Download websites that use Symfony

About Symfony

Server-side frameworks are the hardest category on this site to count honestly, and Symfony shows why. A PHP framework runs entirely before the response leaves the server, and nothing in the finished HTML has to reveal it. What leaks instead is incidental: a session cookie name, a profiler route left enabled in production, a header nobody removed, an error page, a conventional asset path. Detection is therefore inferential, and the sites we can identify are the ones that were slightly careless rather than a random sample of everyone running the framework.

As of September 2026 we detect Symfony on 30,774 sites, and the honest reading of the figure is a floor rather than a measurement. The real installed base is larger by an unknown multiple, and it skews toward software that never exposes a public front end at all: internal tools, back offices, APIs, and the machinery behind sites that appear in our data under some other name entirely.

Where a fingerprint does surface, it says a great deal. Nobody reaches for this framework to publish a brochure site. Released in 2005 by SensioLabs under the MIT license, it targets long-lived applications with structured teams behind them, and its components are reused so widely that a large part of the surrounding ecosystem sits on them indirectly, including several content management systems and a rival framework or two. A domain where the framework is visible is usually a custom build with a development budget, an agency or an in-house team, and a procurement process attached.

Germany supplies 16,795 of what we find, and .de runs through those domains. The German weighting is not an artifact of crawling. A dense market of mid-sized agencies and enterprise integrators standardized on the framework early, and a public sector and Mittelstand preference for applications built to be maintained for a decade pushes work toward exactly this kind of stack rather than toward hosted platforms.

For anyone selling developer tooling, application hosting, security scanning or contract engineering, the value of the list is the qualification it performs before you read a single row. A domain that exposes a framework fingerprint has code being written against it, which is a completely different prospect from a site assembled out of a template by its owner. The same property makes the list useful defensively, since dependency risk in a custom application is carried by whoever commissioned it.

Testing one domain is a matter of a request and a trained eye. Producing the population, and being able to cut it by country, suffix and co-detected stack, needs a crawl of the entire web plus a willingness to state plainly that the result undercounts. That file, with its caveats, is what the download contains.