Download websites that use prettyPhoto

About prettyPhoto

prettyPhoto is a jQuery lightbox, the kind of component that once shipped inside almost every commercial WordPress theme sold on the big marketplaces. A click on an image or a video link is intercepted and the target reopens in a styled overlay above the page, with grouped galleries, keyboard navigation and hash based deep links. Stephane Caron published the plugin under GPL v2 in 2008, back when JavaScript add-ons were distributed as zip archives and copied by hand into a theme directory.

Because the library runs in the browser, detection is direct rather than inferred, and the script and its stylesheet appear in the page source of every site that loads them. As of September 2026 we record prettyPhoto on 501,641 sites. The honest reading of that number is a census of what has been left in place, not a count of decisions anyone made recently, because the plugin has been superseded by newer overlays and by native browser behaviour, and almost nobody adds it to a fresh build.

A presence signal is useful precisely when it is stale. Sites still serving the plugin are usually running a theme that has not been rebuilt since the day it was bought, which tends to travel with old bundles elsewhere on the page, unpatched extensions and a lapsed maintenance contract. Security researchers care for a narrower reason, since older releases carried a documented cross site scripting weakness in the way the URL hash was handled, and a page that still loads the file is worth a look. Agencies care for a commercial reason, because a frozen front end is the clearest public evidence that a redesign is overdue.

The limit worth stating is what detection cannot separate. We can see that the file is served, but not whether a visitor ever opens a gallery, and a theme that bundles the library unconditionally registers even on pages that never call it. We also do not track release identifiers for this plugin, so the dataset can tell you that a site loads it but not which build, which means a vulnerability question still needs a direct fetch of the file.

Geography follows the theme marketplaces rather than any national preference. United States accounts for 165,094 of the sites we see, and .com leads the domain mix, which reflects where commercial themes were sold and hosted rather than any suggestion that the plugin was rare elsewhere. A single domain lookup cannot show a distribution of that kind. Checking one address tells you whether that address loads the library, while the downloadable list tells you how large the surviving population is, where it clusters, what else those sites run, and how fast the set is draining as themes are finally replaced.