I was kinda surprised to see that phpMyAdmin is still maintained, albeit only barely. The last release was in January but before that it hadn't been touched for over two years.

This stuff is still packaged with cPanel, which is probably the most common way to manage web servers on the internet.

I wonder how long it's been since that was true. I think that era passed when most small businesses and individuals moved from self hosting to SaaS.

Nearly every website developer servicing small business builds a WordPress site and sets it up on a hosting company's cPanel install with phpmyadmin running by default.

Which are far far outnumbered by people setting up squarespace sites, or shopify sites or facebook pages or twitter profiles these days.

It was definitely true at one point that small scale indie web devs and small business contractors outnumbered big tech in both headcount and servers. I don't think that's been true for a while now.

That’s not what the stats show.

WordPress powers 43% of websites today. Shopify, Wix, and Squarespace together only account for 11%.

https://w3techs.com/technologies/overview/content_management

Here's their "10 popular sites using Wordpress"

- microsoft.com - It's not wordpress, probably home grown

- wordpress.org - This one's a freebie

- digicert.com - Using Adobe Experience Manager, per script includes

- wordpress.com - Another freebie

- mozilla.org - No, using a homegrown CMS: https://github.com/mozilla/nucleus

- nih.gov - It's using Drupal, per a meta generator tag

- forbes.com - No real for or against evidence, though the lack of any wp- paths leans a little more against it being wordpress

- archive.org - It's some type of react app, not wordpress. Probably home grown

- nginx.org - Just... no.

- ebay.com - Would it surprise you, no.

I have serious questions about their methodology.

Similarly, just because sites like Techcrunch use Wordpress, doesn't mean they're doing it by having someone upload files over FTP to some cPanel managed Godaddy account.

Most of those do in fact seem to use WordPress for part of their site:

* microsoft.com – uses WP at devblogs.microsoft.com

* digicert.com – may be a false positive, they link to files at /wp-content/ URLs, maybe they used WP in the past and kept the URLs?

* mozilla.org – uses WP at blog.mozilla.org

* nih.gov – uses WP at directorsblog.nih.gov

* forbes.com – can’t tell, my ad blocker breaks their cookie consent screen

* archive.org – uses WP at blog.archive.org

* nginx.org – uses WP at blog.nginx.org

* ebay.com – may be false positive?

We end up with 2/10 potential false positives, and one unknown (and even then, those are huge sites, who knows if they’ve got WP hiding under some deeply-buried subdomain).

I agree with you that Microsoft and TechCrunch probably aren’t FTPing their files in, but even if we assume that only 50% of WordPress sites are doing so, that’s still more websites than the next 10 competitors, combined!

If you think about it, this makes sense: do you reckon your local small businesses have a TechCrunch-level web presence, or are they using GoDaddy? Now consider that there exist many more local businesses than TechCrunches.

Do you have figures for that?

I guess those installs are the ones the Wordpress vuln scanners are looking for when they spam my server with /wp-admin/ requests.

I serve a cPanel hosting, some people just want something up and running now which cPanel provides.

With Softaculous for automatic installation of scripts it's still widely popular for Wordpress installations. Web hosting is however a very dead market to startup in.