How do I find out what technology a website uses without any tools?

Right-click any web page and select View Page Source. Look for the generator meta tag near the top of the HTML for CMS identification. Look at script src attributes for JavaScript framework names. Look at CSS href paths for platform-specific CDN domains like cdn.shopify.com or wp-content/themes/.

What is the easiest way to identify website technology?

Paste the URL into a tech stack checker. The checker reads HTTP headers, parses HTML source, and checks DNS records in a single pass, returning a complete stack profile in under three seconds. This is faster and more complete than manual source inspection.

Can I identify website technology on a JavaScript-heavy single-page application?

Partially. The initial HTML of a JavaScript-rendered SPA may contain few signals, but the script src attributes will include the framework name (React, Vue, Angular, Svelte) and often the build tool. HTTP headers and DNS records are unaffected by whether the front-end is a traditional page or an SPA.

How do I know if a website is using Cloudflare?

Cloudflare adds a Cf-Ray header to HTTP responses from sites proxied through their network. This header format is distinctive and present on virtually all Cloudflare-proxied sites. The DNS NS records will also point to Cloudflare nameservers (ns1.cloudflare.com) if Cloudflare is handling DNS.

Can I tell which version of a framework a website is using?

Sometimes. Many frameworks and libraries include their version number in the filename of their minified bundle (react.16.14.0.min.js) or in a meta tag. If version numbers have been removed from filenames and no generator meta tag is present, version detection requires other techniques like checking code signatures.

Is checking a website's technology stack legal?

Yes. Reading publicly available HTTP responses from a public URL is standard browser and search engine behavior. Technology detection reads signals that web servers expose as part of their normal operation and does not bypass any access controls.

What does the X-Powered-By HTTP header tell you?

X-Powered-By typically identifies the server-side technology: PHP/8.1, ASP.NET, Express (Node.js), or a hosting-specific value. It is often suppressed on security-hardened servers since exposing the exact language and version is considered a minor security risk.

How accurate is technology detection for sites that have been security-hardened?

Hardening reduces some signals but rarely eliminates all of them. A site that removes the Server header, suppresses X-Powered-By, and randomizes asset versioning will still expose front-end framework signals in its HTML source and hosting signals in its DNS records.

Can I detect which analytics platform a website uses?

Yes. Google Analytics, Plausible, Fathom, Matomo, and other analytics platforms load scripts from their own domains. The script src URLs in the page HTML identify which analytics platform is in use.

What is the difference between detecting a website's hosting provider and its CDN?

The hosting provider is where the web server and application code run (AWS EC2, DigitalOcean, WP Engine). The CDN is a distribution layer that caches and serves assets closer to the user (Cloudflare, Fastly, Akamai). A site can use both, and they may be different providers.

Does website technology change over time?

Yes. Sites rebuild, update their CMS, change CDN providers, and add or remove front-end frameworks regularly. A tech stack scan reflects the technology in use at the time of the scan. Running periodic scans on competitor sites tracks changes over time.

Can a tech stack checker detect if a site is running on a serverless platform like Vercel or Netlify?

Yes. Vercel adds X-Vercel-Id headers to responses. Netlify sites have distinctive URL patterns and headers. Cloudflare Workers sites can be identified through Workers-specific headers. All three are reliably detectable from standard HTTP response signals.

How to Identify Website Technology

Three passive detection methods — HTTP headers, HTML source, and DNS — and what each one reveals about any website's technology stack

Every website exposes technology signals through its HTTP responses, HTML source code, and DNS records. None of these signals require login credentials, special access, or exploitation — they are the standard outputs of a public web server responding to a standard browser request. This page explains each method, what it reveals, and how to use them together for a complete technology profile.

Method 1 — HTTP Response Header Analysis

HTTP headers are included with every response a web server sends. They are visible to any HTTP client — a browser, a command-line tool like curl, or a tech stack checker. The Server header identifies the underlying web server software: common values are nginx, Apache, LiteSpeed, and Microsoft-IIS. X-Powered-By identifies the server-side language or framework: PHP/8.1, ASP.NET, and Express are common values. X-Cache and CDN-specific headers (Cf-Ray for Cloudflare, X-Served-By for Fastly, X-Cache for Varnish) identify the CDN or caching layer.

Managed hosting providers often set proprietary headers that directly identify their platform: X-WP-Engine for WP Engine, X-Kinsta-Cache for Kinsta, X-Powered-By: Heroku for Heroku-hosted applications. These headers provide reliable hosting identification without any ambiguity. A web server that has been security-hardened may suppress or randomize some headers, but most servers expose the Server header at minimum.

Method 2 — HTML Source Inspection

The HTML source of a web page contains multiple technology signals. The generator meta tag (meta name='generator' content='WordPress 6.4.2') directly states the CMS and version. Script src attributes identify JavaScript frameworks and libraries — React applications include react.production.min.js or next.js in their script sources; Vue applications include vue.min.js. CSS class naming conventions identify front-end frameworks and page builders — Bootstrap uses col-md- and container-fluid; Tailwind uses utility class strings; Elementor uses elementor- prefixes throughout.

Asset URL structure is another signal source. WordPress assets load from wp-content/themes/ and wp-content/plugins/. Shopify assets load from cdn.shopify.com. Webflow assets load from uploads-ssl.webflow.com. These URL patterns are structural to each platform and appear reliably in any page using assets.

Method 3 — DNS Record Analysis

DNS records reveal the infrastructure layer beneath the web server. The A record (IPv4 address) or AAAA record (IPv6) identifies the hosting IP, which can be matched against known IP ranges for major cloud providers (AWS, Google Cloud, Azure, DigitalOcean). The CNAME record may point directly to a hosting provider's domain (sites.netlify.com, username.github.io, pages.cloudflare.com). MX records identify the email service provider (Google Workspace, Microsoft 365, Fastmail). NS records identify the DNS provider and may reveal if Cloudflare is handling DNS (indicating CDN usage).

DNS analysis is the most stable detection method — DNS records change less frequently than HTML source code or server software. It is also the method that reveals infrastructure that HTTP headers and HTML source might not expose, particularly the email provider and the cloud hosting provider.

Combining All Three Methods for a Complete Stack Profile

A complete technology identification uses all three methods together. HTTP headers establish the server software, CDN, and hosting layer. HTML source reveals the CMS, front-end framework, JavaScript libraries, and page builder. DNS records confirm the hosting provider and reveal the email infrastructure. The three methods are complementary, not redundant — each exposes parts of the stack that the others do not.

Three Detection Methods — What Each One Reveals

Use all three together for the most complete stack profile. Each method reveals signals the others cannot.

Method	What It Reveals	Speed	Limitations
HTTP Response Headers	Web server, CDN provider, server-side language, managed hosting identity	Instant — part of every HTTP response	Security-hardened servers may suppress headers; does not reveal front-end technology
HTML Source Inspection	CMS, front-end framework, JavaScript libraries, page builder, asset URL patterns	Fast — reads page HTML	Requires loading a page; JavaScript-rendered apps may not expose signals in initial HTML
DNS Record Analysis	Hosting IP range, email provider, CDN routing, DNS provider	Fast — DNS lookup is lightweight	IP-to-provider mapping requires an updated IP range database; does not reveal CMS or front-end tech

Sources & Further Reading