Companies Using CFML

I run the crawler that records the cookies and headers each domain sends us, and CFML is the language row with the clearest platform story. A domain counts when it sets a CFID cookie, ColdFusion's session identifier. Our October 2026 crawl puts that at 20,265 domains, 3rd of 13 in Programming Languages, with 13,619 matched to a company. On 16 October 2026 I re-requested a random 4% of the clean set, 806 domains, first with a plain request and then in a headless browser, and resolved every address to its network. Our guide to technology detection methods explains how cookie rules work.

What the cookie means

A CFML server issues CFID and CFTOKEN to keep track of a visitor. Adobe ColdFusion and Lucee both do it, so this row counts CFML servers, not Adobe licences. Both engines run on Java: Lucee describes itself as a language for the JVM, and Adobe's engine was rewritten in Java for ColdFusion MX in 2002, per Wikipedia. When an application uses Java sessions as well, the server adds Java's JSESSIONID. 7,524 domains set both cookies today, 37.35% of CFML's clean set, which is why the same servers appear on our Java page.

Sales signal: a CFID cookie identifies a CFML engine and says nothing about who pays for it. Ask which engine before pitching ColdFusion licensing, hosting or migration.

Finalsite writes an eighth of it

2,420 domains (12.01%) are Finalsite sites, and in the sample 94 of the 806 were Finalsite school pages, 90 of which set CFID once the page loaded in a browser. Finalsite sells websites to schools, so each district site carries the cookie without anyone at the school choosing ColdFusion. The company list shows it: Albuquerque, Minneapolis, Fresno, Oakland and Long Beach districts all appear through individual school subdomains.

"An eighth of ColdFusion's web footprint is school websites, and not one of those schools chose ColdFusion. Their website vendor did." - David Thomson, CTO at TechnologyChecker.io

Sales signal: for school rows, the buyer is the district's communications office and the platform is Finalsite. Pitch them as Finalsite customers.

The other platforms and hosts

The smaller clusters work the same way. Doteasy's website builder accounts for 636 domains (3.16%) and Website.com's free website2.me subdomains for 199. Promotional-products distributors on Distributor Central show up as 210 pages titled "Human Verification", an AWS bot check set up for distributorcentral.com. Swiss municipalities and schools on GOViS, the CMS of the agency backslash AG, made up 14 of the 806 sampled domains, all on one Swiss host. Elsewhere the networks are general: Cloudflare 26.18% of the sample, Microsoft 12.16%, Amazon 11.04%, OVH 8.44%, and 42 domains (5.21%) on one Windows hosting network, CyberCon, where half the servers reverse-resolve to ezhostingserver.com.

Sales signal: about one sampled domain in four sits on a platform or a shared host. For those, the platform's own marketplace or partner programme is the channel.

How much of it is current

658 of the 806 (81.64%) set CFID on a homepage visit on 16 October 2026. 72 stopped us at a bot wall, 24 didn't answer and 24 returned an error page, five of them bicycle shops answering with the same 503 page. Placeholder pages were rare, 3 of 806. Since we began tracking on 16 March 2026, 1,197 domains dropped the cookie on at least one hostname, and 266 of those still set it on another. The monthly total rose from 9,701 in June to 20,265 in October, which reflects our side: the set of domains we crawl turns over every month, dead sites out and newly found ones in, and our detection widens.

Sales signal: four in five rows are live and identifiable. Treat this as a working list, but recheck any domain behind a bot wall before outreach.

Who and where

The United States holds 9,425 of the 13,619 matched companies (69.2%), the United Kingdom 950, Canada 705 and Switzerland 493. 54.8% of companies with a known size employ 1 to 10 people and only 378 employ more than 1,000. Education is the biggest sector, 17.17% across three categories, and 43.19% of companies with a founding year predate 1990. Named enterprise users run one application each: Penn State's registrar, UC Davis's portal, Woodward's eBusiness login, Arthur J. Gallagher's business continuity site.

Sales signal: for enterprises, the CFML application has an owner in a business unit. Modernisation offers land better with that owner than with central IT.

Overlap with other languages

We publish no switching rows for CFML. The overlaps are servers that run two things at once: 7,524 domains with Java's cookie, because the engine runs on Java, and 353 with PHP. Of the 689 domains that ran CFML and PHP together at some point since March, 353 (51.2%) still do, a lower share than Java's, but the numbers are too small to call a trend.

"When CFML and PHP share a domain, I look for an old application sitting next to a newer site. That is where a rewrite conversation starts." - David Thomson, CTO at TechnologyChecker.io

Sales signal: the 353 domains running both are the shortlist for migration services.

The stack around it

Across the 20,146 clean domains, Microsoft IIS answers on 27.01%, Nginx on 25.25% and Apache HTTP Server on 8.36%. Microsoft ASP.NET shows on 29.02%, yet 209 of the 806 sampled domains sent an X-Powered-By: ASP.NET header and none set an ASP.NET session cookie, so that row mostly marks Windows servers. Cloudflare fronts 35.72%, Plesk appears on 2.94%, and GoDaddy's 15.95% is mostly DNS: 115 of the 806 use GoDaddy's nameservers.

Sales signal: a quarter of CFML sites run on Windows and IIS. Windows hosting, patching and security services fit this list better than most.

What it costs

Adobe's ColdFusion buying guide lists no prices, sells Standard and Enterprise by subscription, and says perpetual licensing is no longer available for any version. Lucee is free and open source. Our cookie can't separate the two engines.

Sales signal: with perpetual licences gone, every Adobe site's next upgrade is a subscription decision, which is when Lucee and migration offers get a hearing.

Key takeaways

1. 20,265 domains set ColdFusion's CFID cookie; 81.64% of a random 806 still did on 16 October 2026.

2. Finalsite's school sites are 12.01% of the clean set.

3. 69.2% of matched companies are American and 54.8% have 1 to 10 staff.

4. 7,524 domains also set Java's cookie, because the engines run on Java.

How to use this list

Split it three ways: Finalsite school sites, builder and platform sites, and self-run ColdFusion. The third group, about three quarters of the sample, carried no platform fingerprint, and that is where licensing, hosting and modernisation offers belong. The full list of 20,265 domains, with 13,619 matched companies, is on TechnologyChecker.io.