Download websites that use Lucene

About Lucene

A search library has no front door. Lucene runs inside somebody else's Java process, building indexes and answering queries for an application that never has to say what is doing the work, which makes any count of public websites carrying it a strange object worth explaining before it gets used.

Recognition happens only when the stack leaks. A results page that exposes query syntax, a response header left in place, a stack trace on an error page, an endpoint from a search server built on the library, a plugin that names itself in markup: those are the ways a component designed to be invisible becomes visible from outside. As of October 2026 we detect Lucene on 12 sites, and the honest reading of that figure is that it counts installations which revealed themselves, not installations which exist. The real population is bigger by a margin we cannot measure, and anybody presenting this entry should say so out loud.

The licence explains why the gap is so wide. Lucene is Apache 2.0, maintained by Apache Software Foundation, and permissive licensing carries no obligation to tell anyone you used it. Vendors embed the library in commercial products, enterprises build internal search on it and ship nothing back, and the code ends up in appliances, intranets and applications no crawler will ever reach. Dating from 1999, the library has had long enough for that to happen across an entire industry.

What survives the caveat is still useful, because the leak itself is the finding. A domain where search internals are visible from outside is a domain where somebody exposed more than they meant to, which matters to security researchers directly and to everyone else as a proxy: sites in this list run self managed search infrastructure rather than a hosted search box, which means Java operations, servers to maintain and an engineering team with opinions.

The commercial reading follows. Search vendors selling hosted alternatives want to know who still runs their own index, consultancies want migration candidates, and anyone selling infrastructure to Java shops can use a search library sighting as a stack marker, because a domain here almost certainly runs a virtual machine somewhere with the hosting, monitoring and staffing that implies.

A per-domain lookup can tell you that one site leaks a search stack. The list answers the questions that need the whole population at once: which sectors still run their own search, what they pair it with, whether a domain moved to a hosted service and left the old fingerprint behind, and which organisations to approach with a managed alternative. Treated as an inventory of self managed search that happens to be visible, the entry does a job no per-domain check can do.