Download websites that use Moment.js

About Moment.js

Few projects put a deprecation notice at the top of their own documentation and tell new arrivals to pick something else. Moment.js has done exactly that for years, and essentially no new site adopts it on purpose now. Every detection is a date stamp on the front end rather than a description of it.

What the date stamp is worth depends on the question being asked. A bundle containing this library is usually a bundle nobody has rebuilt in a long time, or a theme, plugin or embedded widget that vendored the code and was never updated by whoever installed it. Either way the site carries code that will not receive fixes, along with the locale and timezone payload that made the library heavy in the first place. For a consultancy selling modernisation, a vendor selling performance tooling, or a security team assembling a picture of unmaintained dependencies, that is precisely the population worth naming.

The library is also a proxy for a decision that was never revisited. Front end dependencies are rarely removed on purpose, and a replacement only happens when something else forces a rebuild, so the presence of a deprecated date library is often the visible edge of a much larger backlog behind it.

As of September 2026 we detect it on 759,379 sites, 288,069 of them in United States, with .com the domain ending recorded most often. Released in 2011 under MIT, the library spread through a decade when handling dates in a browser was genuinely painful and no standard answer existed, which is why the code ended up inside so much third party work that outlived the decision to use it.

The number is a floor and should be quoted as one. Detection works when the library loads as a recognisable file or exposes a recognisable global, and a build that inlines and minifies it into an application chunk disappears from view completely. Since modern toolchains do exactly that by default, the sites we can see skew toward older and simpler front ends, which are also the front ends that tend to be stale for other reasons. No version is recorded for this library in our data either, so the list cannot separate a patched install from an unpatched one and should never be treated as a vulnerability inventory.

The reason to take the file instead of checking domains individually is that the useful output is a cohort, not a verdict. A list of every domain still shipping the library, with country, domain ending and the rest of the stack attached, is a working pipeline for anyone selling a rebuild and a research sample for anyone measuring how slowly the web replaces deprecated dependencies. Compared across snapshots the same list measures the rate of that replacement, which is a question no per-domain lookup can answer at all.

There is a quieter use as well. Because the library is a reliable age marker, it works as a control variable. Hold it constant and the differences between countries, hosts or content management systems start to describe how quickly each population refreshes its front end, rather than which framework happens to be fashionable.