Download websites that use VP-ASP

About VP-ASP

A shopping cart from the first wave of ecommerce that still turns up on live sites is a rare artefact. VP-ASP is one of them. The product is a self hosted cart for Windows hosting, built for a world in which a store owner bought software outright, uploaded it to their own server and ran it themselves, which bears little resemblance to renting a hosted storefront by the month.

VP-ASP is published by Rocksalt International under a Proprietary licence and its history reaches back to 1997, which places it in the first generation of commercial cart software rather than in the era of app stores and hosted checkouts. Longevity of that kind shapes the population. A store still running the software has usually been trading on the same platform for many years and has an inventory, an order history and payment integrations that turn replacement into a project rather than a decision.

As of October 2026 we detect VP-ASP on 64 sites. Self hosted carts always undercount, for reasons worth stating plainly. A store can rename script paths, sit behind a CDN or run a heavily customised template, and any of those can remove the signature we match on. What survives detection is the subset of installations that still look like a stock deployment, so the real installed base is larger than the figure shown by a margin nobody outside the vendor can quantify.

Presence of the cart implies a stack rather than a single product. A store running it is on Windows hosting with a classic server side page technology, an ageing database behind it and, in most cases, no upgrade path that does not amount to a rebuild. Migration agencies and modern commerce platforms read the list exactly that way, as a set of merchants with a defined technical problem and an existing revenue stream to justify solving it. Payment providers read it as accounts running integrations old enough that a compliance deadline will eventually force a conversation. Security researchers read it as an exposure population, since a cart that predates most of the current literature on web attack surface is still handling card flows on somebody's own server.

A per-domain check answers whether one shop runs the cart. The value of the export sits in the aggregate: how many stores remain, how they distribute across country domains, and whether the population shrinks between releases at the pace a retiring platform should. Watching that curve is the only reliable way to tell whether a legacy commerce platform is genuinely being retired or quietly persisting on the sites that never had a reason to move, and no single lookup will ever show it.