Technology intelligence · Tranco top-1M · August 25, 2026
1,000,000 sites from the Tranco top-1M, fingerprinted for CMS, ecommerce platform, CDN, analytics, web server and ~600 other technologies — queryable over one REST API. Find every site running a given stack, or look up one domain’s full tech profile. Pay on success.
1,000,000
sites fingerprinted — one record per domain, ~600 detectable technologies.
84.7%
reachable
52.8%
behind a CDN
15.8%
WordPress
Snapshot August 25, 2026 — top1m-2026-08-25-full-v2, detector 2026.10.47.
1,000,000
sites from the Tranco top-1M fingerprinted for their tech stack, of which 84.7% (847,491) resolved a working homepage — one snapshot, one domain, one record.
52.8%
route through a CDN — and Cloudflare alone sits in front of 36.7% (366,519) of all sites, more than every other CDN combined.
15.8%
run WordPress — 65.1% of every site with a detected CMS (24.3% of the whole dataset). No other CMS breaks 1.5%.
14.3%
embed a CAPTCHA widget (reCAPTCHA, hCaptcha, Turnstile or Arkose) — independently close to the Anti-Bot Index’s 9.4% “challenge presented” rate, from a completely different detection method.
Share of the 1,000,000 scanned domains carrying at least one detected technology in each category. A site can carry technologies in many categories at once, so shares don't sum to 100%.
Cloudflare and Google Tag Manager alone sit on close to a third of all scanned sites; jQuery still outruns every modern JS framework combined.
Share within each detected category — e.g. WordPress's share is of sites where a CMS was detected at all, not of the whole dataset. Only 7.8% of all scanned sites run a detected ecommerce platform at all, which is why every ecommerce bar below reads as a share of that smaller 77,754-site base, not of the full 1,000,000.
CMS (242,607 sites)
Ecommerce (77,754 sites)
CDN (527,853 sites)
Split the same census by Tranco rank band and two things move in opposite directions at once: modern JS frameworks and enterprise bot management both concentrate near the top of the web, while WordPress climbs the further down the rank list you go. This is the exact top-10K/100K/1M segmentation BuiltWith gates behind its paid Market Analysis plan — computed here from the same open dataset, for free.
Rank-band figures are a pinned snapshot (the public search API sorts by rank but has no rank-range filter, so this cut isn't queryable live) — see src/lib/techstack/rank-band-figures.ts.
| Rank band | n | Bot management | React frameworks | WordPress | Cloudflare CDN |
|---|---|---|---|---|---|
| Top 1,000 | 763 | 26.3% | 16.4% | 10.6% | 20.8% |
| 1K–10K | 7,397 | 21% | 14.1% | 12.4% | 32.8% |
| 10K–100K | 75,185 | 15.6% | 11.1% | 17% | 38% |
| 100K–1M | 764,146 | 9.8% | 6% | 19.8% | 42.2% |
run_id sums across all of them and inflates counts. Every figure on this page is scoped to top1m-2026-08-25-full-v2 alone, or use the per-domain items lookup, which already resolves to one record.has_captcha field to within 0.03% — a prior category-matching bug that kept that field from firing is fixed as of this run.render_tier field is reserved for that.One fingerprinted record per domain per scan pass. Grouped for readability; the API returns a flat object.
Identity
domaintldrankfinal_urlschemestatusreachableDetections
technologies[] (name, categories, confidence, version, evidence)technology_names[]categories[]tech_countRollups
cmsecommercecdnweb_serverserver_languageanalytics[]has_captchaProvenance
render_tier (http | browser)seed_sourcedetector_versionmethod_versionscan_methodprobed_atrun_idrun_dateCombine any of the filters below on the search endpoint. Page with page and page_size (≤100 per page, page × page_size ≤ 10,000).
Domain & tech match
Category rollups
Site facts
Provenance
Every query authenticates with an x-api-key header and reads the stored search index — no live scraping or proxy routing, billed pay on success. Three endpoints cover it:
GET /datasets/techstack/search — filter, sort, page the population.GET /datasets/techstack/items/{domain} — one site’s full stack.GET /datasets/techstack/facets — market-share counts for any dimension.The same three are exposed as MCP tools — datasets_techstack_search, datasets_techstack_facets and datasets_techstack_item — so an agent can call them directly. A single-site live lookup (rather than this stored census) is also available as the free Website Tech Stack Checker.
