Web Hosting Statistics Updated November 2026

Human Written & Fact Checked · Updated

100 CDN Statistics for 2026

Your delivery footprint depends on which request you measure. The page document, its subdomain assets and third-party resources can follow different infrastructure paths.

These original observations separate website detection, crawl measurements, network telemetry and company capacity disclosures. They describe deployment and traffic without turning differences between samples into promises of performance improvement.

Headline figures

  • HTTP Archive sampled websites and requests: Mobile HTML requests served through CDNs: 35% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • HTTP Archive sampled websites and requests: Mobile third-party requests served through CDNs: 71% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • HTTP Archive sampled websites and requests: Top 1,000 mobile sites using CDNs: 71% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Cloudflare share of mobile CDN-served HTML requests: 58% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Websites with none of the monitored reverse proxy services: 66.6% (9 November 2026). (W3Techs, Nov 2026)
  • Global; Cloudflare-observed traffic: HTTP/2 share of requests to Cloudflare: 50% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Human-generated TLS 1.3 traffic using post-quantum encryption, early December: 52% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Mobile-device share of requests: 43% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: iOS share of mobile-device traffic: 35% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Traffic mitigated for any reason: 6.2% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Share of observed bot traffic originating in the United States: 40% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global Fastly network: Connected global network capacity: 655 Tbps (30 September 2026). (Fastly, Sep 2026)

Where are CDNs and reverse proxies detected?

A CDN footprint depends on the resource being delivered. A reverse-proxy survey answers a related infrastructure question, but its website denominator is different from a request-level crawl.

How does CDN adoption vary by resource and popularity?

  • HTTP Archive sampled websites and requests: Mobile subdomain requests served through CDNs: 52% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • HTTP Archive sampled websites and requests: Top 10,000 mobile sites using CDNs: 70% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Top 100,000 mobile sites using CDNs: 62% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Top 1 million mobile sites using CDNs: 49% (July 2025 dataset). (HTTP Archive, Jan 2026)

The request categories separate the page document, same-site subdomains and external resources. A page can use several delivery arrangements simultaneously. Popularity groups are nested: they are not mutually exclusive market segments that can be added together. The ranking observations concern the mobile crawl and do not establish adoption among every business, every internet user or all paid hosting accounts. Keep the resource category and rank cutoff with a quoted value. The dataset identifies observed delivery technology; it does not measure contract value, spending, customer satisfaction or the causal performance benefit of adopting a service.

Which leading reverse proxies appear in the website survey?

  • Worldwide measured sample: Cloudflare all surveyed sites: 28.8%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Cloudflare known-proxy sites: 86.3%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Amazon CloudFront all surveyed sites: 1.7%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Amazon CloudFront known-proxy sites: 5.2%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Fastly all surveyed sites: 0.9%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Fastly known-proxy sites: 2.8%. (W3Techs, Nov 2026)
  • Worldwide measured sample: DDoS-Guard all surveyed sites: 0.7%. (W3Techs, Nov 2026)
  • Worldwide measured sample: DDoS-Guard known-proxy sites: 2.2%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Akamai all surveyed sites: 0.6%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Akamai known-proxy sites: 1.9%. (W3Techs, Nov 2026)

Each pair gives the share of all surveyed websites followed by the share of websites with a detected reverse proxy. Those denominators answer different questions; they are not separate evidence of adoption. Detection describes the visible delivery layer instead of proving which company hosts the origin.

What does the remaining detected reverse-proxy mix look like?

  • Worldwide measured sample: Sucuri all surveyed sites: 0.2%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Sucuri known-proxy sites: 0.7%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Bunny CDN all surveyed sites: 0.1%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Bunny CDN known-proxy sites: 0.3%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Imperva all surveyed sites: 0.1%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Imperva known-proxy sites: 0.3%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Azion all surveyed sites: 0.1%. (W3Techs, Nov 2026)
  • Worldwide measured sample: Azion known-proxy sites: 0.3%. (W3Techs, Nov 2026)
  • Worldwide measured sample: ArvanCloud all surveyed sites: 0.1%. (W3Techs, Nov 2026)
  • Worldwide measured sample: ArvanCloud known-proxy sites: 0.2%. (W3Techs, Nov 2026)

The survey is a dated technology snapshot, not a census of paid CDN contracts. Smaller rounded shares can conceal differences below the displayed precision. A proxy may provide security or routing without every response being cached. Compare like denominators when describing the service footprint.

How does the provider mix change across requests?

