Website Technology Checker

A website technology checker shows what a site is built with. Enter any address and this tool reads the page's response headers, its HTML and the scripts and stylesheets it loads, along with the domain's DNS records, and names the CMS or website builder, the ecommerce platform, JavaScript frameworks and libraries, analytics and tag managers, chat and marketing tools, CDN and caching layers, web server and backend language. From DNS and the IP address registry it adds the DNS host, the network hosting the site and the email provider. Every detection comes with the evidence that gave it away, such as a /wp-content/ path or a cf-ray header, and a version number where the site shows one, so you can judge the result yourself rather than trust a guess.

How to use the Technology checker

1. 1 Enter the website addressPaste the home page or any page. Different sections of a site can use different tools, so check the page you care about.
2. 2 Run the checkWe fetch the page through our safety checks, collect the URLs of every script, stylesheet and embed, and look up the domain's nameservers, IP address and MX records.
3. 3 Read the platform and infrastructureThe top of the result shows the platform, the DNS host, the hosting network and the email provider.
4. 4 Review each categoryDetected technologies are grouped by category with their version, where shown, and the exact trace that identified them.
5. 5 Act on the flagsFix any software versions exposed in headers and update outdated jQuery, then run the check again.

Why find out what a website is built with

Knowing the technology behind a site answers practical questions. A business owner comparing agencies can see what their own site actually runs on before a meeting. A marketer can check which analytics, tag manager and chat tools a competitor uses. A developer quoting for a redesign can tell whether the site is WordPress with Elementor, a Shopify store or a hand-built Next.js app, which changes the scope of the work entirely. A salesperson for a plugin or hosting company can qualify leads by platform.

It is also useful for your own site. Sites built over several years collect forgotten scripts: an old chat widget, two analytics tags, a library loaded from a CDN that nobody remembers adding. Each one costs page speed and may send visitor data to another company. Running a technology check on your own pages gives you an inventory to review, and the version flags point to software that needs updating.

How technology detection works

Every platform leaves fingerprints. WordPress serves themes and plugins from /wp-content/ and its own files from /wp-includes/. Shopify loads assets from cdn.shopify.com. Wix serves images from static.wixstatic.com. Webflow adds data-wf-page attributes to the HTML. Many systems also announce themselves in a meta generator tag, and servers and CDNs add their own response headers, such as Server: nginx, cf-ray for Cloudflare or x-vercel-id for Vercel.

This checker matches more than a hundred of these fingerprints. To keep false positives down, it looks for them in specific places: script and stylesheet URLs, particular response headers and the generator tag, rather than counting a site as WordPress just because the word appears in a blog post. Where a fingerprint includes a version, as in jquery-3.7.1.min.js, ?ver=6.6.2 on a WordPress asset or PHP/8.1 in a header, the version is shown next to the name.

Infrastructure comes from DNS rather than the page. The nameservers usually reveal the DNS host, for example Cloudflare, Amazon Route 53 or GoDaddy. The website's IP address is looked up in the regional internet registry to find the organisation that holds that network, which is typically the hosting company or cloud provider. The MX records show who handles email, such as Google Workspace or Microsoft 365.

What it can and cannot see

The checker reads the HTML the server sends, the way most crawlers do. Tools that are injected later by JavaScript, for example a tag manager that loads analytics only after consent, may not appear. Single-page apps that render everything in the browser show only their framework, not the services they call. Pages behind a login are not checked at all.

Some sites deliberately hide their stack. A CDN or reverse proxy replaces the server header with its own, so a site behind Cloudflare usually shows Cloudflare rather than the origin server. Security plugins can remove generator tags and rename asset folders. Headless setups, where a CMS feeds content to a separate front end, show the front end's framework rather than the CMS. In these cases the checker reports what it can see and says when the platform could not be identified, rather than guessing.

The hosting network is the owner of the IP address block, which is not always the company you pay. A site on a managed WordPress host may show the cloud provider underneath, and a site behind a CDN shows the CDN's network instead of the real host.

• Seen: asset paths, response headers, meta generator tags, HTML attributes, DNS and registry data.
• Not seen: scripts added later by JavaScript, content behind a login, the origin server behind a CDN.
• Approximate: hosting network, which shows who owns the IP range rather than who sold the hosting plan.

Security flags: exposed versions and outdated jQuery

Version numbers in headers such as X-Powered-By: PHP/7.4.33 or Server: Apache/2.4.41 tell anyone which exact software a server runs. That does not make the site vulnerable by itself, but it lets attackers match it to known issues without any effort. Hiding versions is a quick win: set expose_php = Off in php.ini, ServerTokens Prod in Apache, or server_tokens off in Nginx. Many hosting control panels have the same settings.

A WordPress generator tag with a version number does the same for the CMS. The real fix is to keep WordPress, themes and plugins updated; removing the tag is a small extra that a security plugin or one line in your theme can do.

jQuery is still loaded on a very large number of sites. Versions before 3.5.0 have known cross-site scripting issues, published as CVE-2020-11022 and CVE-2020-11023, so the checker flags them. Updating jQuery can break old plugins or scripts, so test on a staging copy first. On WordPress, keeping core updated brings a current jQuery; themes that load their own old copy need updating or replacing.

Using the results for competitor research

Check three or four competitors and compare. If they all use the same booking widget, review platform or chat tool, that is a hint about what customers in your market expect. If a competitor's pages load several analytics and advertising pixels, they are probably running paid campaigns. A competitor on a website builder may have less room for technical SEO than one on a flexible CMS.

Treat it as a starting point, not proof. A tool present on the home page might not be used elsewhere, and a missing detection does not mean a company does not use something, only that it was not visible in that page's HTML. Combine it with our other checks: the HTTP Headers Checker for caching and compression, the Security Headers Checker for security policies, and a full website audit for SEO, speed and accessibility.

Finding a site's DNS, hosting and email provider

People often want to know where a website is hosted to migrate it, report abuse or contact the provider. The DNS host, shown first, is where the domain's records are managed; changing nameservers moves control of DNS. The hosting network is where the website answers from. The email provider is where mail for the domain is delivered, which can be completely separate from the website.

For more detail, use the DNS Lookup to see every record, the MX Lookup for the full list of mail servers, the WHOIS Lookup for the registrar and expiry date, and What Is My IP to look up any IP address in the registries.

Examples you can copy

WordPress    /wp-content/themes/...   /wp-includes/js/...   <meta name="generator" content="WordPress 6.6">
Shopify      https://cdn.shopify.com/s/files/...
Wix          https://static.wixstatic.com/media/...
Squarespace  https://static1.squarespace.com/static/...
Webflow      <html data-wf-page="..." data-wf-site="...">
Next.js      <script id="__NEXT_DATA__">   /_next/static/...

; php.ini
expose_php = Off

# Apache (httpd.conf)
ServerTokens Prod
ServerSignature Off

# Nginx (http block)
server_tokens off;

remove_action('wp_head', 'wp_generator');

Common mistakes to avoid

Frequently asked questions