What is PHP and why does half the web run on it?

PHP is the programming language that works in the background of a website. Your browser requests a page, PHP assembles it on the server in seconds from text, images and database entries and sends back the finished result. No PHP means no blog post, no shopping basket and no login in classic systems like WordPress, Drupal, Joomla or Magento.

It was invented by Rasmus Lerdorf. According to Wikipedia, he started writing small programs in 1993 to maintain his personal homepage and announced the first version as “Personal Home Page Tools” on 8 June 1995. Hence the name, which was later reinterpreted as “PHP: Hypertext Preprocessor”. A lot has happened since then, from PHP 3 (1998) and PHP 5 with its object-oriented model (2004) to PHP 7 with a big jump in speed (2015) and PHP 8 with a JIT compiler (2020). So the language is 31 years old and today, according to W3Techs, runs on 69.3% of websites with a known server-side language.

Why do so many systems build on it? Because back then PHP had everything the early web needed. It’s free, every cheap host supports it, you don’t need your own server landscape, and once you have a plugin ecosystem, you stay put. The result is a huge network effect. WordPress alone is behind 39.6% of all websites.

Transparency, because it belongs here: Until a few months ago we at oha! digital built all our websites on WordPress. We were fans of the system for years and recommended it to our clients with a clear conscience. For a long time it was also the right recommendation. Our switch to Framer isn’t a reckoning with the past but the result of what we’ve seen in projects, and PHP2Shell has now added the fitting exclamation mark.

What do PHP systems give you and what do they cost you?

The fourth point is the decisive one. With PHP systems, running them comes with the territory, just as servicing comes with a car. That works as long as someone applies updates consistently. Practice looks different. According to the Modat figures at Recorded Future, around 79% of identifiable PHP services run on a version without official support, and PHP 7.4 alone accounts for 878,761 services. A language that’s so widespread and at the same time so badly maintained inevitably becomes a permanent target.

Is PHP still fit for cybersecurity and AI in 2026?

You have to separate two things. The language PHP isn’t dead. It’s actively maintained, PHP 8.5 has been the current version since 2025, and the fixes came one day after the announcement. The operating model behind it is the problem, meaning a website that you or your host looks after on a server, with dozens of plugins that all need patching.

Cybersecurity: According to Recorded Future, a good five hours passed between the leak (02:29 UTC) and the first reported attacks (07:34 UTC). The patch window in which you can calmly take action has practically disappeared. If you look after your website by hand and by calendar, you’re no longer in the same league as the attackers in 2026. On top of that, if your host doesn’t patch immediately, there’s little you can do as a customer. That’s why, according to Malwarebytes, websites are temporarily going offline this week.

AI readiness: PHP isn’t worse here, but the systems built on it are more sluggish. AI visibility (ChatGPT, Gemini, Claude and co. as new ways of searching) demands fast, clean, well-structured pages, and today’s tools build AI directly into page building. Framer, for example, offers Wireframer and Workshop as AI features for layouts and components, and Shopify presents products directly in ChatGPT, Perplexity and Microsoft Copilot. All of this is possible in WordPress too, but usually only with extra plugins that need maintaining in turn.

Our verdict: For a company website that should be secure, fast and visible to AI from 2026 to 2031, a self-hosted PHP system is no longer the first choice. That’s not down to the language but to the effort. The more responsibility for servers, plugins and updates sits with you, the bigger the risk.

Which systems will last the next five years?

The answer depends on who you are. A corporation with its own development team needs something different from a trade business with five subpages. What the candidates below have in common is that they run as a hosted platform or modern architecture, you don’t operate your own PHP server, and AI is part of the toolbox.

Framer in detail: Framer is our favourite, and not out of convenience. You build visually, and according to TechRadar the AI features have been available to all users since May 2025 (Wireframer for page structures, Workshop for your own components in the style of your website). SSL certificates are set up automatically on custom domains, as Framer documents, and Framer also describes active DDoS protection. There’s no server for you to patch and no plugin jungle. For us that means less maintenance, less attack surface and more time for content and marketing.

And what about online shops – does Shopify have a future?

For e-commerce our answer is yes. Shopify is a hosted shop system, so you don’t maintain your own server, and the platform is evolving remarkably fast. According to The Fintech Times, Shopify presented over 150 new features with its Winter ’26 Edition on 10 December 2025. Two of them show where this is heading.

• Agentic Storefronts: Merchants can place their products directly in conversations with ChatGPT, Perplexity and Microsoft Copilot. If you don’t show up there, you’re missing from where people are increasingly searching.

• Sidekick: The AI assistant proactively suggests tasks, edits themes by voice command and builds admin apps from natural language.

The demand is there. In Shopify’s own Holiday Retail Report 2025, according to the same source, 66% of consumers want to use AI for at least part of their Christmas shopping. That’s a vendor figure rather than a neutral one, but the direction is right.

The catch is the same as with any website builder. Ongoing platform costs and app dependencies are part of the deal, and without clean product data even the best AI achieves nothing. That’s exactly where we come in. oha! digital is a Shopify partner and happy to help you build your shop, from setup and design to product data and performance campaigns.

What should you do now?

In plain English, if you run a PHP website you now have two jobs, closing the acute flaw and answering the platform question honestly.