Automattic, the company behind WordPress.com, has applied to run a .php top-level domain. It filed the application through Knock Knock WHOIS There, the Automattic subsidiary that already runs .blog, as part of ICANN's 2026 round of new generic top-level domains (gTLDs).

If it goes through, .php would sit next to .com and .org as a domain anyone could register, with Automattic running the registry. The application surfaced in a Mastodon thread and a post on roddie digital.

What Automattic Applied For

.php is a backup. Automattic listed it as the replacement string for its .vibe application, so it isn't one of the 16 strings Automattic applied for directly. Those include .wordpress, .woo, .tumblr, and .matt.

ICANN's data shows seven active applications for .vibe, Automattic's included. ICANN lets applicants switch to their replacement string until October 21, and Automattic's is the only application for .php on the list.

The application defines the string as "an acronym for Personal Home Page," and its mission statement ties it to WordPress:

The mission of the .php TLD is to provide a dedicated home for individuals and communities building personal web presence. WordPress is the largest open-source PHP project and .php would offer a home to WordPress developers.

It says registrants would use .php domains for "project sites, package and framework homes, documentation, developer portfolios, community resources, and for job seeking." The application also confirms registrations wouldn't be limited to Automattic alone.

The File Extension Problem

.php is also the file extension on every PHP script, and TLDs that match file names have a history. When Google opened .zip and .mov for registration in 2023, security researchers warned that a link like update.zip could look like a file to download when it was really a website. Some organizations blocked the domains outright.

The application answers "No" to ICANN's question on whether consumers are likely to face significant risks if domains in the TLD are abused. B'ad Samurai, who flagged .php in a Reveal Day post, disagreed:

Even if they had good intentions, the string would be heavily abused for crime and fraud. Then similar to .zip and .mov, every mid-large organization would block it on their firewalls and email systems, so anyone with a domain on .php would be disenfranchised by the risk reduction.

What Happens Next

ICANN has set these dates for the 2026 round:

  • October 21: Last day for applicants to switch to a replacement string, such as .vibe to .php.
  • November 17: String Confirmation Day. ICANN publishes the final strings, and comments and objections open.
  • November 27: Last day to withdraw for a 65% refund.
  • March 16, 2027: The objection period closes.

You can read the full application on ICANN's application site, and follow the discussion in the Mastodon thread.