Provider rankings change when the unit moves from the main document to third-party resources. Network capacity introduces another unit and should never be read as market share.

Which providers deliver the measured HTML responses?

  • Worldwide measured sample: Google share of mobile CDN-served HTML requests: 21% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Amazon CloudFront share of mobile CDN-served HTML requests: 7% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Fastly share of mobile CDN-served HTML requests: 5% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Akamai share of mobile CDN-served HTML requests: 2% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Vercel share of mobile CDN-served HTML requests: 2% (July 2025 dataset). (HTTP Archive, Jan 2026)

These values describe providers identified for mobile HTML requests in the crawl. They do not describe the distribution of all bytes, revenue, active users or customers. A provider with a smaller document footprint may still deliver substantial resources elsewhere on the page. Detection and request classification also limit comparisons with website-level proxy surveys. The published capacity figure in the takeaways is a separate company disclosure, not a result from this crawl and not proof of measured end-user throughput.

Which providers appear for subdomain resources?

  • Worldwide measured sample: Cloudflare share of mobile CDN-served subdomain requests: 46% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Amazon CloudFront share of mobile CDN-served subdomain requests: 28% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Google share of mobile CDN-served subdomain requests: 5% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Akamai share of mobile CDN-served subdomain requests: 4% (July 2025 dataset). (HTTP Archive, Jan 2026)

The subdomain category isolates requests linked to the website's own domain structure. A site can use a provider for these resources while delivering its main document through another path. Consequently, these percentages cannot be added to HTML-provider shares to calculate a combined website market share. They are also not evidence of exclusivity: individual pages can expose several delivery providers. The measured distribution reflects the crawl's resource mix and the source's identification method. Retain the mobile context and request category whenever comparing these observations with another dataset or a later edition.

Which providers appear for third-party resources?

  • Worldwide measured sample: Google share of mobile CDN-served third-party requests: 53% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Cloudflare share of mobile CDN-served third-party requests: 17% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Amazon CloudFront share of mobile CDN-served third-party requests: 11% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Fastly share of mobile CDN-served third-party requests: 5% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Akamai share of mobile CDN-served third-party requests: 4% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Facebook share of mobile CDN-served third-party requests: 4% (July 2025 dataset). (HTTP Archive, Jan 2026)

Third-party resources have a different ownership and delivery relationship from the main document. Their provider distribution can reflect common external services embedded across many pages. A provider may appear frequently because its services are embedded widely instead of because it hosts each page's origin. They should not be interpreted as the percentage of organisations purchasing each provider's CDN service.

Which protocols and encryption appear in delivery traffic?

Protocol adoption is observable, but the denominator counts as much as the version. Browser-crawl requests and traffic on a single global network should remain separate evidence.

What protocol versions appear on the observed networks?

  • Worldwide measured sample: Mobile CDN HTML requests using HTTP/3: 29% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile third-party CDN requests using HTTP/3: 45% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile third-party origin requests using HTTP/3: 7% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Global; Cloudflare-observed traffic: HTTP/1.x share of requests to Cloudflare: 29% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: HTTP/3 share of requests to Cloudflare: 21% (1 January–2 December 2025). (Cloudflare, Dec 2025)

The first observations come from the mobile crawl and retain their resource categories. The remaining values describe requests observed on Cloudflare's network during its reporting window. Neither dataset represents a random sample of all internet traffic. Their collection methods also differ: a browser test observes the negotiated protocol under its test conditions, while the network report aggregates live requests. Connection reuse, packet loss, resource size and browser support can influence the experience behind the same protocol label.

How does HTTP/3 adoption differ by geography?

  • Georgia; Cloudflare-observed traffic: HTTP/3 request share: 38% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Armenia; Cloudflare-observed traffic: HTTP/3 request share: 37% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Countries/regions with HTTP/3 above one third of requests: 15 (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Countries/regions with HTTP/3 below one tenth of requests: 7 (1 January–2 December 2025). (Cloudflare, Dec 2025)

The geographic results refer to Cloudflare-observed traffic, not the proportion of a country's population using a protocol. Country counts are threshold summaries of the same underlying geographic distribution. They should not be added to the individual country percentages or treated as independent studies. Network customer mix, browsers, devices and deployment choices can affect the measured traffic. Differences between countries do not establish that a hosting provider is faster or more secure there. Preserve the reporting window and network scope before using a geographic comparison in procurement or infrastructure planning.

Where does post-quantum encryption appear in TLS traffic?

