Website Technology Detector
See what a site is built with, and what it gives away.
Technology fingerprinting works because software announces itself. A Server header names the web server, X-Powered-By names the runtime, a generator meta tag names the CMS, cookie names give away the framework, and asset paths give away the build tool. None of it is hidden; all of it is in the response every visitor receives.
The security angle is version disclosure rather than product disclosure. Knowing a site runs nginx is close to useless to an attacker. Knowing it runs nginx 1.18.0 turns reconnaissance into a lookup: the published vulnerability list for that exact version, filtered to the ones with public exploits. Removing the version from your headers costs nothing and removes that shortcut.
Treat any result here as inference. A signature matching means a pattern was found, not that the technology is definitely in use — a page can mention a library it does not load, a CDN can add headers the origin never sent, and a reverse proxy can rewrite Server entirely. That is why each detection carries its evidence.
What this tool does
Servers, CDNs and frameworks
Detected from response headers, page source and cookie names — the same signals any fingerprinting tool uses.
Evidence, not assertions
Every detection shows what was actually observed, so you can judge it. Fingerprinting is inference and sometimes wrong.
Version disclosure flagged
A precise version in a Server or X-Powered-By header hands an attacker your applicable CVE list for free. Both are called out.
Run it on your own site
The useful question is not what someone else uses — it is what your site is telling everyone without needing to.
Frequently asked questions
How does technology detection work?
By matching known patterns in the HTTP response: header names and values, HTML in the page source, script and asset paths, and cookie names. Each pattern is a signature for a particular product. It is pattern matching on public data, not any kind of probing or scanning.
Is it always accurate?
No, and it cannot be. A page might reference a library it does not use, a CDN can add or rewrite headers so the origin server's identity is hidden, and many products can be configured to reveal nothing. Detections are evidence-based inferences, which is why the evidence is shown alongside each one.
Should I hide what my site is built with?
Hiding the product is close to pointless — an attacker can fingerprint from behaviour anyway. Hiding the exact version is worth doing, because that is what turns a guess into a targeted lookup of known vulnerabilities. Remove X-Powered-By and configure your server to report a product name without a version.
How do I remove version numbers from my headers?
On nginx, set server_tokens off. On Apache, set ServerTokens Prod and ServerSignature Off. On Express, call app.disable("x-powered-by"). In PHP, set expose_php = Off. Each removes a version string that serves no functional purpose.
Why does it detect a CDN instead of my actual server?
Because a CDN or reverse proxy terminates the connection and answers with its own headers. That is working as intended — your origin should not be directly identifiable — and it means the detection describes the edge, not what is running behind it.
Does this scan the site?
No. It makes one ordinary GET request, exactly as a browser would, and inspects the response. It does not probe paths, guess URLs, send unusual input, or do anything a normal visitor does not.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.