Tony Wang9 min readWe Fingerprinted 978K Websites: Cloudflare, WordPress, and the CAPTCHA Cross-Check
978,539 sites fingerprinted: Cloudflare fronts 36.7%, WordPress runs 73.1% of every CMS site, and CAPTCHA prevalence independently matches our Anti-Bot Index.
Search "WordPress market share" or "Cloudflare market share" and W3Techs owns the answer — it has for a decade, and there's no reason to compete with that for the generic query. What we can do instead: run our own independent fingerprint pass across the Tranco top-1M, publish the method openly, and — because we also run a separate anti-bot detection index — cross-validate one number that no CMS-tracking site can replicate: how many sites present a CAPTCHA, measured two completely different ways, arriving at nearly the same answer.
Who fronts the web
Route through a CDN and you're in the majority: 59.5% of all 978,539 sites in the dataset do. But "CDN market" understates how concentrated that majority actually is — one vendor dominates completely.
Inside the CDN category, Cloudflare is not a leader — it's nearly the entire market:
Cloudflare sits in front of 36.7% of every domain in the entire 978,539-site dataset — not just the CDN subset — making it, alongside "runs some web server," the single most common piece of shared infrastructure on the internet. This is the same concentration the Anti-Bot Adoption Index found from the opposite direction: Cloudflare covers 45% of reachable sites there too, just measured as a bot-management layer instead of a CDN.
WordPress doesn't have a rival — it has a long tail
Among the 203,498 sites with any detected CMS, WordPress alone accounts for 148,707 — 73.1% of every CMS site on the web, or 18.9% of the entire dataset regardless of CMS status. No other platform gets within striking distance:
The gap between #1 and #2 here (73.1% vs. 6.9%) is wider than almost any other technology category in the dataset — WordPress isn't competing with Drupal or Joomla so much as it's competing with the long tail of custom-built and headless sites that carry no detectable CMS signature at all.
The plugin economy keeps WooCommerce in the same league as Shopify
Ecommerce is the one category where WordPress's dominance doesn't fully carry over — because WooCommerce is a plugin bolted onto a general CMS, not a purpose-built store platform, and it still lands almost tied with Shopify at the top:
The cross-check: CAPTCHA prevalence, measured two different ways
This is the finding a pure tech-stack tracker can't produce, because it requires a second, independently-run dataset. 70,086 sites in this fingerprint pass — 8.9% of the 787,205 reachable domains — embed a CAPTCHA widget (reCAPTCHA, hCaptcha, Cloudflare Turnstile, or Arkose Labs), detected by matching known script and DOM signatures in the static HTML.
Separately, Crawlora's Anti-Bot Adoption Index scanned a different top-1M pass (top1m-20260614) using an entirely different technique — probing each site's live response and challenge behavior rather than reading static HTML — and found 9.4% of its 818,614 reachable sites carrying a CAPTCHA-kind signature (76,755 sites):
A 0.5-point gap between a passive HTML-signature read and an active challenge-response probe is close enough to call these independent confirmations of the same underlying rate, rather than two unrelated numbers — the small difference is exactly what you'd expect, since some sites embed a CAPTCHA widget that a static crawl can see but never actually triggers during a passive probe, and vice versa. Neither dataset was built to validate the other; they were run at different times, by different teams internally, using different signatures. Getting to within half a point anyway is the strongest evidence either study has that its CAPTCHA number is real and not a detector artifact.
Behind the CDN, Nginx quietly runs a fifth of the web
Web-server fingerprinting is the category where BuiltWith-style tools disagree most, because so many servers hide their identity behind a CDN. Where a server signature is exposed, Nginx dominates:
Apache's near-absence here (59 domains, effectively rounding to zero of the detected server category) doesn't mean Apache has died — it means the sites still running it overwhelmingly sit behind a CDN that strips or replaces the Server header before it reaches a fingerprinting pass. Only 15.7% of the entire dataset exposes any web-server signature at all.
What this means if you're building on top of the open web
For competitive and market-share research, the practical lesson is that WordPress's 73.1% CMS share and Cloudflare's 76.2% CDN share are now closer to defaults than choices — a "which platform should I build for" question is increasingly "how do I work well inside WordPress and behind Cloudflare," not "which of five roughly-equal options do I pick." For anti-bot and scraping teams, the CAPTCHA cross-check is the operational takeaway: roughly 1 in 11 sites you'll ever crawl embeds some CAPTCHA widget, confirmed by two independent measurements — plan for CAPTCHA-solving capacity at that rate, not as a rare edge case. And for anyone fingerprinting their own competitive set, this dataset is exactly the kind of "who runs what" ground truth that's normally locked behind a paid BuiltWith/Wappalyzer export — here it's one REST API call.
For an ecommerce-specific cut of this same fingerprint — Shopify vs. WooCommerce: the CDN gap nobody talks about — see how CDN adoption and TLD distribution diverge sharply between the two leading platforms.
Query the full Tech Stack dataset
978,539 fingerprinted domains — CDN, CMS, ecommerce, analytics, web server and more — over one REST API. Cross-reference with the Anti-Bot Index for detection work.
Frequently asked questions
What is the most common CDN in 2026?
Cloudflare, by a wide margin. Fingerprinting the Tranco top-1M, Cloudflare fronts 36.7% of every site in the dataset (359,429 domains) and 76.2% of the CDN category specifically - more than every other named CDN combined, roughly 9x the next-largest, Amazon CloudFront.
What percentage of websites use WordPress?
In Crawlora's July 2026 fingerprint of 978,539 Tranco top-1M domains, WordPress runs 18.9% of the whole dataset and 73.1% of every site with a detected CMS. No other CMS breaks 7% of the CMS category - Drupal is a distant second at 6.9%.
What percentage of websites use a CAPTCHA?
8.9% (70,086 of 787,205 reachable sites) embed a CAPTCHA widget by static HTML fingerprint. That figure independently corroborates Crawlora's separately-run Anti-Bot Adoption Index, which measured 9.4% of a different top-1M reachable set via challenge-response probing - two different detection methods landing half a point apart.
Shopify vs WooCommerce - which is more common?
They're close to tied: Shopify runs 42.2% of detected ecommerce storefronts (29,374 sites) and WooCommerce 35.9% (24,964 sites) in the July 2026 fingerprint. WooCommerce's showing is notable since it's a WordPress plugin, not a dedicated hosted platform, yet still nearly matches Shopify.
How was this tech stack data collected?
Homepage HTML and response headers for the Tranco top-1,000,000 domains were fingerprinted against a technology-signature database (CDN, CMS, ecommerce, analytics, web server and more) - the same category of detection BuiltWith and Wappalyzer use. 80.4% of domains resolved a working homepage; every figure is scoped to a single scan pass to avoid double-counting.