Download websites that use Grav

Detecting a content management system normally means detecting a database application. Grav is the exception that makes the boundary of the category visible. Content lives as Markdown files on disk, there is no database to install or migrate, and a whole deployment can be copied, versioned in git and rolled back like any other directory of source files.

RocketTheme released it in 2014 under a MIT licence, written in PHP and templated with Twig. The combination says a lot about who runs it. A CMS with no database and a file-based content tree is chosen by people who are comfortable on a server, who want documentation sites, developer portfolios and small marketing sites to deploy straight from a repository, and who are not shopping for a marketplace of one-click plugins. Free licensing also means there is no purchase event behind an install, so the operator is self-directed rather than procured, and the hosting is usually plain shared or virtual server space rather than a managed platform tuned for one specific application.

Version reporting is unusually informative here. We separate 6 distinct version strings across the base, and 0.9.39 still turns up across a substantial part of it, a string from an early release series that predates much of the current plugin ecosystem. A flat-file site is easy to leave running untouched, because nothing breaks the way a database migration breaks, and the version spread is the visible consequence of that comfort.

As of October 2026 we detect Grav on 12,693 sites. The list earns its keep whenever the question is about a population rather than a domain: which hosting providers concentrate flat-file PHP deployments, how large the un-updated tail really is for security research, or which agencies have standardised on it across a portfolio of client sites. Checking one address at a time answers none of those. The same list also serves the reverse pitch, since a vendor of managed hosting or of a database-backed platform is looking at operators who chose to run their own files and would need a concrete reason to stop.

Two limits are worth stating plainly. A generator tag can be removed and a version string can be suppressed, so the version breakdown covers only the installs that still advertise one, and sites served entirely from a page cache or a static export of the same content may expose nothing recognisable at all. The site figure is a floor, not a headcount.