Companies Using Sucuri

I'm Mehmet Suleyman, CEO and co-founder of TechnologyChecker.io. Before starting the company I worked at Microsoft, first on the Bing search team and then on its AI team, which is where I got hands-on with web crawling infrastructure. This analysis covers 94,055 active Sucuri domains from our September 2026 crawl, 70,274 of which we matched to a company record, a 74.7% match rate. Sucuri is one of the easier technologies to measure honestly. Its firewall is a reverse proxy, so every site behind it answers with Sucuri's own response headers, and nothing depends on a script running in a browser. On September 15, 2026 we re-checked a random sample of 50 current Sucuri domains, and 45 still returned Sucuri's firewall header. The count on this page is sites routed through that firewall, not site-seal badges or scanner accounts.

Growth trajectory

Our records show Sucuri on 77,614 domains in June 2026, 91,538 in July, 92,446 in August and 94,055 in September. Don't read the June-to-July jump as a sales surge. That step reflects changes on our side, both the domains we cover and the signals we detect Sucuri with. The two months after it are the better growth read, and they add 2,517 domains, about 2.7%. Even that isn't a same-domain comparison, because the set of domains we crawl turns over every month as dead sites drop out and new ones are added.

Scale is the clearer story. Sucuri ranks first of 18 technologies in the WAF & DDoS Protection category with 39.32%, just ahead of DDoS-Guard at 37.76%, a DDoS protection and hosting provider that has operated since 2011 according to its company page. Imperva is third at 12.05%. One caveat changes how you should read the rank. Cloudflare's firewall isn't in this category, because we classify Cloudflare under CDN, so first place here doesn't mean Sucuri outranks Cloudflare.

"Sucuri tops its category on volume, and nearly three in four of those domains keep their DNS or email at GoDaddy. For a seller, that second number says more about this list than the rank does." - Mehmet Suleyman, CEO & Co-founder at TechnologyChecker.io

Sales Signal: This is a steady installed base, not an expanding one. Time outreach to account events you can observe, such as a DNS or hosting change, rather than to a growth wave the data doesn't show.

The GoDaddy channel

GoDaddy announced its acquisition of Sucuri in March 2017 and, three months later, launched GoDaddy Website Security, powered by Sucuri. GoDaddy's help center still describes that product's firewall as the Sucuri Firewall. Our data shows how heavily the channel shapes the base. 73.18% of Sucuri domains keep their DNS or email at GoDaddy, against roughly 15% of all the domains we crawl, so Sucuri's customers are about five times more GoDaddy-concentrated than the web as a whole. Another 18.25% are built on GoDaddy Website Builder.

That changes who the buyer is. Many of these owners likely bought "website security" as a line item from GoDaddy rather than choosing Sucuri by name. Sucuri's own customer stories page points the same way, featuring agencies, hosts and maintenance services such as Kinsta, Webhosting.net, WP Maintain and ITW Consulting instead of enterprise logos.

Sales Signal: Pitch the category, not the brand. An owner who added protection through GoDaddy thinks of it as part of the hosting bill, so a conversation about what they pay their registrar for security lands better than a Sucuri feature comparison.

Customer profile

The size data is lopsided. 58.08% of matched companies have 1-10 employees and 26.33% have 11-50, so 84.41% of the 67,901 firms with a size on record employ 50 people or fewer. They aren't young, though. The 2010s are the largest founding decade at 34.79%, the 2000s add 23.38%, and only 7.98% were founded in the 2020s. The largest industries are construction, medical practices and IT consulting, so the typical account is a local firm that has been trading for a decade or more.

The large accounts need careful reading. At the top of the company list, Deloitte, Red Hat and RSM appear through subdomains: job.deloitte.com, coolstuff.redhat.com and technologyblog.rsmus.com. Subdomains like these tend to be career pages, campaign sites and blogs sitting behind a firewall, not the corporate perimeter. A smaller group does protect the main domain. When we re-checked them on September 15, 2026, berkshirehathaway.com, sasol.com, www.iocl.com, energizerholdings.com and mapleleaffoods.com each still returned Sucuri's firewall header. Across the whole matched base, just 1,052 companies (1.55%) employ more than 1,000 people.

Sales Signal: Treat an enterprise detection as a way into one team, not as a company-wide security decision. The volume is in the sub-50-employee tier, where the person who approved the firewall is likely the same person who owns the business.

Industry and geographic concentration

No industry reaches 6%. Construction leads at 5.48%, then Medical Practices at 3.61% and IT Services and IT Consulting at 3.2%. Cluster them and a local-service tilt appears: construction plus real estate reach 8.5%, and medical practices plus hospitals and health care reach 6.3%. Geography is far more concentrated. 49,311 of the 70,274 matched companies are in the United States, and the US, Canada, the UK, Australia and Ireland together account for 83.21%. The outlier is the United Arab Emirates, sixth with 790 companies, ahead of Italy (662), Mexico (599) and Germany (477).

