Technology intelligence · Tranco top-1M · July 8, 2026
978,539 sites from the Tranco top-1M, fingerprinted for CMS, ecommerce platform, CDN, analytics, web server and ~200 other technologies — queryable over one REST API. Find every site running a given stack, or look up one domain’s full tech profile. Pay on success.
978,539
sites fingerprinted — one record per domain, ~200 detectable technologies.
80.4%
reachable
47.8%
behind a CDN
15.2%
WordPress
Snapshot July 8, 2026 — top1m-2026-07-08-full, detector 2026.07.5.
978,539
sites from the Tranco top-1M fingerprinted for their tech stack, of which 80.4% (787,205) resolved a working homepage — one snapshot, one domain, one record.
47.8%
route through a CDN — and Cloudflare alone sits in front of 36.7% (359,429) of all sites, more than every other CDN combined.
15.2%
run WordPress — 73.1% of every site with a detected CMS (20.8% of the whole dataset). No other CMS breaks 1.5%.
7.2%
embed a CAPTCHA widget (reCAPTCHA, hCaptcha, Turnstile or Arkose) — independently close to the Anti-Bot Index’s 9.4% “challenge presented” rate, from a completely different detection method.
Share of the 978,539 scanned domains carrying at least one detected technology in each category. A site can carry technologies in many categories at once, so shares don't sum to 100%.
Cloudflare and Google Tag Manager alone sit on close to a third of all scanned sites; jQuery still outruns every modern JS framework combined.
Share within each detected category — e.g. WordPress's share is of sites where a CMS was detected at all, not of the whole dataset. Only 7.1% of all scanned sites run a detected ecommerce platform at all, which is why every ecommerce bar below reads as a share of that smaller 69,615-site base, not of the full 978,539.
CMS (203,498 sites)
Ecommerce (69,615 sites)
CDN (467,976 sites)
run_id sums across all three and inflates counts. Every figure on this page is scoped to top1m-2026-07-08-full alone, or use the per-domain items lookup, which already resolves to one record.has_captcha field — a category-matching bug meant that field never actually fired against production data; the fix ships in the next scan.render_tier field is reserved for that.One fingerprinted record per domain per scan pass. Grouped for readability; the API returns a flat object.
Identity
domaintldrankfinal_urlschemestatusreachableDetections
technologies[] (name, categories, confidence, version, evidence)technology_names[]categories[]tech_countRollups
cmsecommercecdnweb_serverserver_languageanalytics[]has_captchaProvenance
render_tier (http | browser)seed_sourcedetector_versionmethod_versionscan_methodprobed_atrun_idrun_dateCombine any of the filters below on the search endpoint. Page with page and page_size (≤100 per page, page × page_size ≤ 10,000).
Domain & tech match
Category rollups
Site facts
Provenance
Every query authenticates with an x-api-key header and reads the stored search index — no live scraping or proxy routing, billed pay on success. Three endpoints cover it:
GET /datasets/techstack/search — filter, sort, page the population.GET /datasets/techstack/items/{domain} — one site’s full stack.GET /datasets/techstack/facets — market-share counts for any dimension.The same three are exposed as MCP tools — datasets_techstack_search, datasets_techstack_facets and datasets_techstack_item — so an agent can call them directly. A single-site live lookup (rather than this stored census) is also available as the free Website Tech Stack Checker.
Cite this
Crawlora (2026). Website Tech Stack Dataset. 978,539 sites fingerprinted from the Tranco top-1M. https://crawlora.net/datasets/techstack.
Search with AND / NOT
# Sites that use Shopify AND Klaviyo, but not WooCommerce
curl "https://api.crawlora.net/api/v1/datasets/techstack/search?technology=Shopify&technology=Klaviyo¬=WooCommerce" \
-H "x-api-key: $CRAWLORA_API_KEY"One site’s full stack
# One site's full detected tech stack
curl "https://api.crawlora.net/api/v1/datasets/techstack/items/shopify.com" -H "x-api-key: $CRAWLORA_API_KEY"Market share by dimension
# Market share by CDN (or category, cms, ecommerce, web_server, tld …)
curl "https://api.crawlora.net/api/v1/datasets/techstack/facets?facet=cdn" -H "x-api-key: $CRAWLORA_API_KEY"The same figures behind the bars above — plain and machine-readable for search engines and AI answer engines that cannot parse a chart.
