Most PHP scripts on a server end in .php. WordPress, Drupal, Joomla, MediaWiki, Moodle, Nextcloud, Laravel apps.. behind almost any of them, the server runs a file called index.php before you see a single word. Rasmus Lerdorf released the first public version of PHP in 1995, so the extension has been part of the web for three decades, always at the end of a file name and never at the end of a domain. If one application in ICANN’s 2026 round goes through, websites could end in it too.
I thought my series on domain endings had ended with .wordpress. It had not.
Eric L. Barnes reported in PHP News on 14 October that Knock Knock WHOIS There, LLC, the Automattic company that runs .blog and applied for .wordpress, also has an application for .php. The first to flag it was B’ad Samurai, who listed .php on Reveal Day next to other applications such as .pdf, .sys, .log and .url. The application is on ICANN’s site as a replacement string, a second-choice name that an applicant can switch to when its first choice is contested. The first choice here is .vibe, which has seven active applications, Automattic’s among them. ICANN allows the switch only in the 14 days after Reveal Day, so until 21 October.
What the application says
The application defines .php as “an acronym for Personal Home Page”. That is where the name started. Rasmus Lerdorf called his 1994 scripts “Personal Home Page Tools”, and the name later became a recursive acronym, “PHP: Hypertext Preprocessor”, according to PHP’s own history page.
The mission statement makes the link to WordPress directly: “WordPress is the largest open-source PHP project and .php would offer a home to WordPress developers.” It names project sites, package and framework homes, documentation, developer portfolios, community resources and job seeking as uses.
Where .wordpress would be closed to everyone outside Automattic, .php would not be. The application does not ask for brand status or for an exemption from ICANN’s Code of Conduct, so registrations would not be limited to Automattic.
The file name problem
ICANN asks every applicant whether consumers are likely to face significant risks if names in the ending are abused. For .php, the answer is “No”.
Google’s .zip and .mov endings show why not everyone agrees. Both became generally available in May 2023, and BleepingComputer described the debate that followed. Some platforms turn a file name like setup.zip into a clickable link, and whoever owns the matching domain gets the click. Google answered that “the risk of confusion between domain names and file names is not a new one” and pointed to command.com, a 3M domain that shares its name with an MS-DOS program.
index.php and wp-login.php are file names PHP and WordPress developers see every day, and those developers are the people the application wants to attract. With a .php ending, each of those file names could also be a website. B’ad Samurai expects every mid-sized and large organization to block .php on firewalls and email systems, “so anyone with a domain on .php would be disenfranchised by the risk reduction”.
The switch works through a form in ICANN’s application system, called a Replacement String Attestation. If Automattic submits it by 21 October, the application continues as .php instead of .vibe, and the choice is “permanent and irreversible”, according to ICANN. If it submits nothing, the application continues as .vibe. A switch is allowed only if the replacement string does not create or expand a contention set, and nobody else has applied for .php. The public list does not show the choice yet. ICANN notes that both records may still appear active after an applicant has chosen.
On String Confirmation Day, 17 November, ICANN publishes an updated list with each application’s final string and the updated contention sets. From then on the strings are fixed, except for brand applicants in contention. The evaluation starts, and so does the window for public comments and formal objections, which runs until 16 March 2027. If .php is on that list, anyone who worries about it has four months to say so. If it is not, .php stays a footnote in this round. I will update this post once the list is out.
In the first post of the series I wrote that nobody asks a rose to pass a spam filter. A .php name would have to, and so would every developer who picks one.