web server that is typical of cPanel and CloudLinux shared hosting, but it isn’t proof of either. Hover or tab to a segment for the count.
  • Some stacks can hide a backport. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, can ship a fixed PHP build that still reports the old number. On those stacks an old number may already be patched.
  • cPanel doesn’t show itself. cPanel servers don’t name the panel in their headers, so we can’t count them from outside. Many run the LiteSpeed web server, which is the nearest clue we have.
  • On PHP 8.2 or newer, the number can mislead too. The fix for these versions is a normal new release, and many stacks install it with a new number. Some don’t: CloudLinux builds and Red Hat and AlmaLinux packages can carry the fix on 8.2 and newer while keeping the old number. So an older 8.2 or 8.3 number may also be fixed, and we count LiteSpeed stacks on these versions as plausible.
  • On PHP 8.1 or older, the number tells you less. There is no new PHP release for these versions. The PHP project published the fix for 7.4, 8.0 and 8.1 as source code only, so a fix arrives as a host’s or vendor’s build that keeps the old number. Of the 7,408 sites on 8.1 or older, 3,969 (53.6%) run on a stack that could have backported it.

Could the host have fixed it without changing the number?

  • Strong
  • Plausible
  • Usually renumbers (not verified)
  • Unknown

PHP 7.3 or older2,455 sites

PHP 7.43,216 sites

PHP 8.0420 sites

PHP 8.11,317 sites

PHP 8.2+, version doesn’t show the fix6,600 sites

View as table
Could the host have fixed it without changing the number, by PHP version group
Version groupStrongPlausibleUsually renumbers (not verified)UnknownSites
PHP 7.3 or older7.9% (194)37.7% (926)1.5% (37)52.9% (1,298)2,455
PHP 7.40.0% (0)49.5% (1,593)0.5% (16)50.0% (1,607)3,216
PHP 8.00.0% (0)61.0% (256)0.2% (1)38.8% (163)420
PHP 8.10.3% (4)75.6% (996)0.2% (3)23.8% (314)1,317
PHP 8.2+, version doesn’t show the fix0.0% (0)22.3% (1,474)2.7% (176)75.0% (4,950)6,600
Strong: the version string itself is a Linux distribution package. Plausible: a stack whose vendor can patch PHP without changing the number. On 8.2 and newer this means LiteSpeed (typical of CloudLinux shared hosting, where CloudLinux keeps the old number up to 8.5) or a Linux distribution named in the server header. Usually renumbers (not verified): a stack that usually installs new PHP releases with a new number, mainly Plesk on 8.2 and newer. We haven’t verified this. Unknown: no stack signal in the headers, or Hostinger on 8.2 and newer, because we couldn’t check whether it keeps the old number when it patches. “Plausible” means possible, not confirmed: only the host can say whether the fix is installed. Visibly patched sites aren’t shown.

NZ tracker · Where these sites are hosted

Where these sites are hosted

The 15 hosts and networks with the most tracked PHP sites, in order of size. The order isn’t a ranking of how well they patch. Every host with fewer than 50 sites is in “Other”.

Tracked PHP sites by host or network, at the check on 23 October 2026, 6:17 to 6:21 pm NZDT

