Tony Wang10 min readWe Fingerprinted 1,000,000 Websites: Cloudflare, WordPress, and the CAPTCHA Cross-Check
1,000,000 sites fingerprinted: Cloudflare fronts 35.8%, WordPress runs 65.1% of every CMS site, and CAPTCHA prevalence has jumped to 16.9%.
Search "WordPress market share" or "Cloudflare market share" and W3Techs owns the answer — it has for a decade, and there's no reason to compete with that for the generic query. What we can do instead: run our own independent fingerprint pass across the Tranco top-1M, publish the method openly, and — because we also run a separate anti-bot detection index — cross-validate one number that no CMS-tracking site can replicate: how many sites present a CAPTCHA, measured two completely different ways, arriving at nearly the same answer.
Who fronts the web
Route through a CDN and you're in the majority: 52.8% of all 1,000,000 sites in the dataset do. That's the largest single category in the whole fingerprint, and "CDN market" understates how concentrated that majority actually is — one vendor dominates completely.
Inside the CDN category, Cloudflare is not a leader — it's nearly the entire market:
Cloudflare sits in front of 35.8% of every domain in the entire 1,000,000-site dataset — not just the CDN subset — making it, alongside "runs some web server," the single most common piece of shared infrastructure on the internet. This is the same concentration the Anti-Bot Adoption Index found from the opposite direction: Cloudflare covers 45% of reachable sites there too, just measured as a bot-management layer instead of a CDN.
WordPress doesn't have a rival — it has a long tail
Among the 242,607 sites with any detected CMS, WordPress alone accounts for 157,986 — 65.1% of every CMS site on the web. No other platform gets within striking distance:
The gap between #1 and #2 here (65.1% vs. 6.3%) is wider than almost any other technology category in the dataset — WordPress isn't competing with Drupal or Webflow so much as it's competing with the long tail of custom-built and headless sites that carry no detectable CMS signature at all. WordPress's own share moved down from the original snapshot's 73.1% not because it lost ground, but because the CMS category itself grew (200,186 → 242,607 sites) as detector coverage widened — the same "denominator grew, the leader's raw count grew too, but its share of a bigger pie shifted" pattern worth watching for across this whole dataset.
The plugin economy keeps WooCommerce in the same league as Shopify
Ecommerce is the one category where WordPress's dominance doesn't fully carry over — because WooCommerce is a plugin bolted onto a general CMS, not a purpose-built store platform, and it still lands almost tied with Shopify at the top:
The cross-check: CAPTCHA prevalence, measured two different ways
This is the finding a pure tech-stack tracker can't produce, because it requires a second, independently-run dataset. 142,882 sites in this fingerprint pass — 16.9% of the 847,491 reachable domains — embed a CAPTCHA widget (reCAPTCHA, hCaptcha, Cloudflare Turnstile, or Arkose Labs), detected by matching known script and DOM signatures in the static HTML.
Separately, Crawlora's Anti-Bot Adoption Index scanned a different top-1M pass (top1m-20260614) using an entirely different technique — probing each site's live response and challenge behavior rather than reading static HTML — and found 9.4% of its 818,614 reachable sites carrying a CAPTCHA-kind signature (76,755 sites):
Update, worth stating plainly rather than quietly editing over: when this cross-check first ran in July, the two methods landed within six-tenths of a point of each other (8.8% vs. 9.4%) — good evidence both numbers were real. That gap has since widened to 7.5 points, and this is no longer a tight independent confirmation. The likely driver is on our own side, not a real doubling of CAPTCHA adoption across the web in six weeks: this detector's signature set expanded substantially over that window (several rounds of signature-mining work), and Cloudflare Turnstile alone now matches 50,387 sites — more than a third of every reachable domain carrying any CAPTCHA signature. Cloudflare's other free-tier products (CDN, DNS) all grew meaningfully over the same period in this census, so some genuine rise in Turnstile deployment is plausible too — but a raw before/after count across two different detector versions can't cleanly separate "more sites really run a CAPTCHA now" from "we got better at detecting the ones that were already there," and this pass wasn't designed to make that distinction. Read 16.9% as the current best static-fingerprint estimate on its own terms; the Anti-Bot Index's 9.4% is a separate, older, independently-still-true number, not a number this section can currently claim to validate.
