Download websites that use mod_jk

About mod_jk

mod_jk exists to enforce a division of labour that predates most of the modern web. Apache HTTP Server takes the connection, terminates TLS and serves the static files, then hands application requests to Tomcat over the Apache JServ Protocol. The arrangement was standard practice in Java shops for a long time, and the connector is the piece of glue that makes it work.

As of September 2026 we see the module on 34,734 sites, and the geography is the first surprise. 15,354 of them are in Germany, with .de the dominant suffix, which is not the distribution a generic web technology produces. Enterprise Java persisted longest in markets with large in-house IT departments, long procurement cycles and a preference for running your own servers, and the Web server extensions footprint here reflects that history rather than any current adoption trend.

The connector comes from Apache Software Foundation under Apache 2.0, written in C, and has existed since 1999. Age matters in this case because the architecture it serves went out of fashion while the connector itself carried on receiving releases. Sites still running it are on maintained but unfashionable plumbing, which is a specific and actionable state: not broken, not going anywhere on its own, and eventually somebody's migration project.

Version data supports the same reading. 40 distinct versions appear in the dataset and 1.2.40 is the one we see most often, a spread characteristic of software that arrives inside an operating system package or a vendor appliance rather than being pulled fresh by a developer. Upgrades happen when the platform underneath is rebuilt, and for this kind of stack rebuilds can be years apart.

What the module implies about a site is unusually concrete. Behind it sits a Java application server, an application that somebody wrote or bought rather than installed from a plugin directory, and an operations team that manages its own front end instead of pushing everything to a managed platform. Application performance vendors, Java migration consultancies, container and platform vendors, and security teams doing external inventory all care about that population, and the protocol itself has a history of serious vulnerabilities when connector ports are left reachable, which gives defenders a reason to know where it runs.

Detection is inferential and almost certainly undercounts. The connector announces itself only when the front server is configured to reveal its module list, and hardened builds strip that away, as do the reverse proxies and CDNs that sit in front of many enterprise sites. Absence from the list is not evidence the connector is missing, only that the site did not tell us. Treating the count as a floor is the honest interpretation, and the bias runs toward older, less-tuned deployments that still advertise their internals.

A per-domain lookup answers whether one host exposes the module. The download answers whether the Apache-to-Tomcat pattern still has a population worth building a business around, where that population is concentrated, and how fast it drains between releases. Those are the questions a migration offer or a security research programme actually depends on, and they cannot be assembled one host at a time.