Download websites that use Kong

About Kong

An API gateway is built to be unremarkable. Kong sits between clients and the services behind them, terminating requests, checking credentials, counting calls and forwarding whatever survives, and a carefully configured deployment leaves very little evidence of itself in a response. A list of domains where the gateway is visible at all is therefore a list of deployments that either chose not to hide or were never tuned to.

The observation surface matters as much as the detection. Gateways usually live on an api subdomain or an internal hostname, while a web technology dataset looks at what a public site serves. A match here generally means the gateway is fronting the public property itself, which is a different and less common deployment pattern than the ordinary one, and it tends to indicate a team that put its whole edge behind a single Reverse proxies component rather than a separate proxy for the website.

Where the gateway is visible, the implication is organisational rather than cosmetic. A team that puts Kong in front of its services has interfaces worth governing, more than one backend and someone whose job description includes rate limits, authentication and traffic policy. Written in Lua on top of an established proxy core, the gateway is chosen by platform engineers rather than by whoever picked the content management system, and it usually arrives in company with container orchestration, a service registry and a deployment pipeline.

The Apache 2.0 licence explains much of the spread. Kong Inc. publishes an open core anyone can run without ever speaking to a salesperson, alongside a commercial edition and a managed service, so deployments range from a single container in front of a hobby project to a regulated enterprise estate. Released first in 2015, the gateway arrived exactly as microservice architectures were becoming a default, and a large share of what we detect belongs to systems designed in that period.

Version data is where the picture turns uncomfortable for anyone responsible for a fleet. We record 104 distinct versions in the wild, with 1.4.1 recurring more than any other, and a self hosted gateway does not update itself. Old builds keep serving traffic because they work, because the plugins pinned to them were never retested, or because the engineer who deployed them has moved on. For security research the distribution across domains is more useful than any total, since an advisory covers a range of releases rather than a product name.

As of September 2026 we see Kong on 17,594 sites, and the figure should be read as a lower bound. Gateways behind a content delivery network that rewrites headers, or configured to strip identifying responses, simply never surface. What a full extract offers beyond a single lookup is the shape of the population: which sectors standardised on the gateway, which estates run it beside a competing proxy, and which domains still sit on releases a given advisory covers. Vendor teams use lists like this for displacement research, security teams for exposure mapping, and analysts for judging whether an open core has actually converted into paying infrastructure.