Behind the CDN, Nginx quietly runs a fifth of the web
Web-server fingerprinting is the category where BuiltWith-style tools disagree most, because so many servers hide their identity behind a CDN. Where a server signature is exposed, Nginx leads but no longer dominates the way this dataset's own original snapshot suggested:
This is a genuinely different shape than the original July snapshot, which showed Nginx at 93.0% and Apache at a rounding-error 53 domains. The underlying web didn't migrate en masse from Nginx to Apache and LiteSpeed in six weeks — the detector did. Signature-mining work over that window added and corrected server-header detection rules, and Apache and LiteSpeed went from barely-detected to properly detected. It's a real lesson for this whole dataset, not just this one category: a category's exact ranking can flip between refreshes not because the web changed, but because what we can see changed. 34.4% of the entire dataset now exposes some web-server signature (up from 15.5%); of the sites that do, Nginx alone still fronts 18.5% of every reachable site directly.
What this means if you're building on top of the open web
For competitive and market-share research, the practical lesson is that WordPress's 65.1% CMS share and Cloudflare's 67.9% CDN share are now closer to defaults than choices — a "which platform should I build for" question is increasingly "how do I work well inside WordPress and behind Cloudflare," not "which of five roughly-equal options do I pick." For anti-bot and scraping teams, the CAPTCHA number is the operational takeaway even with the cross-check no longer tight: roughly 1 in 6 sites you'll ever crawl now embeds some CAPTCHA widget by this measurement — plan for CAPTCHA-solving capacity at that rate, and re-check the number periodically rather than assuming it's stable. And for anyone fingerprinting their own competitive set, this dataset is exactly the kind of "who runs what" ground truth that's normally locked behind a paid BuiltWith/Wappalyzer export — here it's one REST API call.
For an ecommerce-specific cut of this same fingerprint — Shopify vs. WooCommerce: the CDN gap nobody talks about — see how CDN adoption and TLD distribution diverge sharply between the two leading platforms. And for a cut this post doesn't cover — how the stack itself shifts depending on how big the site is — see What Powers the Top 1,000,000 Websites.
Query the full Tech Stack dataset
1,000,000 fingerprinted domains — CDN, CMS, ecommerce, analytics, web server and more — over one REST API. Cross-reference with the Anti-Bot Index for detection work.
Frequently asked questions
What is the most common CDN in 2026?
Cloudflare, by a wide margin. Fingerprinting the Tranco top-1M, Cloudflare fronts 35.8% of every site in the dataset (358,277 domains) and 67.9% of the CDN category specifically - more than every other named CDN combined, roughly 8x the raw count of the next-largest, Amazon CloudFront.
What percentage of websites use WordPress?
In Crawlora's August 2026 fingerprint of 1,000,000 Tranco top-1M domains, WordPress runs 15.8% of the whole dataset (18.6% of just the reachable sites) and 65.1% of every site with a detected CMS. No other CMS breaks 7% of the CMS category - Drupal is a distant second at 6.3%.
What percentage of websites use a CAPTCHA?
16.9% (142,882 of 847,491 reachable sites) embed a CAPTCHA widget by static HTML fingerprint - up sharply from 8.8% when this dataset was first published. Crawlora's separately-run Anti-Bot Adoption Index, using a different challenge-response detection method on an older top-1M pass, measures 9.4%; the two methods lined up closely in July but the gap has since widened to 7.5 points, most likely from expanded CAPTCHA-signature detection (Cloudflare Turnstile alone now accounts for over a third of the count) rather than a real doubling of CAPTCHA adoption.
Shopify vs WooCommerce - which is more common?
They're close to tied: Shopify runs 37.7% of detected ecommerce storefronts (29,283 sites) and WooCommerce 33.4% (25,958 sites) in the August 2026 fingerprint. WooCommerce's showing is notable since it's a WordPress plugin, not a dedicated hosted platform, yet still nearly matches Shopify.
How was this tech stack data collected?
Homepage HTML and response headers for the Tranco top-1,000,000 domains were fingerprinted against a technology-signature database (CDN, CMS, ecommerce, analytics, web server and more) - the same category of detection BuiltWith and Wappalyzer use. 84.7% of domains resolved a working homepage; every figure is scoped to a single scan pass to avoid double-counting.