Cite this
Crawlora (2026). Website Tech Stack Dataset. 1,000,000 sites fingerprinted from the Tranco top-1M. https://crawlora.net/datasets/techstack.
Search with AND / NOT
# Sites that use Shopify AND Klaviyo, but not WooCommerce
curl "https://api.crawlora.net/api/v1/datasets/techstack/search?technology=Shopify&technology=Klaviyo¬=WooCommerce" \
-H "x-api-key: $CRAWLORA_API_KEY"One site’s full stack
# One site's full detected tech stack
curl "https://api.crawlora.net/api/v1/datasets/techstack/items/shopify.com" -H "x-api-key: $CRAWLORA_API_KEY"Market share by dimension
# Market share by CDN (or category, cms, ecommerce, web_server, tld …)
curl "https://api.crawlora.net/api/v1/datasets/techstack/facets?facet=cdn" -H "x-api-key: $CRAWLORA_API_KEY"The same figures behind the bars above — plain and machine-readable for search engines and AI answer engines that cannot parse a chart.
| Category | Sites | Share of all sites |
|---|---|---|
| SSL/TLS | 747,212 | 74.7% |
| DNS provider | 559,704 | 56% |
| CDN | 527,853 | 52.8% |
| JavaScript library | 383,462 | 38.3% |
| Analytics | 370,521 | 37.1% |
| Web server | 344,247 | 34.4% |
| Tag manager | 326,369 | 32.6% |
| Font | 308,752 | 30.9% |
| UI framework | 259,717 | 26% |
| CMS | 242,607 | 24.3% |
| Security | 211,821 | 21.2% |
| Blog | 166,985 | 16.7% |
| Advertising | 155,055 | 15.5% |
| Email provider | 134,794 | 13.5% |
| Programming language | 130,926 | 13.1% |
| Web framework | 122,890 | 12.3% |
| Hosting | 119,186 | 11.9% |
| Social | 116,187 | 11.6% |
| JavaScript framework | 93,433 | 9.3% |
| SEO | 79,229 | 7.9% |
| Consent management | 77,811 | 7.8% |
| Ecommerce | 77,754 | 7.8% |
| Live chat | 48,474 | 4.8% |
| Marketing automation | 45,635 | 4.6% |
| Widgets | 42,010 | 4.2% |
| Technology | Sites | Share of all sites |
|---|---|---|
| Cloudflare edge/CDN | 375,539 | 37.6% |
| Cloudflare | 366,519 | 36.7% |
| Let's Encrypt | 339,096 | 33.9% |
| Google Tag Manager | 321,354 | 32.1% |
| jQuery | 290,411 | 29% |
| Google Trust Services | 280,976 | 28.1% |
| Google Fonts | 222,809 | 22.3% |
| Google Analytics | 215,857 | 21.6% |
| WordPress | 165,321 | 16.5% |
| Nginx | 157,628 | 15.8% |
| Bootstrap | 156,356 | 15.6% |
| Font Awesome | 153,944 | 15.4% |
| PHP | 130,926 | 13.1% |
| Microsoft 365 | 108,582 | 10.9% |
| Swiper | 102,977 | 10.3% |
| CMS | Sites | Share of CMS sites |
|---|---|---|
| WordPress | 157,986 | 65.1% |
| Drupal | 15,319 | 6.3% |
| Webflow | 7,816 | 3.2% |
| Adobe Experience Manager | 7,206 | 3% |
| Bitrix | 4,878 | 2% |
| TYPO3 | 4,188 | 1.7% |
| The Events Calendar | 4,001 | 1.6% |
| HubSpot CMS | 3,894 | 1.6% |
| Joomla | 3,570 | 1.5% |
| PrestaShop | 3,540 | 1.5% |
| Platform | Sites | Share of ecommerce sites |
|---|---|---|
| Shopify | 29,283 | 37.7% |
| WooCommerce | 25,958 | 33.4% |
| Magento | 6,430 | 8.3% |
| PrestaShop | 3,524 | 4.5% |
| OpenCart | 2,038 | 2.6% |
| Salesforce Commerce Cloud | 1,304 | 1.7% |
| BigCommerce | 1,175 | 1.5% |
| GoKwik | 960 | 1.2% |
| VTEX | 827 | 1.1% |
| Recharge | 815 | 1% |
| CDN | Sites | Share of CDN sites |
|---|---|---|
| Cloudflare edge/CDN | 358,277 | 67.9% |
| Amazon CloudFront | 42,850 | 8.1% |
| cdnjs | 26,489 | 5% |
| Google Hosted Libraries | 22,533 | 4.3% |
| jsDelivr | 14,912 | 2.8% |
| Fastly | 14,001 | 2.7% |
| Alibaba Cloud CDN | 11,604 | 2.2% |
| Akamai edge/CDN | 9,901 | 1.9% |
| Hostinger | 8,231 | 1.6% |
| Web server | Sites |
