Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare

Recorded: Sept. 8, 2026, 9:09 a.m.

Original

Summarized

Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare - CipherCue

CIPHERCUE

Directory
EU Vendors
Docs
Pricing
Blog
Log in
Book a demo
Sign up free

Directory
EU Vendors
Docs
Pricing
Blog
Log in

Book a demo
Sign up free

analysis
Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare

8 September 2026 · 8 min read
· By Chris McCabe

A content delivery network sits in front of a website. Requests hit the CDN's edge servers first, which serve cached content, terminate TLS, filter traffic, and pass the rest back to the origin. That means the CDN is a shared dependency: if it goes down, every site behind it goes down together, whether or not those sites have anything else in common.
I went through CipherCue's tracked European companies to see which CDN fronts their websites. Of the 44,143 companies where we detected a CDN at all, 39,547 are behind Cloudflare. That is 89.6%.
89.6% of 44,143 European companies with a detected CDN sit behind Cloudflare
For a reference point, W3Techs put Cloudflare at 84.1% of sites where the reverse proxy provider can be identified, as of 28 July 2026 (w3techs.com). Our 89.6% is measured the same way, as a share of the identified set rather than of all sites, so the two are close; the European cut here runs a little higher.
I only counted companies that actually run a CDN. If a company serves its site straight from its own origin, it is not in these numbers at all. So this is not "Cloudflare vs the entire web"; it is who the CDN users went with.
First place and everyone else
The four CDN vendors we classify, counted as distinct companies where each was detected:

39,547
Cloudflare

3,112
Amazon

1,299
Fastly

396
Akamai

Distinct European companies where each CDN vendor was detected (a company can appear under more than one vendor)

Amazon is second at 3,112, but that number needs a caveat. We detect Amazon through CloudFront, and Amazon is also a general cloud host, so some of these are companies whose origin happens to sit on AWS rather than companies that deliberately chose CloudFront as their front door. Fastly does not have that ambiguity. It is a pure CDN, and it comes third at 1,299, which is roughly one company for every thirty behind Cloudflare. Akamai, the oldest name in the category, is fourth at 396.
The raw counts add up to more than 44,143 because a company can sit behind more than one vendor and is counted under each (a Fastly front door with an AWS origin, say). That double counting pads the smaller vendors' totals, not Cloudflare's share, which is measured against the whole CDN-using set.
Per country
Rolling eight countries into one figure hides the differences between them, so here is the same measurement per country. Cloudflare is the majority front door in all of them, but the share ranges from about four in five in Spain and Ireland to about nineteen in twenty in the Netherlands.

CountryCompanies with a CDNBehind CloudflareCloudflare share

Netherlands7,9397,58795.6%
United Kingdom17,00715,84693.2%
Poland2,8962,68292.6%
France4,0083,45686.2%
Italy3,6613,12685.4%
Germany5,7154,65081.4%
Spain2,0011,57678.8%
Ireland79262478.8%

The UK has the largest absolute count, 15,846 CDN-using companies behind Cloudflare in one market. Germany is the lowest of the big markets at 81.4%, which is still four in five.
What the concentration costs
Part of why a company buys a CDN is resilience, and one advantage of independent suppliers is that they fail independently. That advantage disappears when most of a market is behind the same supplier. An incident there is no longer one company's outage; it is most of the market's outage, on the same afternoon.
Cloudflare has published postmortems for several incidents in the last fifteen months. Three were global and hit customers:

18 November 2025, roughly 11:20 to 17:06 UTC. A database permissions change caused a Bot Management feature file to fill with duplicate entries and double in size, past a limit the proxy enforced, which crashed core CDN and security serving. Cloudflare's writeup states the outage was "not caused, directly or indirectly, by a cyber attack or malicious activity of any kind" (blog.cloudflare.com).
5 December 2025. A configuration change applied while mitigating an industry-wide React Server Components vulnerability caused a global disruption (Cloudflare outage postmortems).
20 February 2026, from 17:48 UTC, lasting 6 hours 7 minutes. A cleanup automation task read a buggy API response as an instruction to withdraw BYOIP prefixes, and 25% of them were pulled from the internet via BGP. Cloudflare again states it was "not caused, directly or indirectly, by a cyberattack or malicious activity of any kind" (blog.cloudflare.com).

