Download websites that use mod_rails

About mod_rails

Nobody visiting a website has an opinion about the application server behind it, which is precisely why that layer is worth measuring. mod_rails, known as Phusion Passenger, is Web server extensions from Phusion, released under the MIT license and in production use since 2008. The module exists to make Ruby applications deployable by embedding them into Apache or Nginx instead of leaving them behind a hand-rolled process manager.

Written in C++ and sitting between the web server and the application, it handles process supervision, restarts, and request routing that a Rails team would otherwise assemble alone. A site that announces the module is telling you three things at once: the application is Ruby, it runs on infrastructure the operator controls rather than on a platform-as-a-service, and somebody made a deliberate operations decision at deploy time. Detecting the framework alone does not carry the second and third parts.

Who cares about that combination is a short list and a commercially useful one. Application monitoring vendors, error tracking services, Ruby consultancies, managed hosts looking for migration candidates, and security teams cataloguing exposed infrastructure all want the same object, namely a population of self-hosted Ruby deployments rather than a directory of companies that mention Ruby in job adverts. As of October 2026 we see mod_rails on 7,755 sites, and the file supports cross-cuts a domain-by-domain check cannot: which of them sit behind a content delivery network, which pair the module with Apache and which with Nginx, which countries and hosting providers concentrate it, and which sites still carry a framework fingerprint that has not moved in years.

The undercount here is large and predictable, and pretending otherwise would be dishonest. Server-side modules are usually identified from banner headers, and suppressing or rewriting those headers is a default hardening step in most deployment guides, so every carefully administered installation that hides its stack is absent from the count. Reverse proxies and edge caches add a second layer of concealment, because what the crawler meets is the proxy rather than the origin. The result is a list that is reliable in what it contains and silent about what it omits, which suits prospecting well and market sizing only conservatively.

One further distinction is worth holding onto when reading the numbers. The vendor ships a community edition and a commercial enterprise edition that present themselves identically to the outside world, so the list cannot separate paying customers from free users on its own. Anyone using it as a sales input should plan to qualify that split with other evidence, such as company size or hosting footprint, both of which travel with the domain in the same records.