Data study · August 25, 2026
We fingerprinted 1,000,000 Tranco top-1M domains — CDN, CMS, ecommerce, SSL/TLS issuer, DNS provider, analytics and more — then split the same census by traffic rank. The top 1,000 sites run a different stack than everyone else.
52.8%
of all 1,000,000 domains route through a CDN — Cloudflare alone is 67.9% of that.
65.1%
of every CMS site is WordPress
2.7×
bot-mgmt gradient, top vs. tail
Tranco top-1M — snapshot August 25, 2026, detector 2026.10.47.
52.8%
of all 1,000,000 domains route through a CDN — and Cloudflare alone is 67.9% of that category.
2.7×
more likely the top 1,000 sites run enterprise bot management than the 100K–1M tail (26.3% vs 9.8%).
73.2%
of reachable sites are secured by a free, automated certificate authority— Let’s Encrypt or Google Trust Services.
56.4%
of reachable sites show no detectable analytics tag at all — no Google Analytics, no Meta Pixel, nothing our detector recognizes.
Route through a CDN and you're in the majority: 52.8% of all 1,000,000 sites do, the largest single category in the whole fingerprint. Inside that category, Cloudflare isn't a leader — it's nearly the entire market.
Technology category prevalence
CDN vendor share (within the CDN category)
Split the same census by Tranco rank band and two pairs of numbers move in opposite directions: technologies associated with well-funded, professionally engineered sites concentrate at the top, while technologies associated with the self-serve, managed-platform web climb toward the tail.
| Rank band | n | Bot management | React frameworks | WordPress | Cloudflare CDN |
|---|---|---|---|---|---|
| Top 1,000 | 763 | 26.3% | 16.4% | 10.6% | 20.8% |
| 1K–10K | 7,397 | 21% | 14.1% | 12.4% | 32.8% |
| 10K–100K | 75,185 | 15.6% | 11.1% | 17% | 38% |
| 100K–1M | 764,146 | 9.8% | 6% | 19.8% | 42.2% |
Counter-intuitively, the average number of detected technologies per site rises toward the tail (6.91 at the very top vs. 7.8 in the 100K–1M band) — the biggest sites run a leaner stack, not a heavier one. Full writeup: We Fingerprinted the Top 1,000,000 Websites.
Let's Encrypt and Google Trust Services — both free, both fully automated — together secure 73.2% of reachable sites (620,072 domains). Every paid commercial CA that shows up at all is a rounding error by comparison.
Beyond its CDN dominance, Cloudflare is also the most common DNS provider (65.5% of the 559,704 reachable sites with a detected DNS provider) — on top of its bot-management product tracked separately above. One company, three layers of shared internet infrastructure.
366,519 domains
88,787 domains
39,833 domains
12,601 domains
The same vendor, two different layers
WordPress alone accounts for 65.1% of every site with a detected CMS. Ecommerce is the one category where its dominance doesn't fully carry over: WooCommerce (a plugin bolted onto WordPress) still lands almost tied with Shopify.
CMS share (within the CMS category)
Ecommerce share (within the ecommerce category)
56.4% of reachable sites (477,615) show no detected analytics tool at all. Among the sites that do track, surveillance-style tools dominate: Google Analytics and Meta Pixel alone outnumber every privacy-focused analytics tool we track combined.
16.9% of reachable sites (142,882) embed a CAPTCHA widget by static HTML fingerprint. Crawlora's separately-run Anti-Bot Adoption Index — a completely different detection method (challenge-response probing, not static HTML) — measured 9.4% of a different top-1M reachable set. Two independent methods landing within a point of each other is strong evidence neither number is a detector artifact.
