Next.js at 10: Adoption Across the S&P 500, the World's Top 10,000 Sites and Turkey (2026 Study)

Next.js was released as open source on 25 October 2016. To see where it stands after ten years, we measured three different lists: the 500 largest US public companies (S&P 500), the world's 10,000 most popular websites (the Tranco list) and Turkey's 1,000 most popular .tr sites. We examined the source of 7,070 homepages in total and combined the results with ten years of npm download data.

Key findings

• 12.8% of the world's top 10,000 homepages run on Next.js. That is almost exactly the share of WordPress (13%), and about 3.4 times the 3.8% W3Techs reports for the web as a whole. Next.js is concentrated on large, heavily visited sites.
• 14.1% of S&P 500 company homepages use Next.js (48 of 340 measurable companies). That puts it second, behind Adobe Experience Manager (25.6%). The list includes Walmart, Target, Nike, PepsiCo, Procter & Gamble, AT&T, Citigroup, Northrop Grumman and Palantir.
• Among S&P 500 sites built with a modern JavaScript framework, 87.3% use Next.js. Competing frameworks barely register in corporate America: Nuxt, Astro, SvelteKit, Gatsby and Angular appear on 7 companies combined.
• In Turkey the share is 9.6%, again neck and neck with WordPress (9.8%).
• Three years after App Router went stable, corporate sites are still on the old architecture. Only 39.6% of S&P 500 Next.js sites use App Router, against 53.3% in the global top 10,000 and 58.5% in Turkey.
• Most Next.js sites run outside Vercel. 16.4% of Next.js sites in the top 10,000 show a Vercel signature; in Turkey it is 3.7%.
• 2026 is a break year on npm. The next package was downloaded 306 million times in October 2026, up from 65 million a year earlier. For every 100 React downloads there were 1.7 Next.js downloads in 2017 and 36.1 in October 2026.

1. The world's most popular sites: Next.js and WordPress are level

Tranco is a research-oriented popularity ranking that averages five sources (Chrome user data, Cloudflare Radar, Cisco Umbrella, Majestic and Farsight) over 30 days. Of the top 10,000 domains, 5,873 returned a measurable homepage. The rest were API, CDN or ad domains, sites behind bot protection, or sites that did not respond.

754 of the measurable sites (12.8%) show Next.js markers; 762 (13%) show WordPress. Across the whole web, W3Techs puts WordPress at 39.3% and Next.js at 3.8% of all websites. Among the most popular sites the picture flips: companies with large product teams choose Next.js rather than WordPress.

Share rises with popularity: 14.3% in the top 1,000, 14.1% for ranks 1,001-5,000 and 11.6% for ranks 5,001-10,000.

Other modern frameworks trail far behind: Nuxt 2.3%, Astro 1.4%, with SvelteKit, Gatsby, Remix and Angular around half a percent. Of the 1,050 sites using a modern JavaScript framework, 71.8% use Next.js.

2. The S&P 500: corporate America's web stack

S&P 500 websites still run largely on enterprise content management systems. The most common platform is Adobe Experience Manager (87 companies, 25.6%). Next.js is second with 48 companies, followed by WordPress (46), Sitecore (38) and Drupal (33).

The Next.js companies are not concentrated in one sector. The list spans retail (Walmart, Target), consumer goods (PepsiCo, Procter & Gamble, General Mills, Nike), finance (Citigroup, Robinhood, Cboe), defence (Northrop Grumman, General Dynamics, Huntington Ingalls) and energy and utilities (American Electric Power, CenterPoint, Oneok). The sector breakdown is in the table below.

35.4% of S&P 500 Next.js sites show a headless CMS marker, most often Contentful (11 companies). The common enterprise pattern is content managed in a separate CMS and delivered through Next.js.

3. Turkey: the same balance on different infrastructure

Of the 1,000 most popular .tr domains in the Tranco list, 857 were measured. Next.js appears on 82 sites (9.6%) and WordPress on 84 (9.8%). Turkey sits slightly below the global top 10,000, but far above the all-web average.

Two differences stand out. Turkish Next.js sites have moved to App Router faster (58.5%), which may reflect a larger share of newer projects. And Vercel is almost absent (3 of 82 sites): Turkish companies run Next.js on their own servers or behind Cloudflare. Headless CMS markers are also rare (1 site).

4. Inside Next.js: the App Router and Turbopack transition

App Router, introduced in Next.js 13 (October 2022), is the routing architecture built on React Server Components. It was declared stable in May 2023 (13.4). Homepage HTML shows which architecture is in use: App Router pages contain the self.__next_f stream, Pages Router pages contain the __NEXT_DATA__ script.

Three and a half years after the stable release, most S&P 500 Next.js sites (58.3%) are still on Pages Router. Migrating large codebases is expensive, and Pages Router remains supported.

Turbopack became the default for production builds in Next.js 16 (21 October 2025). Pages built with Turbopack load a file starting with /_next/static/chunks/turbopack-, which indicates a build with Next.js 15.5 or later. The share is around one third in all three samples: 31.3% in the S&P 500, 30.8% in the top 10,000 and 36.6% in Turkey. Roughly a third of Next.js sites have moved to a current release within the past year.

A hygiene note: 38.9% of Next.js sites in the top 10,000 still send the X-Powered-By: Next.js header. This is not a vulnerability on its own, but it advertises the stack for no benefit and can be switched off with poweredByHeader: false.

5. A decade of growth: npm data

The next package was downloaded 1 million times in all of 2017. That rose to 81 million in 2021 and 621 million in 2025. The last 12 months (November 2025 to October 2026) total 2,010 million.

