Download websites that use Hotaru CMS

About Hotaru CMS

Software does not vanish when its project stops, it just stops being updated while the sites already running it stay online, and a crawl keeps finding them years later. Hotaru CMS is one of those. Our index classes it as CMS, written in PHP, released under GPL v2, and dating from 2009, when social bookmarking and community news sites were a genre worth building a plugin architecture for.

The architecture is the part worth understanding. A small core extended by plugins is what made the project attractive to developers at the time, and it is what makes a surviving install hard to reason about now, because two sites on the same version can expose entirely different code paths depending on which plugins are switched on. A fingerprint identifies the core and says nothing about the surface bolted onto it.

A hit here is a particular kind of finding. An open source PHP application that nobody maintains is still executing on a public host, without security patches, on a language runtime that has almost certainly moved past what the code expects, and often without the operator being aware of what the site is running at all. The commercial reading is thin, since there is no vendor to sell against and no contract to displace. The security reading is not thin at all, and it is the reason an entry like this stays in the index.

As of October 2026 the index records Hotaru CMS on 1 site, and the figure understates what is still out there for reasons that apply to every abandoned platform. Themes strip the generator tags a fingerprint depends on, legacy installs sit on subdomains and parked hosts that a crawl does not prioritise, and a dormant site may serve a cached or flattened page carrying none of the signatures the live application would emit. The count is evidence that the software persists rather than a census of where.

Checking one domain answers one question about one site. The downloadable dataset answers which hosts across an entire crawl still run a content management system nobody patches, which providers host them, and which countries and top level domains they concentrate in. Assembling that inventory by lookup would require already knowing the domains, which is the thing the list is for.