Download websites that use Caddy

About Caddy

Start with the oddity in the geography, because it is the quickest way into what this technology means. A web server written in a systems language, promoted through developer forums and container tutorials, shows a footprint weighted towards Germany and towards .de domains rather than towards the English-language web where its documentation and community largely sit. Concentration like that usually means a technology travelled through a particular professional culture rather than through a vendor's sales force.

Caddy is Web servers released under the Apache 2.0 license and available since 2015, and its defining decision was to obtain and renew encryption certificates automatically, with no configuration at all. Competing servers made encryption possible. The design here made encryption the default and turning it off the deliberate act. The configuration file is written to be read by a human rather than generated by a tool, which is a preference that says something about who chooses it.

Who chooses it, in practice, is the operator rather than the site owner. Nobody buys this server. Somebody sets it up, usually the same person who administers the machine, writes the container definition, or maintains the reverse proxy in front of an application. A site running behind it is very likely self-hosted or hosted by a small technical provider, and it is unlikely to be sitting on a mass-market shared plan. Presence is a strong indicator of an in-house or contracted technical owner.

The national weighting is consistent with that reading. Germany and the wider German-speaking market have a deep population of small technical hosting companies, agencies that run their own hardware, and privacy-conscious operators who prefer not to place a foreign proxy in front of every request. A server that automates certificates and runs happily on one machine fits that culture better than it fits a market where nearly everything terminates at a large edge network.

Attribution rests mainly on the response header the server sends, and that is a weaker foundation than it sounds. Operators strip the header as routine hygiene. Reverse proxies and delivery networks overwrite it with their own. A server used purely as an internal proxy behind something public never announces itself. Our count should be read as sites where the server is both in use and visible, which is a subset of real deployments, and the invisible remainder is not something anyone can size honestly from outside.

As of September 2026 the visible footprint is 1,667,737 sites, with 611,565 in Germany. The population is interesting precisely because it is self-selected. For anyone selling infrastructure tooling, certificate management, monitoring, or developer products, a list of sites running an opinionated modern server is a list of technically confident buyers who already made an unconventional choice once and survived it. A lookup on a single domain cannot produce that list. Only an export can, and only an export can show whether the population is growing, where it is growing, what else those operators run alongside it, and which hosting companies are quietly standardising on it underneath their own branding.