Download websites that use Imperva

About Imperva

A security appliance in front of a website is bought by a company that has already decided it is a target. Nobody puts a commercial web application firewall in the request path for aesthetic reasons, so the detection carries a budget and a risk assessment behind it.

Imperva has been selling that assessment since 2002, and Imperva delivers it as a Proprietary service, mostly as a reverse proxy, which is the reason it is visible at all. A protective layer terminating connections announces itself through headers, error pages and certificate handling, without the site owner choosing to advertise anything. As of September 2026 we detect it on 100,367 sites.

United States accounts for 91,914 of those detections, close to the whole population and unusual even among enterprise security products. The concentration is not about where attacks come from. Enterprise security budget, compliance regimes that require an inspecting layer, and a direct sales motion all sit in the same market, so the deployment map follows the sales map. The .com zone carries most of the rest for the same reason, since organisations of this size register commercially.

What the marker says about an individual site is fairly precise. Somebody assessed the property as worth protecting, a budget was approved, and the site is large or regulated enough to justify a traffic-based contract. Financial services, healthcare, government suppliers and enterprise software cluster here. A small business site does not end up behind a product like this by accident, which makes the population a filter for organisational size that does not depend on guessing revenue from a homepage.

Competing vendors read the list as a renewal market. Sales teams selling anything enterprise read it as a size qualifier. Researchers read it as a map of which parts of the web sit behind an inspecting proxy, which changes how the rest of a scan should be interpreted.

The limits follow from how the signal is produced. Detection depends on what the proxy chooses to expose, and a carefully tuned deployment can expose almost nothing, so the count is a floor. A proxy can also be applied to some hostnames of an estate and not others, meaning the domain is protected rather than the organisation. And because the layer sits in front, whatever it hides is hidden from us too, so rows in this population carry less detail about the origin than rows elsewhere in the dataset. The export lists every domain where we saw the layer, with country, zone and whatever else the site disclosed, rebuilt daily, which turns a one-off check into a picture of which industries and which markets sit behind commercial inspection.