None of the three was an attack. A doubled config file, a change made while patching someone else's vulnerability, a cleanup job that deleted too much: routine internal work that reached the edge and took a lot of sites down with it. The companies in the table did not need anything in common to go offline together on 18 November. Sharing a front door was enough.
This is not about Cloudflare being sloppy. Fastly and Akamai ship bugs like this too; theirs just take fewer sites down because fewer sites are behind them. That is the whole point. When one provider fronts most of a market, its mistakes stop being its own problem and become everyone's, at the same time.
The front door is not the whole stack
One thing this does not tell you is where a company's data lives. The CDN is the front door. The origin server, the database, and whoever processes the data behind it are a separate question, and for a GDPR or data-residency argument that back end matters more than the edge. If you measure it instead, you get a more European answer: people who look at API subdomains rather than the front door tend to find a lot more OVH and Hetzner than shows up here. So treat this as a finding about the front door specifically. I looked at the front door because that is the part that breaks for every visitor at once, which is what the outages above did.
Check your own front door
You can see which CDN, if any, fronts a domain from its response headers:
curl -sI https://example.com | grep -i 'server\|cf-ray\|x-served-by\|x-amz-cf-id'
A cf-ray header or server: cloudflare indicates Cloudflare. x-served-by with a Fastly cache node indicates Fastly. x-amz-cf-id indicates Amazon CloudFront. No such header, and a server value naming your own web server or origin host, usually means no CDN in front.
Method note
Source and cohort: CipherCue's own observations of European company websites (HTTP response fingerprinting and DNS), not a third-party dataset. The cohort is the companies in our tracked entity set with a country attribution in one of Germany, the United Kingdom, the Netherlands, Poland, France, Italy, Spain, or Ireland, and at least one CDN component detected. That gives 44,143 companies, using the latest observation per company as of 2026-09-07. This is a company count within our dataset, not a representative sample of every company in these countries, and not a claim about companies that use no CDN at all. The cohort also skews toward small and mid-sized companies rather than large enterprises, and Cloudflare's free tier is strongest in exactly that segment, so read the figure as concentration among CDN-using companies of this mix, not as a statement about large enterprises specifically.
What "detected a CDN" means: we classify a component as a CDN when the response headers or serving fingerprint match a known CDN vendor's pattern (for example a cf-ray header for Cloudflare, a Fastly cache-node x-served-by, a CloudFront x-amz-cf-id). Companies that serve directly from an origin with no recognised CDN fingerprint are excluded from the denominator. A misconfigured or unusual setup that hides these headers would be undercounted.
Double counting: a company can be detected behind more than one CDN vendor and is then counted under each. The Cloudflare share (89.6%) is Cloudflare-detected companies divided by all companies with any CDN detected, so a company behind both Cloudflare and Fastly counts once in the numerator and once in the denominator. Raw per-vendor counts therefore sum to more than 44,143.
The Amazon caveat: Amazon is detected via CloudFront, but Amazon is also a general cloud host. Some Amazon detections are front-door CloudFront choices and some are AWS-origin serving; we do not separate the two here, which is why Fastly (an unambiguous pure CDN) is called out as the nearest clean comparison.
Outage details are from Cloudflare's own published postmortems, cited inline. Times and durations are as stated by Cloudflare. We link the primary source for each rather than restating figures from secondary coverage.
Country grouping is our choice and is stated explicitly so the per-country table can be read on its own; the headline figure is the union of these eight markets, not a single country.
Finding this in your own market
CipherCue tracks CDN, hosting, email, and DNS infrastructure per company, filterable by vendor, country, and sector. If you sell a European alternative in one of these categories, the directory shows which companies in your market currently run which incumbent: the companies we detect behind Cloudflare are listed there, and the EU vendor directory covers the alternatives by category.

Cloudflare
CDN
concentration
Europe
digital sovereignty
data analysis

Free account
Researching a company mentioned in this article?
See its observed tech stack, DNS posture, hosting geography, and change history. Free, no credit card. Set up in 30 seconds.
Show me the data →

Prefer email updates? Subscribe to our research digest →

Get our infrastructure research by email
New research and analysis delivered to your inbox. No spam. Unsubscribe any time.

← Back to free account signup

analysis
CAA Has Been Mandatory Since 2017 but 93.1% of Company Domains Skip It

analysis
Ireland Is Being Taken to Court Over NIS2. 88% of the Security Vendor Detections We Found Were American.

analysis
Nearly Half of the Company Websites We Checked Had No Security Headers

CIPHERCUE

Sovereignty intelligence for European cybersecurity vendors. Continuous, sourced observation of organisations' public infrastructure.

Product
Capabilities
Pricing
Request Demo
Directory
Companies by Technology

Resources
Docs
Intelligence Blog
Scanning Policy
Disclosure

A content delivery network functions by positioning itself in front of a website, where requests first reach the CDN's edge servers to serve cached content, handle TLS termination, filter traffic, and subsequently pass requests to the origin server. This architecture establishes the CDN as a shared dependency; consequently, any failure in the CDN impacts all websites relying on it, regardless of their individual separation.

An analysis conducted by CipherCue on European companies utilizing a CDN revealed significant market concentration. Among the 44,143 European companies where a CDN was detected, nearly 9 in 10, or 89.6%, were hosted behind Cloudflare. This finding indicates that Cloudflare functions as the dominant front door for the majority of CDN-using organizations in the region. When classifying distinct vendors based on detected usage, the hierarchy places Cloudflare first with 39,547 instances, followed by Amazon with 3,112, Fastly with 1,299, and Akamai with 396. This raw counting is complicated by double counting, as some companies are detected behind multiple vendors, skewing the smaller vendor counts but accurately reflecting Cloudflare's share relative to the total set of CDN-using companies.

The concentration effect has profound implications for resilience. When a large segment of a market relies on a single provider, an incident at that provider results in a systemic outage affecting most customers simultaneously. Postmortems published by Cloudflare on various incidents demonstrate that widespread disruptions occurred due to internal configuration changes or cleanup automation tasks interacting with edge systems, rather than malicious cyberattacks. This underscores that shared infrastructure creates collective risk; whether the failure stems from a specific vendor's error or routine maintenance activities, the consequence is distributed across the entire market segment relying on that provider.

It is crucial to distinguish between the CDN layer and the infrastructure behind it when considering legal mandates like GDPR or data residency requirements. The CDN serves as the front door for traffic management, but data location regarding the origin server, database, and processing logic remains separate. Analysis of API subdomains suggests a different pattern, indicating that inquiries into backend infrastructure might reveal a greater presence of providers such as OVH and Hetzner than what is reflected in edge statistics alone. Therefore, while CDN concentration addresses front-end availability risks, operational scrutiny for data sovereignty demands examining the origin structure.

Technically identifying the CDN used by a domain involves inspecting response headers; patterns such as the cf-ray header signal Cloudflare, whereas specific headers like x-served-by indicate Fastly or x-amz-cf-id points to Amazon CloudFront. This empirical observation method allows for assessing front-door concentration across European markets while acknowledging methodological limitations, including the fact that the tracked cohort tends toward small and mid-sized companies where the free tier of services like Cloudflare is particularly prevalent.