Download websites that use Cloudflare

About Cloudflare

Adopting Cloudflare installs nothing. A change of nameservers is the entire deployment, which is why a detection here records a decision rather than a piece of software. Somebody chose to put their traffic behind a third party, and that is a different class of fact from a software version and should be read differently.

As of September 2026 that decision has been made on 71,185,874 of the domains we track. At that volume the presence of the service tells you almost nothing on its own, because the population includes personal blogs and payment infrastructure in the same bucket. The signal is in the combinations.

The country breakdown is where this distinction bites hardest. United States accounts for 46,385,079 of the domains we see it on, and read carelessly that looks like a statement about where the customers are. The column does not mean that. It describes where requests are terminated, which follows the service's own network layout rather than the geography of the businesses using it. Anyone building a territory plan off that column will build it wrong.

The .com zone leads the TLD split, and that one is closer to being meaningful. Commercial domains adopt reverse proxies earlier than personal ones, because the pain that drives adoption tends to arrive with revenue.

There is a second-order use that matters more than the headline. A site behind a proxy still runs something at the origin, and a large share of those origins remain fingerprintable through headers, error pages and asset paths that the proxy passes through unchanged. Knowing which sites sit behind the service, and what they are still running underneath it, is a substantially more valuable question than either half alone. It is also a question you cannot answer from any public directory, because nobody publishes it.

The same applies to movement. Sites arrive at a proxy and sites leave, and both events correlate with things worth knowing about: a migration, a growth threshold crossed, a security incident, a change of agency. A single snapshot cannot see any of that. A list you can diff against last week can.

The webatla export is built for exactly that use. Every domain we detect it on, with the origin technologies we could still identify, the hosting country, the TLD and everything else on the same row, delivered as one file and rebuilt daily. Comparing two rebuilds is a local operation.

The reverse question is often the more valuable one. Rather than asking who is behind the proxy, ask which sites in a segment you care about are not, because that population is usually smaller, easier to reach and frequently in the middle of the exact problem the service solves. A list that only contains adopters cannot express that question at all.

There is also a data quality point worth stating openly. Because the service sits in the request path, it can mask or normalise the signals we would otherwise use to fingerprint the origin. Our detections underneath a proxy are therefore a floor rather than a complete picture, and we would rather say that than present a partial view as a census. Where we could not identify an origin technology, the row says so instead of guessing.

Cloudflare Inc. runs the service commercially, which is why the Proprietary label reads the way it does, and it has been operating since 2010. Because the service is bought rather than installed, its adoption curve behaves more like a market than like a software ecosystem, and that is worth remembering when you interpret any number attached to it.