Data study · August 20, 2026
We fingerprinted 965,200 Tranco top-1M domains — CDN, CMS, ecommerce, SSL/TLS issuer, DNS provider, analytics and more — then split the same census by traffic rank. The top 1,000 sites run a different stack than everyone else.
48.1%
of all 965,200 domains route through a CDN — Cloudflare alone is 75.9% of that.
73.1%
of every CMS site is WordPress
3.3×
bot-mgmt gradient, top vs. tail
Tranco top-1M — snapshot August 20, 2026, detector 2026.10.20.
48.1%
of all 965,200 domains route through a CDN — and Cloudflare alone is 75.9% of that category.
3.3×
more likely the top 1,000 sites run enterprise bot management than the 100K–1M tail (23.2% vs 7%).
75.8%
of reachable sites are secured by a free, automated certificate authority— Let’s Encrypt or Google Trust Services.
48.8%
of reachable sites show no detectable analytics tag at all — no Google Analytics, no Meta Pixel, nothing our detector recognizes.
Route through a CDN and you're in the majority: 48.1% of all 965,200 sites do, the largest single category in the whole fingerprint. Inside that category, Cloudflare isn't a leader — it's nearly the entire market.
Technology category prevalence
CDN vendor share (within the CDN category)
Split the same census by Tranco rank band and two pairs of numbers move in opposite directions: technologies associated with well-funded, professionally engineered sites concentrate at the top, while technologies associated with the self-serve, managed-platform web climb toward the tail.
| Rank band | n | Bot management | React frameworks | WordPress | Cloudflare CDN |
|---|---|---|---|---|---|
| Top 1,000 | 737 | 23.2% | 14.8% | 7.3% | 22.5% |
| 1K–10K | 7,202 | 16.9% | 13% | 10.1% | 33.3% |
| 10K–100K | 72,092 | 11.3% | 10.3% | 15.4% | 39.8% |
| 100K–1M | 694,413 | 7% | 5.9% | 19.3% | 45.7% |
Counter-intuitively, the average number of detected technologies per site rises toward the tail (5.24 at the very top vs. 6.42 in the 100K–1M band) — the biggest sites run a leaner stack, not a heavier one. Full writeup: We Fingerprinted the Top 1,000,000 Websites.
Let's Encrypt and Google Trust Services — both free, both fully automated — together secure 75.8% of reachable sites (587,277 domains). Every paid commercial CA that shows up at all is a rounding error by comparison.
Beyond its CDN dominance, Cloudflare is also the most common DNS provider (68.9% of the 468,163 reachable sites with a detected DNS provider) — on top of its bot-management product tracked separately above. One company, three layers of shared internet infrastructure.
322,721 domains
68,211 domains
4,409 domains
38,237 domains
WordPress alone accounts for 73.1% of every site with a detected CMS. Ecommerce is the one category where its dominance doesn't fully carry over: WooCommerce (a plugin bolted onto WordPress) still lands almost tied with Shopify.
CMS share (within the CMS category)
Ecommerce share (within the ecommerce category)
48.8% of reachable sites (378,228) show no detected analytics tool at all. Among the sites that do track, surveillance-style tools dominate: Google Analytics and Meta Pixel alone outnumber every privacy-focused analytics tool we track combined.
8.8% of reachable sites (68,229) embed a CAPTCHA widget by static HTML fingerprint. Crawlora's separately-run Anti-Bot Adoption Index — a completely different detection method (challenge-response probing, not static HTML) — measured 9.4% of a different top-1M reachable set. Two independent methods landing within a point of each other is strong evidence neither number is a detector artifact.