| Category | Sites | Share of all sites |
|---|---|---|
| CDN | 467,976 | 47.8% |
| Analytics | 350,407 | 35.8% |
| JavaScript library | 321,948 | 32.9% |
| Tag manager | 312,029 | 31.9% |
| Font | 288,314 | 29.5% |
| UI framework | 237,784 | 24.3% |
| CMS | 203,498 | 20.8% |
| Web server | 153,365 | 15.7% |
| Blog | 152,312 | 15.6% |
| Advertising | 128,451 | 13.1% |
| Security | 76,988 | 7.9% |
| JavaScript framework | 75,448 | 7.7% |
| Web framework | 72,579 | 7.4% |
| Ecommerce | 69,615 | 7.1% |
| Consent management | 37,427 | 3.8% |
| Technology | Sites | Share of all sites |
|---|---|---|
| Cloudflare | 359,429 | 36.7% |
| Google Tag Manager | 307,670 | 31.4% |
| jQuery | 248,440 | 25.4% |
| Google Fonts | 208,475 | 21.3% |
| Google Analytics | 200,759 | 20.5% |
| WordPress | 150,025 | 15.3% |
| Bootstrap | 143,198 | 14.6% |
| Nginx | 142,602 | 14.6% |
| Font Awesome | 140,973 | 14.4% |
| Swiper | 97,745 | 10% |
| Cloudflare Web Analytics | 71,819 | 7.3% |
| cdnjs | 68,812 | 7% |
| Meta Pixel | 63,085 | 6.4% |
| jsDelivr | 60,521 | 6.2% |
| reCAPTCHA | 58,508 | 6% |
| CMS | Sites | Share of CMS sites |
|---|---|---|
| WordPress | 148,707 | 73.1% |
| Drupal | 13,992 | 6.9% |
| Webflow | 7,555 | 3.7% |
| Adobe Experience Manager | 5,583 | 2.7% |
| TYPO3 | 3,988 | 2% |
| PrestaShop | 3,545 | 1.7% |
| Joomla | 3,316 | 1.6% |
| HubSpot CMS | 2,675 | 1.3% |
| Blogger | 2,393 | 1.2% |
| Contentful | 2,290 | 1.1% |
| Platform | Sites | Share of ecommerce sites |
|---|---|---|
| Shopify | 29,374 | 42.2% |
| WooCommerce | 24,964 | 35.9% |
| Magento | 6,223 | 8.9% |
| PrestaShop | 3,551 | 5.1% |
| OpenCart | 2,013 | 2.9% |
| Salesforce Commerce Cloud | 1,379 | 2% |
| BigCommerce | 1,123 | 1.6% |
| Recharge | 825 | 1.2% |
| Ecwid | 85 | 0.1% |
| Shopware | 41 | 0.1% |
| CDN | Sites | Share of CDN sites |
|---|---|---|
| Cloudflare | 356,766 | 76.2% |
| Amazon CloudFront | 39,108 | 8.4% |
| cdnjs | 33,499 | 7.2% |
| jsDelivr | 17,824 | 3.8% |
| Fastly | 14,292 | 3.1% |
| unpkg | 3,723 | 0.8% |
| Varnish | 2,726 | 0.6% |
| Amazon Web Services | 978 | 0.2% |
| Google Cloud | 884 | 0.2% |
| Web server | Sites |
|---|---|
| Nginx | 142,602 |
| OpenResty | 7,954 |
| Envoy | 2,440 |
| Gunicorn | 302 |
| Apache | 59 |
| Caddy | 8 |
| TLD | Sites | Share of all sites |
|---|---|---|
| .com | 415,253 | 42.4% |
| .net | 48,056 | 4.9% |
| .org | 37,128 | 3.8% |
| .ru | 36,800 | 3.8% |
| .uk | 30,124 | 3.1% |
| .de | 28,127 | 2.9% |
| .br | 17,113 | 1.7% |
| .jp | 16,164 | 1.7% |
| .nl | 13,425 | 1.4% |
| .in | 11,655 | 1.2% |
Query 979K fingerprinted sites — CMS, ecommerce, CDN, analytics and ~200 other technologies — through one REST API. Competitive intelligence, lead scoring, market-share research or migration targeting: clean JSON, pay on success.
The latest complete scan (top1m-2026-07-08-full) fingerprinted 978,539 sites from the Tranco top-1M domain list, one record per domain. 787,205 (80.4%) resolved a working homepage; the rest were unreachable at scan time. A supplementary recheck pass recovers a further 3,625 of those on retry. Query without a run_id and you'll see a larger, inflated total — the index also holds two supplementary re-scan passes (a recheck of initially-unreachable domains, and a broader proxy re-scan) that share domains with the main pass; filter to a single run_id (or use the per-domain item lookup, which already resolves to one record) for an accurate one-row-per-domain count.
A pure HTML-signature + response-header detector (BuiltWith/Wappalyzer-style) fingerprints ~200 technologies across categories like CMS, ecommerce, analytics, CDN, web server, UI framework, tag manager, consent management, A/B testing and CAPTCHA — reading loader-domain/asset-path patterns in the homepage HTML plus server response headers (nginx/Apache/IIS, Cloudflare/CloudFront/Fastly, PHP/ASP.NET/Rails). It is directional, not exhaustive: fully custom, unbundled first-party stacks with no recognizable asset URL or `<meta generator>` tag will under-detect.
The two datasets measure different things. This dataset detects whether a page's HTML embeds a CAPTCHA widget (reCAPTCHA, hCaptcha, Cloudflare Turnstile, Arkose Labs) — a static signal, present whether or not a scraper ever gets challenged. The Anti-Bot Adoption Index instead measures whether the scan itself was served a challenge when it tried to fetch the page — an active signal. They land in a similar range (7.2% here vs 9.4% there) but aren't the same measurement, and shouldn't be summed or directly diffed.
This dataset's scan is HTTP-tier only (render_tier=http) — it reads the server-delivered HTML and response headers, not a rendered DOM. That means it catches most trackers even when they load from an inline script (matched by loader domain in the raw HTML), but consent-gated scripts that only inject after a cookie-banner click, and technologies with no HTML/header fingerprint at all, won't show up. The `render_tier` field is reserved for a future browser-rendered pass.
Yes. Three endpoints: search (filter by technology, category, CMS, ecommerce, CDN, web server, TLD, reachability and more, with AND/OR/NOT technology matching), facets (market-share counts for any dimension) and items (one record by domain). All three are also exposed as MCP tools (datasets_techstack_search, datasets_techstack_facets, datasets_techstack_item) and billed pay-on-success.