Comment by dofm

PHP URLs don’t have to include .php, though?

PHP apps don’t have to use the session; if an app does not start a session deliberately, there’s no cookie. Some PHP frameworks don’t use the built in session. Bespoke PHP code may simply never use it. Or perhaps they do but they rename the cookie. Laravel doesn’t use it, for example. Magento does, but it renames the cookie. Prestashop stopped using it.

Web servers don’t have to announce they use PHP at all.

It is no more uniquely trivial to fingerprint than ASP is/was, for the same reasons.

There’s really a lot of dark PHP out there; I maintain a bespoke app that you would not be able to easily establish was PHP.

One reason why the 70% figure is worth going with is that you barely need any PHP on a site to exploit php2shell anyway. It’s a runtime vulnerability. If it’s possible to provoke the server to hand a URL to a PHP runtime, it’s potentially possible to exploit. A hell of a lot of cheap hosting has ready-to-go support for PHP.