PHP: Server language detection

What PHP is

PHP is the language underneath WordPress, Drupal, Joomla, Magento, Laravel and a very large share of the web. DNSTrace.dev reports it as a runtime signal in its own right, separate from whichever application framework or content management system sits on top of it.

How DNSTrace.dev detects it

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

PHPSESSID cookie — The default PHP session cookie name, set when a session starts.
x-powered-by naming PHP — The interpreter banner, which includes the version unless it is disabled.
server naming php-fpm or a PHP handler — Supporting evidence from the process serving the request.

What a detection proves

The response was produced by a PHP runtime.

What it does not prove

Which application or framework runs on it, or that the reported version is current. Frameworks such as Laravel replace the default session cookie, so PHP can be present without PHPSESSID appearing.

Common questions

Why does a WordPress site not always report PHP?

WordPress does not start a PHP session for anonymous visitors, so no PHPSESSID cookie is set. The application is still PHP; the runtime simply left no public signal.

Does x-powered-by expose the PHP version?

It does by default. Disabling expose_php removes it, which is common hardening practice.