Download websites that use Express

About Express

Any count of Express on the public web is a lower bound, and ours is no exception. Detection depends on a server admitting what it runs. A default installation announces itself in a response header, a hardened one removes that header in a single line of configuration, and the framework is otherwise invisible from outside. Nothing in the HTML has to change. Nothing in the URL structure has to change. The sites we can confirm are therefore, disproportionately, the sites that never went through a hardening pass.

The bias is useful once you know it is there. A domain that leaks its framework is a domain running close to defaults, which correlates with small teams, internal tools, prototypes that quietly became production, and agencies shipping quickly. For a security researcher the same population is the one worth studying, because default configuration rarely stops at one setting. For anyone selling monitoring, hosting, error tracking or application security, an undercounted list of confirmed installations is still a list of confirmed installations, and every entry is a running service rather than a static page. An honest lower bound with a known bias is worth more than a confident total assembled from guesswork.

Presence of Express tells you the shape of the backend, which is rare information. Most technology detection describes the browser side, so a list built from a server side Web frameworks signal moves you behind the page. A site running this framework has a process to keep alive, a package manager, a dependency tree, and a deployment that involves running code rather than uploading files. Applications with a build pipeline, a webhook receiver, an API or server rendered pages land here. Brochure sites generally do not.

OpenJS Foundation stewards the project and the code is MIT, which is a large part of why it spread. Free to use since 2010 and small enough to read in an afternoon, the framework became the layer other frameworks were built on rather than a rival to them. A consequence for research is that a detection often means an inherited stack rather than a direct choice. A team may have picked a higher level tool and acquired the header with it, so segmentation should always pair this signal with whatever else the domain reports.

As of September 2026 we see the framework on 965,939 sites, with 647,694 in United States and .com as the suffix that recurs across the set. Geography here reflects where servers answer, and cloud regions in one country host applications owned in many others, so the country column is a hosting fact first and a market fact second. The downloadable list is the part a per domain lookup cannot replace. Checking one site tells you what one site runs. The full set lets you ask which of these domains also carry a payment provider, which sit behind a particular delivery network, which use a suffix implying a national market, and how the population shifts between exports. Direction survives an incomplete count even when the absolute figure does not, and direction is usually the question being asked.