Download websites that use WebGUI

About WebGUI

Perl was a mainstream way to build the web when WebGUI first appeared in 2001, and almost nothing in that sentence is still true of new projects. A CMS written in Perl, released under GPL v2 and built commercially by Plain Black Corporation, WebGUI arrived when self hosting was the default and a content system was something an organisation installed, configured and then owned for years.

Ownership of that kind is the whole story of what we detect now. Installations do not vanish when a project loses momentum. Installations persist, because the site still works, the content is still served and nobody has funded a replacement. Longevity also selects for a particular kind of owner. Organisations with a small budget, a stable brochure or membership site and no appetite for a rebuild keep systems like this running far past the point where a growing company would have moved. So a domain running WebGUI today is usually a long lived site with a maintainer who inherited it rather than chose it, which is a specific and very targetable situation.

The version data supports that reading. We record 6 distinct version strings across the installations we fingerprint, and 7.10.30 keeps recurring among them. A version string that precise, on a release line that old, is the signature of an install left alone for a long stretch. Fragmentation across so many strings also says there is no coordinated upgrade path in play, which is what you would expect from independent self hosted deployments rather than a managed fleet.

Three audiences buy lists shaped like this. Replatforming agencies and competing CMS vendors treat an aging self hosted base as a pipeline, since every entry is a site that will eventually have to move and an owner nobody has approached yet. Security researchers read the same list as exposure, because unmaintained server side code with an administrative interface on a public host is the classic shape of a soft target. Historians of the web and researchers tracking language use in a category get a measurable trace of a decline that is otherwise anecdotal.

Detection has limits worth stating. Version comes from what the software advertises in markup or headers, which an administrator can strip, so version coverage is partial and skews toward installs that were never hardened. A site can also sit behind a reverse proxy or be exported to static files, in which case the CMS behind it is invisible to us. A match means the fingerprint appeared, not that the install is maintained or even administered any more.

As of October 2026 we detect WebGUI on 169 sites. Confirming any one of them is a lookup anyone can do. Producing the whole surviving population, which is what a migration pipeline, a vulnerability survey or a study of Perl on the public web actually requires, is what the downloadable list is for.