The same figures behind the charts — plain HTML tables, easy to copy and machine-readable for search engines and AI answer engines that can't parse a chart.
| Category | Domains | Share |
|---|---|---|
| CDN | 464,118 | 48.1% |
| JavaScript library | 327,542 | 33.9% |
| Tag manager | 302,470 | 31.3% |
| Analytics | 301,737 | 31.3% |
| Font | 278,343 | 28.8% |
| UI framework | 230,965 | 23.9% |
| CMS | 200,186 | 20.7% |
| Web server | 149,507 | 15.5% |
| Ecommerce | 68,009 | 7% |
| Issuer | Domains | Share |
|---|---|---|
| Let's Encrypt | 325,744 | 46.2% |
| Google Trust Services | 267,834 | 38% |
| Amazon (ACM) | 45,158 | 6.4% |
| DigiCert | 43,731 | 6.2% |
| GoDaddy | 38,237 | 5.4% |
| Sectigo | 30,031 | 4.3% |
| Provider | Domains | Share |
|---|---|---|
| Cloudflare | 322,721 | 68.9% |
| Amazon Route 53 | 68,211 | 14.6% |
| NS1 | 4,409 | 0.9% |
| GoDaddy | 38,237 | 8.2% |
We fingerprinted the Tranco top-1,000,000 domain list — one HTTP-tier fetch of each domain’s homepage (no browser render), matched against a ~540-signature technology database reading HTML markup, script/stylesheet URLs, and response headers. 80.2% (774,444 of 965,200) resolved a working homepage.
Rank bands(top 1,000 / 1K–10K / 10K–100K / 100K–1M) are a pinned snapshot, not a live query — the public dataset API sorts by rank but has no rank-range filter, so this specific cut isn’t queryable through the REST API the rest of the dataset is. Homepage-only. This sees what a plain request to / returns, not what loads behind a login or on a checkout page — payment processors and app-specific integrations are structurally under-counted here.
The aggregate rollups behind this page are open under CC BY 4.0. Snapshot dated August 20, 2026, detector version 2026.10.20, run top1m-2026-08-20-full.
Cite this
Crawlora (2026). Tech Stack Index. 48.1% of 965,200 Tranco top-1M domains route through a CDN; Cloudflare fronts 75.9% of that category. https://crawlora.net/tech-stack-index.
Cloudflare, by a wide margin. Fingerprinting the Tranco top-1M, Cloudflare fronts 75.9% of the CDN category and 352,438 domains overall — roughly 9x the next-largest named CDN, Amazon CloudFront.
Yes, sharply. Splitting the same census by Tranco rank band, enterprise bot management falls from 23.2% of the top 1,000 sites to 7% of the 100K-1M tail (a 3.3x gradient), and React meta-frameworks (Next.js and its siblings) fall the same way. WordPress runs the opposite direction, from 7.3% of the top 1,000 up to 19.3% of the tail.
Two free, automated certificate authorities dominate: Let's Encrypt and Google Trust Services together secure 75.8% of reachable sites (587,277 domains) - more than every paid commercial CA (DigiCert, Sectigo, GoDaddy, Amazon ACM) combined.
WordPress runs 20.7% of the whole 965,200-domain dataset and 73.1% of every site with a detected CMS. No other CMS breaks 7% of the CMS category - Drupal is a distant second.
51.2% of reachable sites show at least one detected analytics tool; 48.8% (378,228 sites) show none our detector recognizes. Among sites that do track, Google Analytics (193,357 sites) and Meta Pixel (60,434) dominate; every privacy-focused analytics tool we track (Matomo, Plausible, PostHog, Fathom) combined reaches only 13,291 sites.
Homepage HTML and response headers for the Tranco top-1,000,000 domains were fingerprinted against a ~540-signature technology database (CDN, CMS, ecommerce, SSL/TLS issuer, DNS provider, analytics, web server and more). 80.2% of domains resolved a working homepage; every figure is scoped to a single scan pass (top1m-2026-08-20-full) to avoid double-counting.
This index is a snapshot of 965,200domains. Crawlora’s Tech Stack API and free checker tool let you fingerprint any individual site on demand — CDN, CMS, analytics, and web server in one call.