TL; DR: Instead of opening dozens of tabs and wading through technical information, PHP Versions lets developers and website owners know which hosting providers offer the most modern releases and patches of the popular programming language — as well as which hosts are stuck in the past. Matt Trask and the PHP Versions community compile the information from nearly 120 companies, covering shared and managed hosting, Platform-as-a-Service, and operating systems. We got a peek behind the curtain to learn how PHP Versions operates, the importance of knowing which version your server runs, and what the programming experts look for in a new host.
Programming languages and web hosting components that have been lingering around for more than a decade are probably obsolete and riddled with security vulnerabilities.
PHP 5.2 recently celebrated its 12th birthday. It hasn’t been actively supported since 2010 and officially reached its end of life in early 2011 — and yet, Matt Trask and the community behind PHP Versions still see a number of hosts continuing to offer it.
More broadly speaking, roughly 80% of all websites use PHP, the language behind WordPress and countless other applications. More than 75% of sites using PHP run some form of Version 5 — which will no longer be supported by the end of 2018.
“PHP developers are often stuck with hosts that support insanely old versions of PHP, which mean their applications have to support those insanely old versions,” Matt said. “We all get stuck in this standoff and end up with people reducing their software to try and get it onto old servers.”
He and PHP Versions developers gather and display color-coded information on which hosts keep up with modern PHP releases and those that don’t — to build site owner awareness and encourage providers to offer more regular updates of the popular programming language. The site covers more than 100 shared hosting, managed hosting, and Platform-as-a-Service offerings, as well as computer operating systems.
“We saw a need to offer people a quick way to look at what versions of PHP were offered with different types of hosts,” Matt said. “Whether the people coming to the website are experienced developers or first-time guests, we’re giving them a quick, 30,000-foot look at what the hosting landscape is in terms of where you can find an actively maintained PHP version on a server that gets you exactly what you want.”
How PHP Versions Tracks 14+ Years of PHP Implementation
Amusingly enough, the developer who launched the PHP Versions project in late 2014 primarily codes in Ruby instead. Phillip Sturgeon eventually handed over the reins to Matt Trask, an open-source advocate and developer from Nashville, Tennessee.
Operations at PHP Versions are pretty simple and lightweight. The project pairs the Jekyll static site generator and its GitHub repository to build its web presence, and Matt oversees the pull requests. The contributions come from a wide-ranging community of independent PHP developers and even some hosts themselves.
The data for PHP Versions comes from YAML files that detail the versions and patches each host maintains. If a host or contributor provides a phpinfo page URL, PHP Versions will automatically track and update each patch update to major or minor PHP releases.
“We have plans to automate a lot of the process and move away from manual pull requests and attaching the website every month,” he said. “Life sometimes gets in the way, holidays happen, and we’re not always Johnny-on-the-spot with pull requests.”
The inclusion of phpinfo pages is a key step in ensuring PHP Versions stays up to date with providers’ most recent advancements. Hosting companies can work with Matt or the project to coordinate providing a secret or password-protected URL if desired.
“We’re hoping we can talk more to these hosts and automate stuff away with browser testing,” he said. “We’d just read phpinfo and update the site automatically instead of waiting on Heroku or whoever to tell me what version of PHP they’re running.”
Monitoring PHP 7.3 and Building Excitement for 7.4
As the PHP Versions project works to modernize and extend its offerings, the community recently added information about PHP versions supported by default on various Linux and macOS operating systems. While you probably won’t base your laptop-buying decision based on which PHP release comes standard, it helps forward-thinking developers plan ahead; more importantly, the data provides more information on how to effectively select and maintain a web server’s operating system.
A page tracking recent and future releases of PHP represents the most recent addition to the project. Promoting the “new and shiny” versions, as Matt called them, continues to build excitement and momentum for the language and its active release cycle after the language began to stagnate in the Version 5 series.
“We can keep developers in the loop, and they don’t have to keep looking at the internals mailing lists,” he said. “We offer them a nice, clean way to see when the next version would be coming out and what it will likely introduce.”
Even though the PHP 7.3 release became officially available in early December 2018, Matt said the community is already getting eager for Version 7.4. He’s hoping to add more documentation to the PHP Versions site on how to use upcoming features such as the updated version of typed properties.
“We’re seeing this release of 7.3 as kind of an internal fix, hitting bug fixes, patches, and speed increases, but 7.4 is actually going to be a massive upgrade in how coding is done with PHP,” Matt said. “We want developers to have a resource and an understanding of why 7.4 is going to be such a huge jump forward.”
Sound Advice on Shopping for PHP Hosting
Even as a PHP expert, Matt recognizes the wide-ranging needs developers and hosting customers bring to various projects. Sometimes time constraints or the desire for simplicity tip the hosting scales in favor of more streamlined, if slightly behind, services, while a big, important project may inspire him to adhere to higher PHP standards.
“Depending on how hands-on you want to be, not everyone is comfortable SSH-ing into a remote server and Vim-ing around to different files and setting up firewalls, iptables, and all that kind of stuff,” he said. “The same can be said for working with PHP.”
Matt’s biggest criteria when searching for a new hosting platform is how frequently PHP is updated — or how easy it is for him to do it himself. He distilled his host evaluations into three questions:
- How often do you check for new patches and update?
- How easy is it for me to upgrade PHP?
- Is there SSH access and how secure is it?
The tradeoffs between ease of use and meeting specific requirements comes into play especially at the Platform-as-a-Service level. For instance, Laravel Forge has one-click setup and deploy for PHP servers that removes a layer of flexibility but dramatically shortens development time. However, developers may not want to spend the time configuring a server to exact specifications for every project.
“Sometimes I just don’t want to have to do it,” Matt said. “I love Vim-ing around on the server and SSH-ing and messing around, but sometimes I just want to start a blog quickly. I want a one-click WordPress installation, but I also want to know that security is taken seriously by these managed and shared hosting companies.”
Moving Ahead With Automation and a New Site
The irony of a website tracking PHP versions running on a Ruby platform is certainly not lost on Matt, who is working to move the site from Jekyll to PHP. He said he hopes Version 2, as he calls the updated site, will introduce new features like list management and alerts when information is updated.
In addition to automating updates to a host’s PHP specifications, Matt said he hopes to incorporate information and solutions to common vulnerabilities and exposures, or CVEs, into the site to build PHP Versions as a robust resource for developers.
“A lot of time, developers are caught off guard by CVEs,” he said. “If we can make it easier for developers to know that a common vulnerability exists in a certain PHP version, we can maybe send an email alert with patching notes and stuff like that.”
Despite the list of new and upcoming features — many of which were requested by the community — Matt said his overall goal is to not rock the boat too much. Moving to PHP and installing an SSL certificate represent overdue maintenance, but he looks to other developers for guidance on what would make PHP Versions the most useful and relevant.
“I want to keep it as simple as possible while still trying to make it more robust,” he said. “If someone has an idea they don’t see on the site but think would be cool, an issue in GitHub is the best way to guide us along our path. Otherwise, it’s just me sitting in my bedroom with a glass of whiskey, making stuff up as I go. I’d rather see the community get what they want rather than me just building things for fun.”