Download websites that use Polyfill

About Polyfill

Old browsers do not disappear on a schedule, and every site that still expects to meet one carries some form of compensation code. Polyfill is the JavaScript libraries that fills that role, detecting which modern features a visitor's browser lacks and loading only the missing pieces, so that a developer can write current JavaScript without branching on the user agent.

The pattern matters commercially because a polyfill is usually fetched rather than written. Sites reach for a shared service that inspects the incoming browser and returns a tailored bundle, which puts an external host directly in the path of page rendering. A widely used service of exactly this kind changed hands after years of quiet operation and later served unwanted code to a share of visitors, and the episode turned a routine compatibility helper into a supply chain question that security teams now ask about by name.

As of September 2026 we detect Polyfill on 21,122 sites. The library is distributed under the MIT license and has been in circulation since 2011, and the implementation is JavaScript, delivered to the client, so the code runs on the visitor's machine rather than at the origin. Version data here is coarse. We separate 3 builds and attach 3 to the bulk of detections, a shallow spread that is what you expect from a service which pins a major line and changes things behind it.

Geography sharpens the picture rather than explaining it. United States contributes 11,292 of the sites and .com recurs more often than any other suffix in the mix. The distribution says less about where old browsers actually live and more about where the templates, themes and build defaults that pull in a polyfill were authored, which is a useful distinction if you are trying to reach the people responsible rather than the people affected.

A per-domain lookup answers whether one site loads compatibility code today. The list answers a different question. Vendor risk and application security teams use it to find every domain in a portfolio, a supplier base or an acquisition target that still depends on externally hosted browser shims, which is the only form of the question that scales past a handful of names. Framework vendors and agencies read the same population in reverse, as a map of sites still building for browsers their newer product would happily drop.

Detection is inferential and undercounts on purpose. A polyfill compiled into an application bundle at build time leaves no separable fingerprint, and only the recognizable hosted and named distributions are recorded, so the number should be read as a floor for the technique rather than a census of it. Absence in a row is not evidence that a site ships no compatibility code at all, only that none was visible from the outside.