Download websites that use Clockwork

About Clockwork

Nobody installs a debugging toolbar so that strangers can read it. Written in PHP and published under the MIT license since 2013, Clockwork lives inside a running application and records timings, database queries, log output and request payloads, then hands the collection to a browser extension or a standalone viewer. On a developer laptop that is precisely the point. On a public host it becomes a description of the application's internals, available to anyone who thinks to ask for it.

A detection therefore carries two readings at once. One is technical: the site runs a PHP application, almost certainly built on one of the frameworks the toolbar hooks into, which narrows the stack far more than a server banner does. The other is procedural: a configuration meant for local work reached production with its instrumentation left switched on, or a staging host was published to the open internet without anyone noticing. Neither reading flatters the operator, and both are useful if your work involves finding places where configuration has drifted.

Because the toolbar ships as a library rather than a hosted tag, its version is part of the fingerprint. We currently separate 29 distinct release strings across the installations that respond, with 5.3.3 as the common reading. A spread of that width on a developer dependency usually means the package was pinned once when the project began and then left alone, which is a statement about maintenance habits as much as about the package.

Detection is inferential here, and it undercounts. The toolbar can be installed with its interface disabled, restricted by address, routed to a port nobody scans, or enabled only when a debug flag is set, and in each of those cases the application is instrumented while nothing reaches us. Counting Clockwork means counting the installations that answer, not the installations that exist. As of October 2026 we record it on 284 sites, and the figure deserves to be read as a floor rather than a census.

The downloadable list answers a question that checking one domain at a time cannot. A single lookup tells you whether a particular host is exposed. The full population tells you how common the exposure is, which hosting providers and which framework communities it concentrates in, and whether the count moves as maintainers tighten their defaults. Security researchers use a list like this to size a class of misconfiguration before deciding whether it is worth a report. Vendors selling profiling, error tracking or application monitoring into the PHP world read the same rows as a map of teams that already instrument their code and have reached for a free option first.