Download websites that use Envoy

About Envoy

Envoy was written to solve a problem inside one company's fleet: too many services calling each other across a network nobody could see into. Filed under Reverse proxies, the software is an application layer proxy that sits in front of or between services, handling load balancing, retries, circuit breaking, traffic routing and TLS termination, and it is the component that many service mesh, ingress and API gateway products run as their data plane.

Nobody publishing a website picks Envoy the way they pick a CMS. A platform team picks it, or it arrives underneath a managed gateway, an API product or a hosting platform bought for entirely different reasons. Detecting the proxy on a domain is therefore an organisational signal more than a technical one. Behind that domain there is very likely a container orchestrated backend, a team that owns request routing as a discipline, and an infrastructure budget that a shared hosting customer does not have.

Cloud Native Computing Foundation has stewarded the project since it was contributed by the engineering team that wrote it, and the Apache 2.0 licence together with a C++ implementation makes it something vendors can embed and resell without asking permission, which is a large part of how it spread. Released in 2016, the proxy became a common answer to service to service traffic management quickly enough that its name now turns up inside products that never mention it in their marketing.

As of October 2026 we detect Envoy on 274,453 sites, with 171,570 of those assigned to United States and the domain mix leaning towards .com. Concentration in one country reflects where cloud native engineering is concentrated and where the vendors who embed the proxy sell hardest, and probably also where operators are least inclined to bother stripping identifying response headers.

The last point deserves to be stated plainly rather than buried. Detection here is inferential. We read response header signatures and error page fingerprints that the proxy emits by default, and any operator can rename or remove them with a line of configuration. Sites behind a content delivery network that terminates the connection first may never reveal the proxy at all. The recorded count is a floor, and a hit tells you the proxy answered, not whether the team runs it themselves or inherited it inside a managed product, a distinction we cannot make from outside.

For infrastructure, observability and security vendors the value of the list is that it identifies organisations by how they operate rather than by what they publish. A single lookup confirms one header on one domain. A population lets you size the addressable set of platform teams, correlate the proxy with the clouds and frameworks it appears beside, and watch that set grow or shift between refreshes, which is the question anyone selling into cloud native infrastructure is actually asking.