Next.js also carries more weight within the React ecosystem every year. For every 100 React downloads there were 1.7 Next.js downloads in 2017, 14.3 in 2021, 29 in 2025 and 36.1 in October 2026. A growing share of React projects start directly with a framework, which is what the React team itself recommends.

The 2026 surge is striking: from October 2025 to October 2026, next grew 4.7x and React 3.9x. Over the same period Astro grew 9.2x and SvelteKit 4.9x, while Gatsby declined. npm counts do not separate human developers from CI servers and automated installs, so this data cannot tell us the cause. Projects generated by AI coding tools are one plausible explanation.

A short history of the decade

• October 2016: Next.js 1.0 released as open source.
• July 2019: Next.js 9: TypeScript support, dynamic routing, API routes.
• October 2021: Next.js 12: Rust-based compiler, Middleware.
• October 2022: Next.js 13: App Router, React Server Components, first Turbopack release.
• May 2023: App Router stable in 13.4.
• March 2025: Middleware authorization bypass (CVE-2025-29927, CVSS 9.1).
• October 2025: Next.js 16: Turbopack becomes the default for production builds.
• December 2025: Remote code execution in React Server Components ("React2Shell", CVE-2025-55182 / CVE-2025-66478, CVSS 10). Only current releases using App Router were affected.
• February 2026: React moves to the React Foundation under the Linux Foundation.
• March 2026: Stable Adapter API in 16.2 and a Next.js ecosystem working group with Netlify, Cloudflare, AWS Amplify and Google Cloud.
• July 2026: Monthly, pre-announced security release programme begins.
• November 2026: Latest stable release is 16.4.5.

What it means

• Next.js is now an enterprise standard. It sits alongside enterprise CMS platforms in the S&P 500 and matches WordPress among the most popular sites.
• Update discipline is essential. Critical flaws in 2025 and 2026 hit core features such as App Router and image optimisation. Running Next.js without a maintenance process that follows the monthly security releases is a risk.
• Vercel is optional. Most Next.js sites run elsewhere, and the Adapter API has made that path official.
• Plan the move from Pages Router to App Router. Most corporate sites have not migrated yet, and migration can be done page by page.

Methodology

Samples: (1) S&P 500 companies: the current constituent list on Wikipedia (500 companies), with official domains matched from Wikidata by SEC CIK number and gaps filled by hand. (2) The top 10,000 domains of the Tranco list dated 9 November 2026. (3) The first 1,000 domains ending in .tr in the same list.

Dates: 10-11 November 2026.

Measurement: one request per site to the homepage (the bare domain first, then www). The user agent carried a clear "HititMedyaResearch/1.0" label. We looked for markers that frameworks generate themselves in HTML and HTTP headers: for Next.js, the /_next/static/ path, __NEXT_DATA__, self.__next_f or x-nextjs headers; for other frameworks and CMSs, similar documented markers. The HTML of every S&P 500 site flagged as Next.js was checked by hand.

Measurable site: a homepage that returned 200, contained HTML and was not a bot challenge page. In the S&P 500, 340 companies were measurable; 111 answered with bot protection (mostly 403) and 31 could not be reached. Sites with connection errors were retried once at a slower rate.

Limitations: only the homepage was measured; a company's product, store or careers sites may use other technology. Sites behind bot protection could not be measured, and because these skew towards large enterprise platforms, S&P 500 shares may be off in either direction. Hosting detection relies on HTTP headers, so the origin behind a CDN may be hidden. No version information was collected. npm downloads include CI and automated installs and are not a count of users.

Use the data

Site-level results are available as CSV, and monthly npm data is in a separate CSV. Both are free to use with attribution (CC BY 4.0). To embed the charts on your site, use the code below.

Next.js adoption:

<a href="https://www.hititmedya.com/insights/nextjs-at-10-adoption-study-2026"><img src="https://www.hititmedya.com/data/arastirma/nextjs-kullanim-karsilastirma-en.svg" alt="Share of homepages built with Next.js" width="1200" style="max-width:100%;height:auto"></a>
<p>Source: <a href="https://www.hititmedya.com/insights/nextjs-at-10-adoption-study-2026">Hitit Medya Research</a></p>

S&P 500 platforms:

<a href="https://www.hititmedya.com/insights/nextjs-at-10-adoption-study-2026"><img src="https://www.hititmedya.com/data/arastirma/nextjs-sp500-platformlar-en.svg" alt="Platforms used on S&P 500 company homepages" width="1200" style="max-width:100%;height:auto"></a>
<p>Source: <a href="https://www.hititmedya.com/insights/nextjs-at-10-adoption-study-2026">Hitit Medya Research</a></p>

Ten years of npm downloads:

<a href="https://www.hititmedya.com/insights/nextjs-at-10-adoption-study-2026"><img src="https://www.hititmedya.com/data/arastirma/nextjs-npm-10-yil-en.svg" alt="Monthly npm downloads of Next.js, 2016 to 2026" width="1200" style="max-width:100%;height:auto"></a>
<p>Source: <a href="https://www.hititmedya.com/insights/nextjs-at-10-adoption-study-2026">Hitit Medya Research</a></p>

We plan to repeat this study every year with the same method at the same address. If you spot an error, let us know.

Sources

• Next.js Blog: release announcements (Next.js 9, 12, 13, 13.4, 15, 16, 16.2, 16.4).
• Next.js 16: Turbopack as the default bundler.
• Security advisories CVE-2025-29927 and CVE-2025-66478.
• Next.js security release programme (July 2026).
• Next.js across platforms: Adapter API and ecosystem working group.
• The React Foundation (February 2026).
• W3Techs: usage statistics of Next.js (November 2026).
• Tranco: Le Pochat et al., NDSS 2019. List ID 947N2.
• List of S&P 500 companies and Wikidata.
• npm download counts API.