Download websites that use ThinkPHP

About ThinkPHP

Server-side frameworks are among the harder things to identify from outside a site, because a framework has finished its work before the browser sees anything. ThinkPHP is recognised from what leaks around the edges: routing and URL conventions, default error output, session cookie naming, occasional response headers and the file layout that ships with a standard installation. Detection is inferential, and both misses and the occasional false positive on a fork are realistic outcomes.

With that stated, the framework is worth mapping precisely because of where it lives. ThinkPHP was created by Top Think in 2006, is written in PHP and released under Apache 2.0, and its documentation, tutorials and community grew up in Chinese. A framework whose learning material sits in one language tends to accumulate a user base in one market, and the detection data reflects exactly that.

As of October 2026 we see ThinkPHP on 17,073 sites, 6,475 of them in China. Distribution of that shape is unusual in web technology data, where the pattern normally centres on the United States regardless of what is being measured. For anyone studying regional stacks, a technology that breaks the default pattern is the interesting case rather than the exception to discard.

Domain endings still cluster on .com, which is a useful reminder that the suffix is a weak proxy for audience. Commercial registration habits are global, and a site serving a domestic audience is as likely to sit on a generic commercial domain as on a national one. Country data and language markers carry the signal for this technology, not the domain ending.

The framework also has a security history that gives the population a second use. Remote code execution flaws in older releases were mass-exploited by automated scanners, and installations that were never upgraded remain a recognisable class of exposure. An inventory of publicly reachable installs is a legitimate research artefact for anyone measuring how long known-vulnerable software stays online, with the caveat that we cannot resolve a release number for most of what we detect, so the file identifies the framework and not the patch level.

Commercially the population answers a different question. Hosting providers, security vendors, agencies and software companies planning entry into the Chinese market want to know what the local stack actually looks like rather than what English-language technology surveys report. A per-domain lookup cannot produce that picture. A downloadable list can, and the country and domain columns are what make it sortable into something usable.