Download websites that use CherryPy

About CherryPy

A web framework that predates most of the modern web is a strange thing to find in a live crawl, and yet CherryPy keeps showing up. Written in Python and public since 2002, it belongs to a generation of frameworks that assumed you would run your own server process and talk to it directly, which is exactly what it does. An application built on it ships with its own multi-threaded HTTP server rather than borrowing one from the environment around it.

The self-contained design explains where the framework survives. It is rarely the choice for a new consumer-facing website. Detections turn up on internal tools, appliance and device interfaces, control panels, scientific and instrumentation software, and long-lived applications whose authors wanted a small dependency and no framework opinions about templating or storage. A hit is therefore less likely to be a marketing site and more likely to be something operational that happens to be reachable over the web.

As of October 2026 we detect it on 162 sites, and the version spread says more than the total does. We currently observe 16 distinct version strings in production, with 17.4.2 the one reported by the largest number of installations. A fragmentation figure like that across a population of this size means deployments are pinned rather than tracked. Nobody is upgrading these applications on a schedule, because for the most part nobody is developing them any more. They were built, they worked, and they were left running.

Which is precisely why the list has commercial and research value. A framework version that has stopped moving is a proxy for an application that has stopped receiving attention, and an unattended service exposed to the internet is a security question, a migration opportunity and an infrastructure liability at the same time. Security researchers want the population in order to scope exposure. Hosting and consulting firms want it to find modernisation work. Anyone maintaining a Python runtime wants to know which interpreter generations are still being kept alive underneath.

There is no vendor row here, and the absence is meaningful rather than a hole in our data. The project has been developed by a community under a BSD licence since its first release, with no company, no licence server and no download registry behind it. Nobody has a customer list to sell you, and nobody ever knew how many installations existed. Measuring the running web is the only method available.

Detection has honest limits. We identify the framework from the server headers and response characteristics its built-in server exposes, and where a deployment sits behind a reverse proxy that rewrites or strips those headers, we see the proxy and not the application. Version strings behave the same way, present only when the server chooses to disclose them. Both effects bias the visible population toward the less carefully configured end of the estate, and the bias runs in one direction, so our counts are a floor.

The export publishes the raw version string observed against each domain, alongside the rest of the stack on that host, which is what turns a framework census into something you can actually query.