  • Kuwait; Cloudflare-observed traffic: Post-quantum encrypted traffic share at the reported year-end observation: 37% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Puerto Rico; Cloudflare-observed traffic: Post-quantum encrypted traffic share at the reported year-end observation: 49% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Countries/regions whose post-quantum traffic share more than doubled: 28 (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: iOS requests using post-quantum encryption by early December: more than 25% (1 January–2 December 2025). (Cloudflare, Dec 2025)

These observations concern human TLS 1.3 traffic in the source's network measurements, with endpoint observations identified separately from the annual window. They are not percentages of all internet users, websites or every TLS version. The source describes deployment and negotiation, not a controlled estimate of attack reduction. Browser and operating-system support can change which connections qualify. The geographic growth count measures countries crossing a relative-change threshold, whereas the country and device values describe adoption shares. Keep those metric types separate when summarising the rollout.

How do lookup, compression and connection features differ?

Delivery measurements span several stages of a request. A DNS timing, a compression share and a TLS-version share cannot be collapsed into a single score for a hosting provider.

How do measured DNS timings compare?

  • HTTP Archive sampled websites and requests: Median mobile CDN DNS resolution: 176ms (July 2025 dataset). (HTTP Archive, Jan 2026)
  • HTTP Archive sampled websites and requests: Median mobile origin DNS resolution: 217ms (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Median desktop CDN DNS resolution: 52 ms (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Median desktop origin DNS resolution: 129 ms (July 2025 dataset). (HTTP Archive, Jan 2026)

These are crawl measurements under the source's controlled browser conditions, separated by device profile and delivery classification. They are not a representative survey of user connections in every country. The compared groups contain different websites and infrastructure configurations. An observed timing difference therefore does not identify the causal saving from moving one website to a CDN. Resolver behaviour, connection reuse, geography and cache state can affect operational measurements. Use the median values as descriptions of the published distributions, retaining the mobile or desktop label, instead of promising that individual users will receive the same result.

Which compression formats appear in responses?

  • Worldwide measured sample: Mobile CDN compressed responses using Brotli: 46% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile CDN compressed responses using gzip: 42% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile CDN compressed responses using Zstandard: 12% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile origin compressed responses using Brotli: 39% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile origin compressed responses using gzip: 61% (July 2025 dataset). (HTTP Archive, Jan 2026)

The published shares describe compression formats in the source's compared response groups. They should not be relabelled as shares of websites or users. An encoding's adoption does not directly reveal its compression ratio, processing cost or impact on rendering. Those depend on content and configuration as well as the algorithm. The CDN and origin groups are observed deployments, not equivalent workloads randomly assigned to competing systems. Keep the response denominator attached when using the values to describe delivery practices.

What do TLS and Early Hints observations show?

  • Worldwide measured sample: Mobile third-party CDN requests using TLS 1.3: 96% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Mobile third-party origin requests using TLS 1.3: 78% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: CDN requests with Early Hints: 0.012% (July 2025 dataset). (HTTP Archive, Jan 2026)
  • Worldwide measured sample: Vercel requests with Early Hints: 2.84% (July 2025 dataset). (HTTP Archive, Jan 2026)

The TLS observations describe negotiated security versions for mobile third-party resources. Early Hints is a different feature, measured through the source's response observations. Its provider-specific value uses a different denominator from the overall CDN figure. These shares cannot be combined into a general infrastructure-readiness score. The presence of a feature also does not prove that a particular page benefited from it. Resource ordering, browser behaviour and configuration influence realised performance. The crawl records what was observed under its test conditions; an operational claim requires direct measurements of the actual website and audience.

How does the device mix vary across countries?

A global traffic average can hide markedly different delivery audiences. These country comparisons describe requests on one network, so they are useful context instead of a national census of device ownership.

Where is mobile traffic more prevalent?

  • Global; Cloudflare-observed traffic: Countries/regions with mobile devices generating more than half of requests: 117 (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Sudan; Cloudflare-observed traffic: Mobile-device share of requests: 75% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Malawi; Cloudflare-observed traffic: Mobile-device share of requests: 74% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Gibraltar; Cloudflare-observed traffic: Mobile-device share of requests: 5.1% (1 January–2 December 2025). (Cloudflare, Dec 2025)

The network report categorises observed requests by device. The country threshold count describes how many locations crossed a share boundary, while the country percentages describe individual request populations. They are not estimates of the number of smartphone owners or subscribers. A person may generate traffic through several devices, and automated or unclassified traffic can be treated differently by the source methodology. Hosting teams should use their own audience measurements when setting performance priorities. The geographic contrast provides context for that investigation without establishing a universal mobile share for every site serving those locations.

