- WebPulse's June 2026 scan found Joomla on 352,042 sites, 3.5% of all framework detections at the 10-million-site scale, more than Astro, SvelteKit and Hugo combined (about 200,000).
- WebPulse says this reflects a migration gap, not Joomla's strength: many sites were built, left unmaintained, and keep running by inertia, on an aging system with a known history of security flaws.
- Organizations running Joomla, often without knowing it, should check their sites and plan a move off the aging system. WebPulse scores Joomla 38 out of 100.
Joomla occupies a strange position in the framework landscape: too dead to recommend, too alive to ignore. WebPulse detects Joomla on 352,042 sites — 3.5% of all framework detections at the 10-million-site scale.
Dead Framework, Live Sites
The Zombie Pattern
Joomla sites follow a pattern WebPulse sees across legacy frameworks: they were built, they worked, the original developer left, and nobody migrated them. They're not maintained — they're running. The site loads, the contact form works, the SSL certificate auto-renews. Nothing seems broken until something breaks.
These 352,000 sites are technical debt that nobody is tracking. Each one runs an aging CMS with an active CVE history, managed by organizations that often don't know what Joomla is.
The Comparison That Matters
The fact that Joomla outnumbers Astro, SvelteKit, and Hugo combined says less about Joomla's strength and more about the migration gap. Modern frameworks are winning new projects. Legacy frameworks are winning by inertia. At 352,000 sites, Joomla's inertia is formidable.
Produced by the WebPulse Newsroom with AI assistance and checked against our data by our editorial review. How we use AI.
