Download websites that use Jetty

About Jetty

Most web servers announce themselves. Jetty frequently does not, and understanding the reason is most of what it takes to read a Jetty number correctly. Jetty is a Java servlet container designed above all to be embedded, which makes it more often a library compiled into an application than infrastructure that somebody installs on a machine. Build tools, developer platforms, monitoring consoles and countless internal services carry it inside the application archive, invisible until something answers a request.

The project dates to 1995, older than most of the stack it now serves, and it moved from its original commercial home to Eclipse Foundation, where it is maintained under the Apache 2.0 license. Longevity of that kind leaves a visible mark in the data.

We record 164 distinct Jetty versions across the sites where it can be seen, and the release we observe most often is 9.4.20. Behind the leading release stretches a tail running back through several major generations that are still answering requests, because an embedded server is upgraded when the application around it is upgraded and not before. Enterprise applications are upgraded slowly, and a component that nobody chose consciously is upgraded slower still.

A host where Jetty answers the public internet directly is a particular kind of host. The page behind it is rarely marketing and rarely a shop. Far more often the responder is an API, a developer tool, a document or search service, a corporate system that got exposed, or an appliance with a web console that was never meant to be reachable from outside.

As of October 2026 we detect Jetty on 1,694 sites, and the figure is a floor rather than a count. Deployments sit behind reverse proxies, load balancers and content delivery networks that rewrite or remove the server header, and hardened configurations suppress it deliberately. Everything running inside a private network, which is the bulk of the installed base, is beyond the reach of any external crawl by definition.

The people who want this list are usually not shopping for web hosting. Vulnerability management teams want internet facing instances together with their reported versions, because a servlet container exposed to the public with a documented patch history is an attack surface with a known shape. Java tooling vendors, observability companies and commercial support providers want the same population as a market map, since an organisation running an embedded server in production has the kind of estate they sell into. Researchers want the version distribution as an empirical measure of how quickly a widely embedded component is actually patched in the field, as opposed to how quickly its maintainers publish fixes.

Checking one host answers whether that host runs Jetty. Only a full crawl answers what the internet facing Jetty population looks like, which version each host reports, how the mix shifts between generations over time, and which other technologies keep appearing beside it, which is usually the fastest way to tell an appliance apart from an application.