Companies Using gunicorn

gunicorn is a server you aren't supposed to see. Its own deploy guide strongly recommends putting a proxy such as Nginx in front, and when that's done, Nginx answers and gunicorn's Server header never reaches the outside world. So a domain counts on this page only when gunicorn speaks for itself. As of our October 2026 crawl that's 7,728 domains, 15th of the 70 web servers we track, and 4,393 of them match a company. It's a small, odd sample of Python's web footprint, and the oddest part is who's in it.

What the header shows

I checked 24 random domains from the list in October. 16 answered with gunicorn's header directly, two of them with a Via header showing a proxy that passed it through. Three sat behind Caddy and sent two Server headers, Caddy's and gunicorn's. Three redirected to another domain that answered with gunicorn, one was a disabled site and one didn't respond. None was behind Cloudflare. So the count is real, and it's the exposed edge of a much larger installed base.

Sales signal: a gunicorn header means the application server meets visitors with nothing to buffer slow clients. For proxy, CDN and web-security vendors, that's a specific gap to raise.

Two platforms carry a fifth of the count

1,385 domains announce gunicorn 19.10.0, and when I loaded 40 of them, 37 were gallery sites built by Artlogic, which sells websites and inventory software to the art world; their pages carry a "Site by Artlogic" credit and Artlogic-hosted images. That's roughly 1,280 Artlogic sites, about one domain in six, and it's why Artists and Writers, Retail Art Dealers and Fine Art add up to 16.65% of matched companies. The second platform is SpotOn, the restaurant point-of-sale company: 296 gunicorn domains load SpotOn's scripts, and 14 of the 15 I sampled ran gunicorn 19.9.0. Smaller carriers are the RGive donation platform (56 domains) and Stageplaza's internship sites (23).

Sales signal: the account for most gallery and restaurant rows is the platform, not the gallery or the restaurant. Sell infrastructure to Artlogic and SpotOn; sell art-market or hospitality software to their customers.

Growth trajectory

The chart reads 4,646 in June 2026, then 6,237, 6,886, 7,465 and 7,728 in October. I wouldn't call that growth. The domain set we crawl turns over every month, with dead sites dropping out and new ones added, and our detection signals widen over time; both moved the line through September. Since March 2026, 667 domains have dropped gunicorn on a hostname, and about one in 11 of those still shows it on another.

"Most gunicorn installs are invisible to us, and that's how the project wants it. The ones we see either skipped the proxy or belong to a platform that never changed its defaults." - David Thomson, CTO at TechnologyChecker.io

Sales signal: size Python's web market from Django and the hosting data, not from this count. Use this list for the exposed deployments.

Who runs gunicorn

65.92% of matched companies have 1 to 10 employees and 86.75% have 50 or fewer. They're also young. 23.06% were founded in the 2020s, against 15.7% on Apache's profile, and the 99 companies above 1,000 staff usually run a single application on gunicorn. The UK National Archives serves Find Case Law from gunicorn, Mintel its client portal, G Adventures its developer API, Caribbean Airlines its Jetpak service. Tate, IDEXX, Aveanna Healthcare and JTEKT North America answer from it on their main sites.

Sales signal: outside the platforms, a gunicorn header at a large organisation marks an in-house Python team that shipped something public. That team buys hosting, monitoring and developer tooling.

Layered, not switched

We test every server pair for switching, and none of gunicorn's passed. 482 domains show gunicorn and Apache today, 453 gunicorn and Nginx, 378 gunicorn and Caddy and 8 gunicorn and Kestrel. Most domains ever seen with both still run both, which is what layering looks like: a proxy on one hostname or in front, the Python app behind. The Caddy pairs are the clearest case, since Caddy passed gunicorn's header along with its own.

"Seeing gunicorn next to Nginx isn't a migration. It's the architecture gunicorn's documentation asks for, caught half-configured." - David Thomson, CTO at TechnologyChecker.io

Sales signal: pitch the missing layer, not a replacement. Teams exposing gunicorn already chose their framework; they may not have chosen their edge.

The stack: Django on AWS

Of the 7,832 live gunicorn domains left after we removed for-sale and gambling pages, 21.76% run Django, the framework we find most often behind a gunicorn header. Amazon Web Services shows on 13.93%, Azure on 5.68% and OVHcloud on 2.81%. Google Analytics is on 53.26%, and Matomo (2.36%), Plausible (1.23%) and Umami (1.07%) form a privacy-minded minority.

Sales signal: Django agencies and AWS partners have the clearest fit. Privacy-focused analytics vendors already have a foothold.

Versions: nothing newer than 2020 announces itself

gunicorn removed its version from the Server header in 20.1.0, released in February 2021, so every version we can read is 20.0.4 or older. In the 45 days to mid-October 2026 we saw a gunicorn header on 7,488 domains, and 2,135 of them carried a version: 19.10.0 on 1,408, 19.9.0 on 409, 20.0.4 on 144 and older releases on the rest, including 15 from the 0.x series. gunicorn's changelog lists the fix for CVE-2024-1135, a request smuggling flaw NVD rates 7.5, in 22.0.0 from April 2024. Every versioned domain predates it, unless a distribution patched the package without changing the number.

Sales signal: most of the 2,135 sit on two platforms, so the patch is one deployment each for Artlogic and SpotOn. The rest are individual teams on releases from 2021 or earlier.

Key takeaways

1. 7,728 domains expose gunicorn's header, 15th of 70 web servers and a floor for real use.

2. Artlogic gallery sites are roughly 1,280 of the domains; SpotOn's restaurant sites add about 300.

3. 86.75% of matched companies have 50 or fewer staff, and 23.06% were founded in the 2020s.

4. Django runs on 21.76% of gunicorn domains, AWS on 13.93%.

5. All 2,135 versioned domains run 20.0.4 or older, before the CVE-2024-1135 fix.

How to use this list

Split the Artlogic and SpotOn rows from the rest, then filter by company size. Our technology detection methods post explains how header signals are matched. For the full list of 7,728 gunicorn domains with company, size and stack data, explore TechnologyChecker.io.