Download websites that use SWFObject

About SWFObject

Most detections describe something a site is doing. SWFObject describes something a site stopped doing and never cleaned up. The library exists to embed Flash content, Flash has been removed from every current browser, and so a page loading this script today is running code that cannot succeed. Presence is not a capability. Presence is a timestamp.

The library earned its place honestly. Written in JavaScript and published under MIT in 2006, it replaced a mess of hand written object and embed markup with a clean, standards friendly way to detect the plugin, pass parameters and supply alternative content for visitors without it. For the years when interactive web content meant Flash, this was the sensible way to do it, and it was copied into countless themes, templates and CMS distributions where it quietly persists.

As of October 2026 we still find it on 183,282 sites, with 49,959 attributed to United States and .com common among the domain endings. The geography here reflects who was publishing heavily during the Flash era rather than anything about the library, which is the usual shape for a dependency that survives by inertia rather than by choice.

What makes the data useful is precisely that the technology is dead. A working dependency tells you little about maintenance, because maintained and abandoned sites both run it. A dead one tells you a great deal. A page still shipping Flash embedding code has almost certainly not had its templates reviewed since the plugin was retired, and sites in that condition tend to carry other aged components behind them, including old CMS versions, unpatched libraries and expired integrations. Security teams, hosting providers looking at migration candidates and agencies selling rebuilds all use markers like this one as a cheap proxy for neglect.

The caveat is that neglect can be local rather than total. A well maintained organisation may still host an old microsite, a conference archive or a legacy documentation section where the script survives, and detection will report the domain without knowing that the rest of it is current. Read a hit as evidence about the crawled page and its template lineage, not as a verdict on the whole business behind the domain.

That distinction is also why the aggregate matters more than the individual lookup. Checking one domain confirms a fact you can see in the page source yourself. The downloadable list gives you the population of sites that share the condition, with the rest of each stack beside it, so you can ask which platforms carry the most stalled installs, which countries and domain endings concentrate them and how quickly the group shrinks between releases. A slowly dissolving population is a measurable thing, and measuring it needs the whole set rather than a sample of one.