Download websites that use Kohana

About Kohana

Kohana is a PHP framework whose origins date to 2007, and almost everything interesting about the sites still running it follows from that date. Public development stopped years ago, so a Kohana fingerprint today rarely marks a technology decision anyone made recently. What it marks is a codebase that was written once, put into production, and never migrated.

The version evidence supports that reading. Across the entire detected population we record 3 distinct versions, clustered around 3.3.6, which is a remarkably narrow distribution for a framework of this age. Live projects fan out across releases because teams upgrade at different speeds and for different reasons. A frozen population converges instead, since nothing moves at all, and what we observe here is much closer to the second pattern than the first. As of October 2026 we detect Kohana on 134 sites.

An unmaintained PHP framework carries a specific meaning for anyone doing security or diligence work. Newly discovered weaknesses in the framework itself will not be patched upstream, and any fix has to be written by whoever owns the application, assuming somebody still does. Hosting providers inherit that exposure from customers who have forgotten the site exists. Acquirers inherit it from targets whose engineering history nobody documented. In both cases the useful artefact is not a yes or no answer about one domain, because the exposure is a portfolio question and needs a portfolio sized answer.

The commercial reading is the mirror image of the security one. A site on a discontinued framework is a migration candidate, and migration is expensive enough that agencies and platform vendors will pay for a qualified list of them. Because the framework was distributed under the BSD license, nobody ever had to register to use it, so there is no vendor customer list to acquire and no download ledger to consult. A crawl of live sites is the only way to see the population at all, and it is the only way to watch that population shrink as sites are rebuilt or retired.

Detection has real limits worth naming. We recognise Kohana from framework specific cookies, error page signatures, header behaviour and public paths that survive into production deployments. An application that renamed its session cookie, suppressed its error output and sits behind a cache can run this framework invisibly, which is common in exactly the older, carefully firewalled installations where it tends to live. Our count should be read as the portion of the population still visible from the outside rather than the whole of it, and for a framework in this condition the invisible remainder is probably substantial.