Technology/CMS detector

How to use it

1. 1Enter the address you want to checkType or paste it into the field marked "Address to check", including the https:// at the front. Any page on the site. A homepage usually carries the most signatures.
2. 2Press Check and wait a few secondsThe request runs from our server rather than from your browser, so your cache, your extensions and your login session cannot affect the answer. That is the point of it: you are seeing what an anonymous visitor sees.
3. 3Read each detection with its evidenceEvery technology named comes with the signature that identified it — a header, a path, a meta tag, a script. You can verify each one yourself, which matters because a wrong guess about somebody's stack is worse than no guess.
4. 4Treat silence as silenceWhen nothing matches, the tool says nothing matched. There are deliberately no confidence percentages anywhere in this result — a number attached to a guess makes the guess look like a measurement.
5. 5Check the version numbers with suspicionA version is reported only when a signature actually contains one. Many sites strip or fake them, and a stripped version is not an old version.
6. 6Share or keep the result within 24 hoursThe result has its own link you can send to whoever needs to act on it. It is deleted 24 hours after the check ran, so save anything you need to keep — and re-run the check after a change rather than trusting an old link.

About this tool

Sites reveal what they are built with in dozens of small ways: a wordpress_ cookie, asset paths under /wp-content/, a __NEXT_DATA__ payload, a CF-Ray header from Cloudflare, a generator meta tag that plainly says so. This tool reads one response — headers, cookies and markup — against a table of those signatures and reports what it can prove.

The rule is evidence-or-silence. Every detection quotes the exact header, cookie, tag or path that matched, so you can open your own page source and see the same thing. There are no confidence percentages: a quoted signature is verifiable, a percentage is theatre.

Understanding the result

Detections are grouped — CMS, e-commerce, frameworks, frontend, analytics, infrastructure, libraries — and each entry expands to show its proofs. One technology found three ways is one entry with three proofs.

A version appears only when the page itself disclosed one (a generator tag, a header, a versioned asset path). Versions are read, never inferred.

The "worth removing" section lists version disclosures: a Server or X-Powered-By header advertising an exact version hands an attacker the CVE list to try first, and suppressing it costs nothing.

An empty result means no signature matched — common behind CDNs and on hardened sites — and is reported as exactly that, never as "this site uses nothing".

Example

https://example.com/

CMS: WordPress v6.5.2 — 3 proofs (generator tag, wordpress_ cookie, /wp-content/ paths)
Infrastructure: Cloudflare (cf-ray header) · Analytics: GA4 (gtag.js)
Worth removing: X-Powered-By: PHP/8.1.2 — exact version disclosed.

Limitations

• One response is read, without executing the page. Scripts injected by a tag manager after load are invisible here.
• The signature table is finite and versioned; a stack it does not know produces silence, not a guess. The table version is stamped into every result.
• A site that deliberately strips its fingerprints is invisible by design — theirs and ours.
• Requests to private and internal addresses are refused by design.

Questions