Download websites that use jsDelivr

About jsDelivr

Every script a page loads from somebody else's domain is a small act of trust, renewed on each page view. jsDelivr is one of the domains that trust points at, a free public delivery network that serves packages, releases and plugin assets to any page willing to link to them.

Nobody buys the service, and that changes what a count of it means. There is no contract and no account, so a site appears here because a developer pasted a URL, or more often because a theme, a plugin or a documentation template did it years ago and nobody revisited the decision. Detection is correspondingly direct, since the request target is written into the markup we fetch. What detection cannot establish is whether the site owner knows the dependency is there.

As of September 2026 the file carries 5,681,286 sites loading assets from the network, 2,914,911 of them in United States, on a domain mix where .com is heavily represented. Scale of that order is the entire security argument. A public network appearing across that many pages is infrastructure, and infrastructure supplied at no charge is infrastructure with no customer relationship to fall back on when something goes wrong.

The project has run since 2012 under an MIT license, funded by sponsorship and spread across several commercial networks with automatic failover. Openness is a real strength and also the reason a due diligence questionnaire asks about it. A version pinned URL is reproducible and behaves like a dependency. A URL pinned loosely, or not pinned at all, is a standing promise that whatever the maintainer publishes next will execute inside your pages with your users' sessions in scope. The technical distinction is invisible in a boolean column, which is why the raw reference matters more than the flag.

Application security teams want the population view because their own inventories only cover the domains they remember owning, and acquired brands and campaign microsites are where third party origins accumulate. Vendors selling subresource integrity, content security policy tooling or dependency scanning want prospects whose pages already reach outside their own origin. Package maintainers want to know where their releases are genuinely consumed, which registry download counts never show, because a delivery network request is not a package install.

Limits deserve stating plainly. We record the origin a page references rather than what came back, so a stale link to something long removed still counts as a reference. Assets injected later by another script can be missed altogether. A site flag also hides depth, since one small library on a contact form and an entire application shell of dependencies look identical in a yes or no column, and the risk they represent is not remotely identical.

A per domain lookup answers whether one page references the network today. The download answers what comes after: which sectors carry public CDN references, how the share moved as bundlers became standard, which hosting bases and countries concentrate the exposure, and which sites combine this origin with several others on the same page. Every row carries country, suffix and the rest of the detected stack, so third party exposure can be sized across a market rather than sampled one hostname at a time.