  • PHP 8.1 or older
  • 8.2+, version doesn’t show the fix
  • Visibly patched

Crazy Domains/Dreamscape2,835 PHP sites

Hostinger2,634 PHP sites

Behind Cloudflare (origin host hidden)2,407 PHP sites

Voyager NZ1,386 PHP sites

SiteHost825 PHP sites

AWS734 PHP sites

Synergy Wholesale (AU)730 PHP sites

WHG (Web Hosting Group)437 PHP sites

GoDaddy416 PHP sites

Instra376 PHP sites

2degrees/Vocus NZ319 PHP sites

A2 Hosting313 PHP sites

HostPapa262 PHP sites

Vetta Online NZ194 PHP sites

OVH182 PHP sites

Other hosts and networks (294 hosts and networks)3,561 PHP sites

View as table
Where the tracked PHP sites are hosted, by number of PHP sites
Host or networkPHP sitesVisibly patched8.2+, version doesn’t show the fixPHP 8.1 or olderMain stack signal
Crazy Domains/Dreamscape2,8352.5%59.8%37.7%No stack signal (93.2%)
Hostinger2,6340.3%72.1%27.6%Hostinger hPanel (99.9%)
Behind Cloudflare (origin host hidden)2,40728.9%30.7%40.5%No stack signal (43.7%)
Voyager NZ1,38640.4%16.2%43.4%Plesk (80.4%)
SiteHost82529.6%9.7%60.7%No stack signal (47.6%)
AWS73429.2%18.7%52.2%No stack signal (31.5%)
Synergy Wholesale (AU)73020.1%33.7%46.2%LiteSpeed (98.8%)
WHG (Web Hosting Group)4379.4%48.3%42.3%LiteSpeed (91.5%)
GoDaddy41647.8%0.2%51.9%No stack signal (97.1%)
Instra3760.0%22.9%77.1%LiteSpeed (100.0%)
2degrees/Vocus NZ31957.4%9.1%33.5%No stack signal (45.5%)
A2 Hosting3131.3%54.6%44.1%LiteSpeed (74.8%)
HostPapa2622.3%76.7%21.0%No stack signal (99.2%)
Vetta Online NZ1940.0%43.8%56.2%No stack signal (71.1%)
OVH18233.5%23.1%43.4%LiteSpeed (44.0%)
Other hosts and networks (294 hosts and networks)3,56132.9%21.2%46.0%No stack signal (41.7%)
Each bar is 100% of that host’s tracked sites that showed a PHP version. The table also shows the most common stack signal. “Behind Cloudflare” means the site’s address belongs to Cloudflare, so the real host is hidden.
  • The site owner picks the version, the host patches it. On shared hosting the site owner usually chooses the PHP version in the control panel, and the host controls whether that version gets fixes.
  • An old number at a host that backports may be fixed. Hosting platforms such as cPanel, Plesk and CloudLinux, and Linux distributions, commonly ship backported fixes without changing the version number, on PHP 8.2 and newer as well as older versions. A high share of sites below the fix at a host doesn’t mean those sites are unpatched.
  • The host is a network label. We matched each site’s address to the network that owned it at the site’s latest census check (22 October 2026, 8:53 am to 12:41 pm NZDT). The tracker’s own first point was taken at 10:37 am NZDT, before the census’s retry passes finished. That says where the server sat, not who manages it, and it isn’t a statement from the host. A site may have moved since.
  • Aggregates only. We name hosting networks, never individual websites or their owners. The data is in hosting.json.

Census · CDN and server

32.0% of New Zealand sites and 27.5% of Australian sites answer through Cloudflare

In the census of each country’s .co.nz or .com.au list (22 October in New Zealand, 22 to 23 October in Australia, NZ time), what answered our request: a CDN in front, or the web server software itself. A CDN or firewall can hide the PHP version and block some attacks, but it isn’t a fix. The server behind it still runs PHP and still needs the fix: the new release or the host’s backport.

  • New Zealand
  • Australia
% of sites that answered (NZ 253,113, AU 1,254,985), by the CDN or server software named in the response. “Other servers” groups every less common server name.
View as table
CDN or server software, census, by country
CDN or serverNew ZealandAustralia
Cloudflare32.0% (81,016)27.5% (345,639)
nginx (origin)20.2% (51,117)12.9% (162,221)
LiteSpeed (origin)4.7% (11,808)15.9% (199,672)
Apache (origin)12.9% (32,584)13.6% (171,103)
Other servers8.7% (22,095)8.2% (102,882)
Unknown7.3% (18,501)8.7% (109,171)
Squarespace7.0% (17,837)6.4% (79,716)