Hospitals spend heavily on clinical systems, but the public website is where most patients start. We wanted to know how current the technology behind those websites is. On October 31, 2026 we scanned the homepages of every US hospital listed in Wikidata with an official website: 1,921 domains. We could read 823 distinct websites. This report covers what we found on them.
Key findings
- 15.1% (124 of 823) load at least one component that has reached end of life.
- 14.4% (78 of 540) of sites with a readable jQuery version run a release older than 3.5, the version that fixed two cross-site scripting flaws in 2020.
- 69% (568 of 823) send no Content-Security-Policy header.
- 43.3% (356 of 823) send no Strict-Transport-Security (HSTS) header.
- Epic MyChart is linked or named on 285 homepages, more than every other patient portal vendor combined.
jQuery: most sites are current, a long tail is not
We could read the jQuery version on 540 of the 823 sites. Most run a supported release: 353 are on 3.7 and 43 have already moved to 4.0. But 78 sites (14.4%) run a version older than 3.5, and 58 (10.7%) are still on the 1.x or 2.x lines, which the jQuery team no longer maintains.
Which end-of-life components we found
A website counts as running an end-of-life component if its homepage loads any of the items below. One site can load several.
- jQuery older than 3.5: 78 sites. The security fix (CVE-2020-11022, CVE-2020-11023) was released in April 2020.
- Bootstrap 4 or older: 34 sites. Bootstrap 4 support ended on January 1, 2023, and Bootstrap 3 in July 2019.
- PHP older than 8.2: 16 sites. PHP 8.1 security support ended on December 31, 2025.
- Adobe Flash or Microsoft Silverlight embeds: 7 sites. Flash ended in December 2020 and Silverlight in October 2021.
- Drupal 7 or older: 6 sites. Drupal 7 support ended on January 5, 2025.
- AngularJS (1.x): 3 sites. Support ended on December 31, 2021.
- IIS older than version 10: 1 site, which points to Windows Server 2012 R2 or older.
Bootstrap versions were readable on only 51 sites, too few for a reliable rate, so treat that row as a count. Another 38 websites (4.6%) run on ASP.NET Web Forms or SharePoint. Neither is end-of-life, but Microsoft has stopped developing both, and they are among the most common starting points for a modernization project.
Security headers are the bigger gap
Old libraries were less common than missing basic protections. 69% of homepages send no Content-Security-Policy, the header that limits which scripts a page may run. 43.3% send no HSTS header, which tells browsers to always use HTTPS. 82 sites (10%) announce their exact server or framework version in response headers, and 47 (5.7%) do not redirect plain HTTP visitors to HTTPS.
Platforms: custom-built sites carry the most legacy
WordPress runs 342 of the 823 readable sites (41.6%), ahead of custom-built or unidentified platforms (206) and Drupal (139). Custom and unidentified sites had the highest end-of-life rate at 20.9%, followed by Sitecore (17.7%), WordPress (13.7%) and Drupal (10.8%). We report rates only for platforms with at least 15 sites.
Patient portals: MyChart dominates
285 homepages (34.6%) link to or mention Epic MyChart. Oracle Health (Cerner) appears on 22, athenahealth on 12, FollowMyHealth on 10 and eClinicalWorks or healow on 9. We found no portal link on 485 homepages. Many of those hospitals do offer a portal, but place the link deeper in the site or load it with JavaScript.
What this means for hospital IT teams
An outdated library on a marketing homepage is rarely an emergency. It is a signal: the content platform, theme or build pipeline behind it has not been touched in years, and the same is often true of the integrations and internal systems nobody sees.
Most fixes in this report are small in isolation. HSTS is a one-line server setting. A Content Security Policy takes more care to get right. A jQuery upgrade usually comes down to testing the scripts that depend on it. The expensive part is a platform that makes even those changes hard. If that platform is yours, our legacy software modernization team starts with a three-day assessment of one application.
How we ran the scan
The source list is every US hospital in Wikidata that has an official website and no recorded closure date, queried on October 31, 2026. We scanned each unique domain once that day, from a single machine, with a crawler that identified itself and linked to our contact page.
- We read robots.txt first and skipped any site that asked crawlers to stay out.
- We then made one request for the homepage and one HEAD request to check the HTTP to HTTPS redirect.
- When a homepage loaded jQuery without a version in the file name, we read the first 800 bytes of that file, where jQuery prints its version.
- We did not probe paths, submit forms, test for vulnerabilities or try to get past bot protection.
- We publish totals only and do not name any hospital.
From 1,921 listed domains, 472 blocked automated requests, 342 could not be reached (142 of those domains no longer exist), 13 asked crawlers to stay out, 138 had no readable homepage, 1 was a parked domain for sale, and 132 redirected to a website we had already counted. That leaves 823 websites.
Limitations
- We read the homepage only. Older code on inner pages, or code added later by JavaScript, is not counted, so the real rates are likely higher.
- Sites that blocked us are often large health systems behind commercial bot protection. Their absence may skew the sample toward smaller hospitals.
- Wikidata is volunteer-maintained and does not list every US hospital.
- The presence of an old component does not prove a site is exploitable. We did not test that, and would not.
- Copyright years in page footers are too often filled in automatically to show how long a site has gone unchanged, so we draw no conclusion from them.
Download the data
The dataset has one row per website: platform, library versions, security headers and portal links. Hospital names and domains are removed and states are grouped into US Census regions. It is free to reuse under CC BY 4.0.
Cite as: Woltrio, "US Hospital Website Legacy Technology Scan (2026)," October 31, 2026, https://www.woltrio.com/insights/hospital-website-legacy-technology-2026