|---|---|
| Nginx | 157,052 |
| Apache | 102,688 |
| LiteSpeed | 44,729 |
| Microsoft IIS | 21,060 |
| OpenResty | 10,469 |
| Envoy | 2,711 |
| Tengine | 2,219 |
| Caddy | 1,515 |
| Kestrel | 891 |
| Cowboy | 573 |
| TLD | Sites | Share of all sites |
|---|---|---|
| .com | 424,270 | 42.4% |
| .net | 49,005 | 4.9% |
| .org | 37,915 | 3.8% |
| .ru | 37,579 | 3.8% |
| .uk | 30,892 | 3.1% |
| .de | 28,806 | 2.9% |
| .br | 17,544 | 1.8% |
| .jp | 16,495 | 1.6% |
| .nl | 13,776 | 1.4% |
| .in | 11,917 | 1.2% |
Query 1.0M fingerprinted sites — CMS, ecommerce, CDN, analytics and ~600 other technologies — through one REST API. Competitive intelligence, lead scoring, market-share research or migration targeting: clean JSON, pay on success.
The latest complete scan (top1m-2026-08-25-full-v2) fingerprinted 1,000,000 sites from the Tranco top-1M domain list, one record per domain. 847,491 (84.7%) resolved a working homepage; the rest were unreachable at scan time. A supplementary recheck pass recovers a further 0 of those on retry. Query without a run_id and you'll see a larger, inflated total — the index also holds two supplementary re-scan passes (a recheck of initially-unreachable domains, and a broader proxy re-scan) that share domains with the main pass; filter to a single run_id (or use the per-domain item lookup, which already resolves to one record) for an accurate one-row-per-domain count.
A pure HTML-signature + response-header detector (BuiltWith/Wappalyzer-style) fingerprints ~600 technologies across categories like CMS, ecommerce, analytics, CDN, web server, UI framework, tag manager, consent management, A/B testing, CAPTCHA, SSL/TLS certificates, DNS providers and email providers — reading loader-domain/asset-path patterns in the homepage HTML plus server response headers (nginx/Apache/IIS, Cloudflare/CloudFront/Fastly, PHP/ASP.NET/Rails). It is directional, not exhaustive: fully custom, unbundled first-party stacks with no recognizable asset URL or `<meta generator>` tag will under-detect.
The two datasets measure different things. This dataset detects whether a page's HTML embeds a CAPTCHA widget (reCAPTCHA, hCaptcha, Cloudflare Turnstile, Arkose Labs) — a static signal, present whether or not a scraper ever gets challenged. The Anti-Bot Adoption Index instead measures whether the scan itself was served a challenge when it tried to fetch the page — an active signal. They land in a similar range (14.3% here vs 9.4% there) but aren't the same measurement, and shouldn't be summed or directly diffed.
This dataset's scan is HTTP-tier only (render_tier=http) — it reads the server-delivered HTML and response headers, not a rendered DOM. That means it catches most trackers even when they load from an inline script (matched by loader domain in the raw HTML), but consent-gated scripts that only inject after a cookie-banner click, and technologies with no HTML/header fingerprint at all, won't show up. The `render_tier` field is reserved for a future browser-rendered pass.
Yes. Three endpoints: search (filter by technology, category, CMS, ecommerce, CDN, web server, TLD, reachability and more, with AND/OR/NOT technology matching), facets (market-share counts for any dimension) and items (one record by domain). All three are also exposed as MCP tools (datasets_techstack_search, datasets_techstack_facets, datasets_techstack_item) and billed pay-on-success.