Download websites that use PostgreSQL

About PostgreSQL

A database is supposed to be invisible from the outside. Nothing about a carefully built site should tell a stranger what stores its data, and that is the first thing to understand about this row in a technology dataset. Detecting a database from the public web means the site disclosed something it did not have to.

PostgreSQL has been developed since 1989 in C and released under the PostgreSQL License, which is to say it is free, unbranded and installed by whoever wants it, with no registration step anywhere in the process. No vendor holds a customer list. As of September 2026 we detect it on 102,411 sites, and the honest description of that figure is that it counts disclosures rather than deployments.

The disclosures come from a handful of recurring places. Framework and admin interfaces that name their backend, database tooling published on a subdomain, error output that escapes into a response, connector libraries declared in a page, and platform bundles where the stack is documented rather than hidden. Each of those is a leak or a convention rather than an announcement, and the sites producing them are not a random sample of the sites running the database.

The bias runs in a direction worth naming. Estates with careful configuration disclose nothing, so the visible population tilts toward smaller teams, self-managed servers, staging environments that were never locked down, and applications whose stack is part of the product description. Well resourced, professionally run deployments are precisely the ones absent from the list.

None of that makes the population useless. It makes it a specific population with specific uses. Anyone selling managed hosting, backup, monitoring or migration services is looking for self-managed installations rather than enterprise fleets, and self-managed installations are what a disclosure-based signal finds. Security researchers want the same rows for the opposite reason, because a stack that names its database in public has usually told a stranger several other things as well.

United States carries 38,403 of the detections and the .com zone carries much of the rest, which reflects where the hosting sits rather than where the developers are. Hosting geography and developer geography diverge more for infrastructure components than for anything user facing, so country here should be read as a data residency fact and not as a market fact.

The question a download answers is co-occurrence. Which frameworks, which web servers, which hosting providers and which countries travel with these detections, across the whole population instead of a sample of it. One domain checked by hand tells you about one domain. The full file, rebuilt daily, lets you build a profile of the leak itself and then decide how far you are willing to generalise from it, which is a judgement that belongs to you rather than to us.