Sales Signal: Build North American lists by vertical. Construction and healthcare practices carry the most volume, and a clinic that handles patient data already has a reason to talk about security. The UAE cluster is small enough to work account by account.

Where departing sites go

Our records show 7,863 domains that have stopped showing the Sucuri signal since mid-March 2026. We don't publish a switching table for Sucuri, and the reason is worth spelling out. Among domains that stopped routing through Sucuri, 44% now show Cloudflare, against 27% of those still on Sucuri. That gap is real. But Cloudflare already sits on more than a quarter of Sucuri's current base, so a good part of that 44% is what ordinary churn would produce anyway. The lift works out at roughly 1.6 times, below the threshold we use before calling a flow a migration corridor.

"Sites that leave Sucuri show Cloudflare more often than sites that stay, but Cloudflare is already on more than a quarter of the ones that stay. That's a tilt, not a corridor, and I'd rather say so than sell you a migration story." - Mehmet Suleyman, CEO & Co-founder at TechnologyChecker.io

Sales Signal: If you sell CDN migrations or Cloudflare services, domains that recently dropped Sucuri are a reasonable list, but qualify each one. Sucuri's own Cloudflare setup guide shows the two are designed to run together, and 27.06% of current Sucuri domains already show Cloudflare, which makes many of them a consolidation conversation rather than a replacement.

Technology ecosystem

The stack is small-business WordPress. WordPress runs on 76.19% of Sucuri domains, against 1.41% for Joomla and 1.08% for Drupal. reCAPTCHA appears on 19.5%, far ahead of Cloudflare Turnstile (0.74%) and hCaptcha (0.32%), so most owners who protect a form still use Google's widget. The web server figures need an explanation before anyone quotes them. LiteSpeed shows on 1.91%, Apache on 1.55% and Nginx on 1.1%, which looks as if almost nobody runs a web server. The real cause is the proxy: Sucuri replaces the origin's Server header with Sucuri/Cloudproxy, so the server underneath is hidden from anyone reading the response, us included. Our guide to technology detection methods explains how header-based signals work.

Sales Signal: Don't build hosting or web-server displacement lists from Sucuri domains using server headers, because they'll come back nearly empty. Use DNS and CMS signals instead, where GoDaddy and WordPress show up clearly.

G2 review signals

Review data is thin for a product this widely deployed. Sucuri's G2 listing averages 3.3 out of 5 across 48 reviews as of September 2026, and each theme in G2's AI summary rests on a single mention, so we haven't published a pros-and-cons table on this page. The themes still line up with our data. Praise centres on price and on getting a firewall, CDN and backups in one plan, which fits a base where 58.08% of companies have ten or fewer staff. The complaints include setup effort, and that matches how the product works, since activating the firewall means changing DNS records. Set 48 reviews against 94,055 domains and the channel story appears again: a base this GoDaddy-heavy is consistent with owners who bought through their registrar rather than from Sucuri directly.

Sales Signal: Sell simplicity and support, not detection quality. Setup effort and slow support responses are what a small owner remembers, and a managed offer that handles the DNS change removes the main friction.

Key takeaways

1. First by domain count at 39.32%, but only 1.56 points ahead of DDoS-Guard, and Cloudflare isn't in the category.
2. GoDaddy is the channel: 73.18% of Sucuri domains keep DNS or email there, about five times the rate across the web.
3. The base is small business, with 84.41% of sized companies at 50 employees or fewer.
4. Big-brand detections are often subdomains, though Berkshire Hathaway, Sasol and Indian Oil run their main domains through Sucuri.
5. Departing domains tilt toward Cloudflare: 44% now show it, against 27% of those still on Sucuri, a lift too small to call a corridor.

Sales applications

Outreach angle: "Your site runs through a Sucuri firewall and your DNS is at GoDaddy. That combination shows up on about three in four Sucuri sites we track. Worth fifteen minutes to check what you're paying for and whether it covers what you need?" Targeting: on TechnologyChecker.io, filter this list to the United States and Canada, 11-200 employees, in construction, medical practices and real estate, then intersect with WordPress. Competitive angle: domains that dropped Sucuri recently have just changed their edge setup, which makes them a timely list for anyone selling CDN, firewall or managed security services.

Every figure above comes from our own crawl and enrichment: 94,055 active Sucuri domains and 70,274 matched companies. Filter the list by size, country and industry, or compare it with the rest of the WAF & DDoS Protection category on TechnologyChecker.io.