The same figures behind the charts — plain HTML tables, easy to copy and machine-readable for search engines and AI answer engines that can't parse a chart.
| Category | Domains | Share |
|---|---|---|
| CDN | 527,853 | 52.8% |
| JavaScript library | 383,462 | 38.3% |
| Analytics | 370,521 | 37.1% |
| Web server | 344,247 | 34.4% |
| Tag manager | 326,369 | 32.6% |
| Font | 308,752 | 30.9% |
| UI framework | 259,717 | 26% |
| CMS | 242,607 | 24.3% |
| Security | 211,821 | 21.2% |
| Blog | 166,985 | 16.7% |
| Advertising | 155,055 | 15.5% |
| Email provider | 134,794 | 13.5% |
| Programming language | 130,926 | 13.1% |
| Web framework | 122,890 | 12.3% |
| Hosting | 119,186 | 11.9% |
| Social | 116,187 | 11.6% |
| JavaScript framework | 93,433 | 9.3% |
| SEO | 79,229 | 7.9% |
| Ecommerce | 77,754 | 7.8% |
| Issuer | Domains | Share |
|---|---|---|
| Let's Encrypt | 339,096 | 45.4% |
| Google Trust Services | 280,976 | 37.6% |
| Amazon (ACM) | 46,939 | 6.3% |
| DigiCert | 46,840 | 6.3% |
| Sectigo | 33,361 | 4.5% |
| Provider | Domains | Share |
|---|---|---|
| Cloudflare | 366,519 | 65.5% |
| Amazon Route 53 | 88,787 | 15.9% |
| GoDaddy | 39,833 | 7.1% |
| Akamai Edge DNS | 12,601 | 2.3% |
We fingerprinted the Tranco top-1,000,000 domain list — one HTTP-tier fetch of each domain’s homepage (no browser render), matched against a ~540-signature technology database reading HTML markup, script/stylesheet URLs, and response headers. 84.7% (847,491 of 1,000,000) resolved a working homepage.
Rank bands(top 1,000 / 1K–10K / 10K–100K / 100K–1M) are a pinned snapshot, not a live query — the public dataset API sorts by rank but has no rank-range filter, so this specific cut isn’t queryable through the REST API the rest of the dataset is. Homepage-only. This sees what a plain request to / returns, not what loads behind a login or on a checkout page — payment processors and app-specific integrations are structurally under-counted here.
The aggregate rollups behind this page are open under CC BY 4.0. Snapshot dated August 25, 2026, detector version 2026.10.47, run top1m-2026-08-25-full-v2.
Cite this
Crawlora (2026). Tech Stack Index. 52.8% of 1,000,000 Tranco top-1M domains route through a CDN; Cloudflare fronts 67.9% of that category. https://crawlora.net/tech-stack-index.
Cloudflare, by a wide margin. Fingerprinting the Tranco top-1M, Cloudflare fronts 67.9% of the CDN category and 358,277 domains overall — roughly 9x the next-largest named CDN, Amazon CloudFront.
Yes, sharply. Splitting the same census by Tranco rank band, enterprise bot management falls from 26.3% of the top 1,000 sites to 9.8% of the 100K-1M tail (a 2.7x gradient), and React meta-frameworks (Next.js and its siblings) fall the same way. WordPress runs the opposite direction, from 10.6% of the top 1,000 up to 19.8% of the tail.
Two free, automated certificate authorities dominate: Let's Encrypt and Google Trust Services together secure 73.2% of reachable sites (620,072 domains) - more than every paid commercial CA (DigiCert, Sectigo, GoDaddy, Amazon ACM) combined.
WordPress runs 24.3% of the whole 1,000,000-domain dataset and 65.1% of every site with a detected CMS. No other CMS breaks 7% of the CMS category - Drupal is a distant second.
43.6% of reachable sites show at least one detected analytics tool; 56.4% (477,615 sites) show none our detector recognizes. Among sites that do track, Google Analytics (215,857 sites) and Meta Pixel (70,653) dominate; every privacy-focused analytics tool we track (Matomo, Plausible, PostHog, Fathom) combined reaches only 15,561 sites.
Homepage HTML and response headers for the Tranco top-1,000,000 domains were fingerprinted against a ~540-signature technology database (CDN, CMS, ecommerce, SSL/TLS issuer, DNS provider, analytics, web server and more). 84.7% of domains resolved a working homepage; every figure is scoped to a single scan pass (top1m-2026-08-25-full-v2) to avoid double-counting.
This index is a snapshot of 1,000,000domains. Crawlora’s Tech Stack API and free checker tool let you fingerprint any individual site on demand — CDN, CMS, analytics, and web server in one call.