The higher a site ranks, the more likely it runs a modern framework
Among the Tranco top 1,000, 72.6% of the sites where we could identify the platform run a modern framework. Across the top 100,000 it is 54.2%, and on the wider web 17.5%. The biggest sites have largely moved on. Most of the web has not.
Modern frameworks thin out as you go down the rankings
Modern share of sites with an identified platform, within each rank band. Hollow points rest on fewer than 50 identified sites.
Show as a table
| Rank band | Identified | Modern | Legacy |
|---|---|---|---|
| Top 100 | 19 | 89.5% | 10.5% |
| 101–300 | 34 | 55.9% | 44.1% |
| 301–1,000 | 162 | 74.1% | 25.9% |
| 1,001–3,000 | 521 | 63.1% | 36.9% |
| 3,001–10,000 | 1,827 | 61.7% | 38.0% |
| 10,001–30,000 | 5,610 | 56.1% | 43.7% |
| 30,001–100,000 | 19,548 | 52.5% | 47.4% |
| Cumulative | |||
| Top 100 | 19 | 89.5% | 10.5% |
| Top 1,000 | 215 | 72.6% | 27.4% |
| Top 10,000 | 2,563 | 62.9% | 36.9% |
| Top 100,000 | 27,721 | 54.2% | 45.7% |
| Wider web | 10,002,735 | 17.5% | 82.5% |
Next.js leads the top 10,000. Below that, WordPress takes over.
Share of identified sites for the twelve most common platforms in each dataset. The two charts use different scales.
10,368 sites
6,413 sites
1,994 sites
1,622 sites
1,278 sites
1,067 sites
923 sites
832 sites
732 sites
573 sites
282 sites
256 sites
7,427,780 sites
777,276 sites
444,706 sites
352,042 sites
263,488 sites
165,015 sites
122,141 sites
87,361 sites
79,322 sites
64,281 sites
53,500 sites
40,151 sites
Which platforms have flaws confirmed as exploited
Entries in CISA's Known Exploited Vulnerabilities catalog matched to each platform's NVD product identifier. A KEV entry means attacks were seen in the wild.
13 CVEs in the last 12 months
64 CVEs in the last 12 months
3 CVEs in the last 12 months
9 CVEs in the last 12 months
66 CVEs in the last 12 months
40 CVEs in the last 12 months
39 CVEs in the last 12 months
5 CVEs in the last 12 months
No KEV entries: Django, Vue, Angular, Hugo, Astro, Nuxt, SvelteKit, Flask, htmx, Gatsby, Laravel, FastAPI, Remix, Eleventy. A platform with no entries is not free of vulnerabilities; see the CVE database for published flaws.
How to read these numbers
Percentages are of identified sites. We identified a platform on 37.2% of the Tranco sites that responded. The rest use custom stacks, sit behind CDNs that hide the platform, or run something we don't detect. "54.2% modern" means 54.2% of identified sites, not of the web.
Some platforms are easier to see. WordPress leaves strong signatures in HTML, so it is identified more reliably than most platforms. Server frameworks such as Spring and Laravel can only be seen through HTTP headers and cookies.
The wider web uses HTML only. The Common Crawl census (10,002,735 detections, processed 2026-06-05) reads archived HTML without HTTP headers, so it undercounts header-only frameworks. Each domain counts once, regardless of traffic.
Corrected in September 2026. Our detector used to count any session cookie as evidence of Drupal and some server frameworks. We fixed it, re-scanned, and replaced the affected figures. Earlier versions of this page overstated Drupal and legacy shares. Full methodology.