↑↓ to move · Enter to open · Esc to close

Website Technology Detector

This website technology detector reads a public page and reports matching CMS, framework, library and analytics clues. Each match includes the signal that led to it.

This check runs on our server. The address you enter is used only for this check and is not stored.
Built and reviewed by · Updated

One page, up to 5 MB of HTML. Scripts do not run.

Tick the box to show you are not a robot, then press Detect technologies.

How to use the Website Technology Detector

  1. Enter the URL of a public page.
  2. Complete the robot check and press Detect technologies.
  3. Review the technologies by group, their evidence and any exposed version. A missing match does not prove that a technology is absent.

How technology detection works

The checker fetches one HTML page from our server. It compares response headers, cookie names, generator metadata, script and stylesheet addresses, and HTML markers with 150 original Utilza fingerprints. It does not query a paid technology database or call a technology-detection API.

Each result names the matching signal, such as a generator tag, a library filename or a server banner. A version appears only when a rule captures one from that signal. Assets bundled under a custom filename may have no recognizable marker. HTML pattern matching reads the first 1 MB; metadata and asset addresses are collected from the full HTML response, up to the 5 MB input limit.

Examples of technology clues

  • A generator tag containing WordPress 6.8.1 can produce a WordPress match with that exposed version. A wp-content asset directory can produce the match without a version.
  • A script URL ending in jquery-3.7.1.min.js can identify jQuery and its version.
  • A Cloudflare response marker can identify the edge service. It does not reveal the origin server behind it.

Why detection is evidence rather than proof

A public page exposes only part of a site. A copied asset path, an outdated generator tag or a server banner can be misleading. A library may be referenced but never used. Conversely, bundling, renamed files, an edge cache or removal of version headers can hide software that is active.

Use the result to guide a closer inspection or a migration inventory. Do not treat an exposed version as a vulnerability verdict. The checker does not compare versions with a vulnerability database and cannot infer database software, private APIs or the complete backend stack from one response.

What the request does

No JavaScript is executed, and discovered scripts and stylesheets are not downloaded. Cookie values are not included in the result; only names are used as signals. The page address and results are not stored. To inspect response headers yourself, open HTTP Headers. The API Response Viewer can show the HTML source returned by a server.

Limitations

  • One public page, a 5 MB response limit and a 15-second request timeout.
  • Services loaded only after JavaScript, consent or login may be missed.
  • The fingerprint list is finite. Unknown or unmarked technologies return no match.
  • CDNs and reverse proxies can hide the origin stack. Matches can be false positives, so inspect their evidence.

Frequently asked questions

How can I find what CMS a website uses?

Enter a public page URL and inspect the CMS matches. Generator metadata and recognizable asset paths can identify a CMS, but custom themes and hidden markers can prevent detection.

Why is the version shown as Not exposed?

The matched signal identifies a technology without a version string that its fingerprint can capture. The checker does not guess a release number.

Does this run Wappalyzer or BuiltWith?

No. It uses an original local set of 150 fingerprints and makes no request to those services.

Does a detected old version prove the website is vulnerable?

No. A public marker may be stale or misleading, and the checker does not query vulnerability databases or test security flaws.

Often used together with Website Technology Detector.

  • HTTP HeadersNetwork Tools

    Status, final URL, and response headers from one GET.

  • API Response ViewerDeveloper Tools

    GET any public API endpoint and read its JSON as a tree, with status, time, and headers.

  • Website Headers Analyzer

    Grades security headers, caching, compression, version exposure and cookie attributes using a published advisory rubric.