Download websites that use mod_wsgi

About mod_wsgi

Server modules are the part of a stack nobody chooses twice. A deployment pattern gets picked when an application first goes into production and then survives, largely untouched, through years of feature work, because changing how the process model works is a project with real risk and no visible reward.

mod_wsgi is that decision preserved. Released in 2007 and written in C, the module embeds a Python interpreter inside Apache or runs the application in daemon processes that Apache supervises, which was the standard way to host a Python web application for a long stretch. The Apache 2.0 license and the absence of a company behind the project meant it spread through documentation and tutorials rather than through sales. Newer deployments tend to put a dedicated application server behind a reverse proxy instead, so finding the module today is a fair indicator that the host predates that shift or was built by somebody who learned during it.

Version data is where the population gets specific. We see 75 distinct versions in circulation, with 5.0.0 recurring more often than any other build. Spread on that scale across a single Apache module is not ordinary churn. Spread on that scale means installations pinned by an operating system package, frozen inside a container image built years ago and never rebuilt, or held in place by a requirements file nobody dares to touch. For anyone tracking exposure, the version distribution is the finding rather than a detail attached to one.

Detection is inferential and we would rather say so. The module announces itself in a server header when the administrator leaves the default configuration alone, and plenty of administrators do not. Hardened hosts strip or rewrite that header, a reverse proxy or CDN in front of the origin usually replaces it outright, and in both cases a perfectly healthy installation becomes invisible from outside. As of October 2026 we detect mod_wsgi on 23,640 sites, and each of those is a host that both runs the module and advertises the fact. The true installed base is larger by an unknown factor, and any analysis treating the count as complete will understate Apache-hosted Python.

Geography follows the same logic as the version spread. 12,072 of the detections sit in United States, and .com is the domain ending that comes up most often, which reflects where long-lived hosting estates and university infrastructure accumulated rather than where Python is being written today.

The question an export answers is a population question. Which hosts still run this pattern, on which providers, at which versions, beside which frameworks and which Apache builds. Security researchers use that to scope exposure, migration consultancies use it to find estates worth modernising, and framework maintainers use it to decide what still has to keep working. Asking about a single domain tells you what one domain runs. Asking the list tells you whether a deprecation is a footnote or a breaking change for a substantial installed base.