Birmingham, 15 October 2026. CodeFirst has published the first monthly results of its survey of UK public-sector websites: the home page of every UK council, NHS trust in England and UK university, checked for software that no longer receives security fixes. The figures below are from the run on 3 October 2026; the latest figures are on the report page, updated on the first of each month.
Headline findings
Nearly one in ten reveal something out of support. Of the 816 organisations listed, 739 home pages were reached. 70 of them, 9.5%, named at least one component whose vendor has stopped issuing security fixes, and a further 4 named something whose support ends within a year. 361 pages, 48.8%, named nothing with a vendor support date, so the figures are a floor.
Universities come out worst. 24 of the 215 university websites reached, 11.2%, revealed out-of-support software, against 35 of 361 councils, 9.7%, and 11 of 163 NHS trusts, 6.7%.
Old front-end libraries are the most common finding. jQuery 1.x, which the jQuery project no longer supports, was on 37 sites and jQuery 2.x on a further 11. Bootstrap 4, whose support ended on 1 January 2023, was on 10 sites and Bootstrap 3, unsupported since 24 July 2019, on 9. AngularJS 1.x, unsupported since 31 December 2021, was on 5; PHP 7.4, whose security fixes ended on 28 November 2022, on 4; and Drupal 7, which reached end of life on 5 January 2025, on 2.
Councils by nation
28 of the 297 English council websites reached revealed out-of-support software, 9.4%; 3 of 31 in Scotland, 9.7%; 3 of 22 in Wales, 13.6%; and 1 of 11 in Northern Ireland, 9.1%. jQuery 1.x was the most common out-of-support component in all four nations. The three smaller nations rest on small numbers: one site moves them by several points.
What it means for an IT manager
A public home page is only the visible edge of an organisation’s software. The survey reads what each page is set to reveal and nothing behind it: not the systems behind a login, the databases, or the internal applications that usually matter more. When a library is years out of support on the public site, the same version is often under the line-of-business systems behind it.
The order of work is the same whatever the survey finds: an inventory of what is actually running; then whatever has already lost its security fixes, starting with anything reachable from the internet; then whatever loses support within a year, planned to finish before the date.
How the survey was done
On 3 October 2026 a script fetched the home page of each of the 816 organisations once, following redirects as a browser would, without logging in. It read the headers and HTML of that page for the things that name their software: the server and framework headers, the generator meta tag, the addresses of scripts and stylesheets, and ASP.NET view state. Nothing else was requested and no vulnerability testing was done.
The organisations come from public registers: every current UK local authority with a page on GOV.UK’s “find your local council” service, every active NHS trust in England listed by the NHS Organisation Data Service, and every UK university with a website recorded on Wikidata. Each component found was matched to the vendor’s dates in CodeFirst’s end-of-support tables. jQuery 1.x and 2.x count as out of support because the jQuery project no longer supports them, although it has published no date.
No organisation is named: only totals are published, and the per-site results are deleted after ninety days. The same code runs the free check for any site, so anyone responsible for a website can see what the survey would report for it.
Comment
Graham Church, founder of CodeFirst, said: “A home page that still loads a library its maintainers stopped supporting years ago is a small thing in itself, but it is a fair prompt to ask what else has been left as it was. The useful response is an inventory rather than alarm: find out what is actually running, and deal first with whatever has already lost its security fixes.”