Where does iOS account for a larger mobile share?

  • Monaco; Cloudflare-observed traffic: iOS share of mobile-device traffic: 70% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Denmark; Cloudflare-observed traffic: iOS share of mobile-device traffic: 65% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Japan; Cloudflare-observed traffic: iOS share of mobile-device traffic: 57% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Puerto Rico; Cloudflare-observed traffic: iOS share of mobile-device traffic: 52% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Countries/regions with iOS at least half of mobile traffic: 30 (1 January–2 December 2025). (Cloudflare, Dec 2025)

The denominator is mobile requests observed by Cloudflare, not all requests and not the national installed base of smartphones. A higher request share can reflect traffic intensity as well as device prevalence. The country count is a summary of locations meeting a threshold in this same dataset, not a separate adoption study. These measurements cannot identify the operating system used by every visitor to a particular website. They also do not show why a platform is more common in one location than another.

Where does Android account for a larger mobile share?

  • Papua New Guinea; Cloudflare-observed traffic: Android share of mobile-device traffic: 97% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Bahamas; Cloudflare-observed traffic: Android share of mobile-device traffic: 51% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Countries/regions with Android above nine tenths of mobile traffic: 27 (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Countries/regions with Android at least half of mobile traffic: 175 (1 January–2 December 2025). (Cloudflare, Dec 2025)

These values retain the mobile-request denominator. Country-level shares and counts of countries above a threshold measure different aspects of the same distribution. They should not be added together or interpreted as a population-weighted global ownership rate. Cloudflare's customer and traffic mix limits extrapolation to the whole internet. Browser capabilities, connection quality and device performance also vary within an operating-system category. A delivery strategy should therefore test actual user journeys instead of treating an operating-system share as a complete description of audience performance requirements or geographic infrastructure quality.

What do mitigation and automated-traffic measurements show?

Mitigation is an action applied to traffic, not a definitive count of criminal activity. Bot location also describes observed network origins instead of the residence or identity of an operator.

How much traffic receives different forms of mitigation?

  • Global; Cloudflare-observed traffic: Traffic mitigated as DDoS or by managed WAF rules: 3.3% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Equatorial Guinea; Cloudflare-observed traffic: Traffic mitigated for any reason: 40% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Equatorial Guinea; Cloudflare-observed traffic: Traffic mitigated as DDoS or by managed WAF rules: 29% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Dominica; Cloudflare-observed traffic: Traffic mitigated for any reason: 0.7% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Dominica; Cloudflare-observed traffic: Traffic mitigated as DDoS or by managed WAF rules: 0.1% (1 January–2 December 2025). (Cloudflare, Dec 2025)

The overall mitigation measure includes actions broader than the DDoS and web-application-firewall subset. The two measures are not interchangeable, and the narrower measure is contained within the broader one. A mitigated request is not automatically a confirmed attack; rules and difficulties can apply for several operational reasons. Geographic percentages use traffic observed for the relevant location instead of the world total. They cannot be used to rank national cybercrime without further evidence.

Where does the observed bot traffic originate?

  • Global; Cloudflare-observed traffic: Share of observed bot traffic originating in Germany: 6.5% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Share of observed bot traffic originating in the top ten countries/regions: 71% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Share of observed bot traffic from two AWS autonomous systems: 14.4% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Share of observed bot traffic from two Google Cloud autonomous systems: 9.7% (1 January–2 December 2025). (Cloudflare, Dec 2025)
  • Global; Cloudflare-observed traffic: Share of observed bot traffic from Microsoft Azure: 5.5% (1 January–2 December 2025). (Cloudflare, Dec 2025)

The source assigns requests to countries and networks. That identifies infrastructure carrying requests, not the ultimate person or organisation controlling them. Autonomous-system shares can include legitimate automated services as well as unwanted activity. Cloud providers host many unrelated tenants, so their appearance does not make the provider responsible for every request. Country totals and network shares overlap instead of representing separate categories that sum to a new total.

Glossary

Methodology and sources

Every figure on this page comes from the organisation that produced it: regulators, statistics offices, public bodies, research institutes, and companies reporting their own data or surveys. Each one links to the original report or dataset and carries its release date. Survey results keep their population and fieldwork period, and financial figures keep the measure the producer used. Figures from different producers are not added together or ranked against each other. The page is reviewed monthly and updated when a producer releases newer data.