Download websites that use XSLT

XSLT is not a technology anyone adopts this year. Standardised by W3C in 1999 as the transformation half of the XML stylesheet family, it turns XML documents into HTML, text or other XML through declarative rules instead of procedural code. The specification is Open Source and freely implementable, which is why processors ship inside browsers, Java runtimes and .NET rather than being sold as a product. The web moved on to JSON and templating engines, and the language stayed where it was already load bearing: publishing pipelines, document archives, financial and government data exchange, and the machinery that turns structured records into pages.

Filed under Programming languages, it behaves less like a language a team writes in and more like a layer a system inherits. Finding it on a live site usually means one of a few things. A legacy publishing chain is still transforming XML into pages. A feed or a sitemap carries a stylesheet so that a browser renders it readably. A vendor product in publishing, library systems or regulatory reporting emits XML and dresses it up on the way out. In each case the site is older than its front end suggests and there is an integration story behind it.

The visibility problem here is severe and worth stating plainly. Most transformation of this kind happens on the server, and the browser is handed finished HTML with nothing left to detect. What a crawl can see is the narrow case where the transformation is left to the client: a stylesheet processing instruction at the top of an XML document, or namespace declarations that survive into the delivered markup. As of October 2026 we record XSLT on 4,231 sites, and the real installed base behind that number is far larger and not measurable from outside.

Version data carries a related warning. We track 9 distinct version strings, but those strings come from declarations embedded in documents rather than from a runtime reporting itself, and a declaration states which revision of the specification a stylesheet was written against, not which processor executed it. The distribution shows how much of the visible population is still pinned to the original revision rather than the later ones, and says nothing reliable about what runs on a server.

The audiences are narrow and know exactly what they want. Modernisation consultancies sell the replacement of precisely this layer, and a set of domains still exposing it is a set of systems old enough to have a budget attached. Security researchers care because XML processing has a long history of parser level vulnerabilities, and an exposed transformation chain implies an exposed parser. People studying technology decay get something rarer: a standard with a known publication date, no marketing behind it, and a measurable residue on the live web, which makes it a decent instrument for how long a technology persists after the industry has moved on. None of those questions survives being asked one domain at a time.