We recently crawled just over a million domains worldwide looking for websites built with Angular, one of the most popular ways to build websites and web apps over the last decade. 18,699 of them sit on .uk domains.
Then we looked closer. We set aside the sites that belong to big platforms and agency-built clusters, and kept the 1,803 that a UK organisation runs itself. We loaded every one of those in a real browser and read the framework version it actually serves to visitors.
The result: 91% are running a version that no longer receives security fixes. Not "getting a bit old". Out of support entirely.
1,639 of the 1,803 UK business-run Angular websites we verified are on end-of-life versions. 820 of them run AngularJS 1.x, which had its final patch in December 2021.
How we did this
A quick note on method before the numbers, because numbers without method are just marketing.
- We searched public source code across roughly 1.03 million domains for Angular fingerprints, the tell-tale markers the framework leaves in a page.
- We filtered to .uk domains: 18,699 sites.
- We classified each one. 16,869 turned out to be platform or agency clusters: the same template or booking system repeated across hundreds of sites, where one central fix covers everyone. The remaining 1,803 are individually run sites, each one somebody's responsibility.
- We then loaded each of those 1,803 in a real browser and read the framework and version actually served. No logins, no probing, no security testing. Just the public page, exactly as any visitor's browser receives it.
What we found
Of the 1,803 verified, business-run Angular sites in the UK:
- 820 (45%) run AngularJS 1.x. AngularJS reached end of life on 31 December 2021. Nothing on it has been patched since.
- 983 (55%) run modern Angular (version 2 onwards). But 819 of those are on major versions that have also left support.
- That leaves 153 sites, about 1 in 12, on a currently supported version.
Some details that surprised even us:
- The single most common version is Angular 15, on 348 sites. Its security fixes ended in May 2024.
- The most common AngularJS line is 1.6, on 294 sites. It was released in December 2016 and last updated in 2018.
- 195 sites run Angular 9, which left support in August 2021. More UK business sites run Angular 9 than run version 21, which is current.
- 40 sites run AngularJS 1.2 or older. That code shipped in 2013. Those websites are old enough to be in secondary school.
What "end of life" actually means
When a framework version reaches end of life, the people who make it stop fixing it. Any security flaw found after that date stays open forever, no matter how serious.
This is not hypothetical for AngularJS. Since it died in December 2021, six vulnerabilities have been publicly documented against it (CVE-2022-25844, CVE-2022-25869, CVE-2023-26116, CVE-2023-26117, CVE-2023-26118 and CVE-2024-21490). Fixes exist only in commercial forks sold to enterprises. The sites in our data run the originals.
Who runs these sites
These are not abandoned hobby projects. We matched 641 of the 1,803 directly to Companies House records. The sectors we could classify break down like this:
- Hospitality (hotels, campsites, restaurants, venues): 416
- Education and training: 315
- Trades (heating, building, automotive): 118
- Retail: 96
- Charities: 38
- Financial services and advisers: 31
- Medical, pharmacy and care: 30
(Another 750 didn't fit a neat category: everything from sports clubs to manufacturers.)
Pharmacies. Independent financial advisers. Care providers. Schools. Businesses whose customers reasonably assume the website is looked after.
Why it matters (an honest version)
We'll be straight with you: if your site is a simple brochure with no forms, no logins and no customer data, an unpatched front-end framework is unlikely to get you hacked tomorrow. The documented AngularJS flaws are mostly denial-of-service and content-spoofing issues, not one-click takeovers. Anyone who tells you otherwise is selling fear.
The real problem is what an end-of-life framework tells you about the whole site:
- The stack froze with it. A site on 2016 Angular usually means 2016 everything: old jQuery, old build tools, old server software. The known-vulnerability count across all of it grows every year.
- Nobody can safely change it. Developers who work on AngularJS are retiring the skill. Every year the fix gets more expensive and the list of people willing to do it gets shorter.
- Browsers move on underneath it. These sites break silently, one browser update at a time. Usually the owner finds out from a customer.
- Questionnaires now ask. Cyber insurance forms and supplier due-diligence checks increasingly ask whether you run unsupported software. "Yes" has a price.
We wrote more about the security side of stale dependencies in why website updates are a security issue.
If this might be your website
You don't need to know what Angular is to find out where you stand. Ask whoever built or hosts your site two questions: what framework and version is it on, and is that version still in support? A good developer answers in one email.
Or ask us. Send your web address and we'll reply with the version, its support status and what (if anything) it means for you. Free, no obligation, and we won't add you to a mailing list.
If it does turn out to be end of life, you have four honest options:
- Accept it, knowingly. Legitimate for a pure brochure site with nothing to protect. The key word is knowingly.
- Pay for extended support. Commercial vendors will patch dead frameworks, priced for enterprises. Rarely sensible for a small business website.
- Upgrade. Modern Angular has a genuine version-to-version upgrade path. AngularJS to modern Angular, though, is a rebuild in all but name.
- Rebuild. For most small-business sites this costs less than an upgrade, and you get a faster, mobile-friendly site out of it. See our Angular upgrade and rescue service.
Methodology notes and caveats
So the limits of the data are clear:
- We counted .uk domains only. UK businesses on .com or other endings are not included, so treat every number here as a floor, not a ceiling.
- Fingerprint detection can miss heavily customised builds. Another reason it's a floor.
- 53 sites report AngularJS version 1.9, which only exists as a commercial extended-support fork. If those sites are paying for it, they are patched. Exclude all 53 and the end-of-life figure is still 88%.
- We performed no security testing on any site. Versions were read from public pages only.
- Data collected June and July 2026.
For journalists and researchers
We're happy to share aggregate breakdowns (sector, version, region) with journalists, researchers or industry bodies. We won't name individual businesses; the point is to get sites fixed, not to embarrass anyone. Get in touch.