Out-of-support software on UK public-sector websites
Every month we fetch the home page of each UK council, NHS trust and university website and record what the response reveals about the software behind it: the web server, the version of Windows, PHP, the content management system and the front-end libraries. This is what those pages said on 3 October 2026.
- Websites checked
- 739of 816 organisations listed
- Reveal something out of support
- 9%70 sites named at least one component whose security fixes have ended
- Reveal something ending within a year
- 1%4 sites
- Reveal nothing with a support date
- 49%361 sites name none of their software, or only things without vendor dates
A page that names nothing has not passed; it has said nothing. The figures above are therefore a floor, not a measure of the whole estate.
By sector
Share of the websites reached in each sector that revealed at least one component in each state. Universities come out worst, at 11%.
| Sector | Reached | Out of support | Ending within a year | Not pinned down | Nothing revealed |
|---|---|---|---|---|---|
| Local councils | 361 of 366 | 38% | |||
| NHS trusts | 163 of 211 | 64% | |||
| Universities | 215 of 239 | 56% |
What is out of support
The components whose vendor has stopped issuing security fixes, by the number of websites that revealed them. A site is counted once per component.
| Component | Security fixes ended | Websites | Councils | NHS | Universities |
|---|---|---|---|---|---|
| jQuery 1.x | No longer supported | 17 | 8 | 12 | |
| jQuery 2.x | No longer supported | 7 | 1 | 3 | |
| Bootstrap 4.x | 1 January 2023 | 6 | 1 | 3 | |
| Bootstrap 3.x | 24 July 2019 | 4 | 3 | 2 | |
| AngularJS 1.x | 31 December 2021 | 2 | 0 | 3 | |
| PHP 7.4 | 28 November 2022 | 1 | 0 | 3 | |
| Drupal 7 | 5 January 2025 | 2 | 0 | 0 | |
| Drupal 9 | 1 November 2023 | 1 | 0 | 0 |
Ending within a year
| Component | Security fixes end | Websites |
|---|---|---|
| PHP 8.2 | 31 December 2026 | 4 |
Seen, but the page does not say which release
| Component | Websites | Why it is not pinned down |
|---|---|---|
| IIS 10.0 | 41 | IIS 10 ships with Windows Server 2016, 2019, 2022 and 2025. |
| ASP.NET on .NET Framework 4.x (CLR 4.0.30319) | 7 | Every .NET Framework release from 4.0 to 4.8.1 reports this runtime version. |
Web servers
What the Server header said, across the 739 websites reached. Through IIS the Windows version can often be read: IIS 8.5 means Windows Server 2012 R2, for example.
| Server | All | Local councils | NHS trusts | Universities |
|---|---|---|---|---|
| IIS | 23 | 6 | 12 | |
| Apache | 17 | 43 | 44 | |
| nginx | 54 | 32 | 27 | |
| Cloudflare in front | 79 | 48 | 71 | |
| Other | 16 | 9 | 14 | |
| Not named | 172 | 25 | 47 |
How the survey is done
So that the figures can be checked and quoted.
Who is included
Every current UK local authority with a page on GOV.UK's "find your local council" service, every active NHS trust in England listed by the NHS Organisation Data Service, and every UK university with a website recorded on Wikidata. The list is rebuilt from those registers and currently holds 816 organisations.
What is checked
One request to each organisation's home page, from a script that identifies itself as a survey, following redirects, as a browser would. The response headers and the HTML of that page are read for the things that name their software: the Server, X-Powered-By, X-AspNet-Version and X-Generator headers, the generator meta tag, the addresses of scripts and stylesheets, and ASP.NET view state. Nothing else is requested and nothing is probed. The same code runs our website check, so you can see exactly what it reports for a site you are responsible for.
How status is decided
Each thing recognised is matched to the vendor's dates in our end-of-support tables, which are checked against endoflife.date every time this site is published. "Out of support" means the vendor has stopped issuing security fixes for that version. jQuery 1.x and 2.x count as out of support because the jQuery project no longer supports them, although it has published no date.
What the figures cannot show
A page only reveals what its server is set to reveal, and many are set to reveal nothing. IIS 10 does not identify its Windows version and ASP.NET does not identify its .NET Framework release, so those are counted as "not pinned down" rather than guessed. The survey sees the public website only: not the systems behind a login, the databases, or the internal applications that usually matter more. All of this makes the figures a floor.
Why no organisation is named
Pointing at a particular council or hospital running an unpatched server would help nobody but an attacker. Only totals are published; the per-site results are kept for ninety days for verification and then deleted. If you work for one of these organisations and want your own result, run the website check on your address.
Using these figures
The totals are free to quote with a link to this page, which is updated on the first of each month. The numbers are also available as JSON. For comment or the method in more detail, email contact@codefirst.co.uk.
Responsible for one of these sites?
Run the website check on your own address, then tell us what it found. We will say what we would look at first, at no charge.