The tech stack of 30 top ecommerce companies.

17 of 30 sites front their storefront with Cloudflare. 10 of 30 still run Akamai. 6 of 30 use an AWS CDN. The split is not random and it is not about company size.

The Cloudflare cohort is almost entirely Shopify-tier DTC: Allbirds, Glossier, Gymshark, Casper, Brooklinen, Away, MVMT, UNTUCKit, Fashion Nova, Dollar Shave Club. These brands sit on Shopify, which already does its own edge work, and Cloudflare is fronting the apex domain mostly for marketing pages, DNS, and basic protection. The choice is not architectural - it is the path of least resistance for a small team.

The Akamai cohort is older, larger, and harder to move. Sephora, Ulta, Target, Walmart, Costco, Mr Porter, eBay, Bonobos, and Patagonia all sit on Akamai contracts that predate Cloudflare being a serious enterprise option. Replacing Akamai at a national retailer means rewriting bot management, replatforming origin shields, and re-validating PCI scope. Three of those things are scary on their own. Doing them together is uneconomic.

The signal: where the CDN sits is a near-perfect predictor of when the company was founded and how its commerce stack was assembled. Cloudflare is what you pick if you started on Shopify after 2018. Akamai is what you keep if you were on a national- retailer scale before then.

18 of 30 ecommerce sites run a detectable bot-management vendor. That is roughly twice the rate observed in the unicorn-SaaS cohort, and the gap is not surprising. Inventory-hoarding bots, sneaker-style drop attacks, credit-card stuffing on the checkout, and competitive price scraping are continuous problems for ecommerce in a way they are not for SaaS marketing pages.

Every big-box retailer in the cohort runs Akamai Bot Manager because that is what shipped with their Akamai contract and because their fraud-engineering teams have tuned it across a decade of incidents. Cloudflare Bot Management shows up on the marketplace and on-demand side: Instacart, DoorDash, Rappi. The DTC Shopify cohort shows almost no visible bot defense because Shopify edge is doing it at a layer the scanner cannot see.

The signal: if you cannot detect bot management on an ecommerce site, it is either because the platform vendor is hiding it from the edge or because the brand is small enough that bot pressure has not yet hit. There is no third option at storefront scale.

Three patterns repeat across the 30 storefronts. First, the commerce platform decision is functionally over for DTC. Shopify Plus is the default for any consumer brand under roughly $500M GMV that does not have a hardware, logistics, or subscription dependency that the platform cannot model. The exceptions are not opinion calls. They are operational requirements.

Second, the enterprise retail stack has split along team lines. Adobe Experience Manager owns content because brand and legal sit on the content side. Salesforce Commerce Cloud or homegrown AWS owns checkout because revenue and fraud sit on the checkout side. The two vendors coexist inside the same retailer because they serve different teams with different budgets.

Third, the CDN choice is sticky in a way the CMS choice is not. A retailer can swap CMS in 18 months. Swapping CDN means rewriting bot rules, edge cache, origin shields, and PCI scope at the same time. That is why Akamai still owns big-box retail almost two decades after Cloudflare existed.

The website tells you which stack a brand picked. Hiring tells you which one they are about to replace. JobsPipe surfaces the platform, infrastructure, and team-side adoption signals that scanner-only data cannot reach.