TechDetect

TechDetect

Identify the technology stack behind any website — CMS, JavaScript frameworks, web servers, analytics, CDNs, ecommerce platforms, payment processors and more. Fingerprinting runs entirely server-side, so there's nothing to install and no browser extension required.

Target URL

How TechDetect works

A server-side fingerprinting pipeline — your browser only sends a URL; all detection logic stays on the server.

Server-side fetch

The target page is retrieved by the server (not your browser), which sidesteps the cross-origin restrictions that prevent in-browser tools from reading third-party sites. Private, loopback and reserved addresses are blocked to prevent SSRF.

Multi-signal fingerprinting

Each technology is matched on response headers, Set-Cookie names, raw HTML, <script src> URLs, <meta> tags, and CSS-selector (dom) rules evaluated against the parsed page — the server-side signal classes Wappalyzer uses, with version extraction where the signature allows. Signals that only exist after JavaScript runs (in-page js globals) require the optional render service.

Implied technologies

Detections cascade: spotting WooCommerce implies WordPress and PHP; Next.js implies React and Node.js. Implied entries are flagged so you can tell direct matches from inferred ones.

Security-header scorecard

The same response TechDetect fingerprints also carries the site's security headers. Each scan grades Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cross-origin policies into an A–F score, and flags software-version disclosure — no extra requests to the target.

Cookie & third-party audit

Every Set-Cookie is checked for the Secure, HttpOnly and SameSite flags, and the page's external hosts are inventoried and labelled (analytics, advertising, CDN, payments, chat) so you can see who a site talks to and what it may be leaking.

Hidden ruleset

The fingerprint database and matching engine never reach the browser — there is no detection logic in the page source to copy. The page only renders results returned as JSON.

JS-render aware

Single-page apps that render via JavaScript expose little in raw HTML. TechDetect flags likely JS-heavy pages, and can optionally route them through a headless renderer for deeper detection when that service is enabled.

Export

Every result set is exportable as JSON for reporting, asset inventories, or feeding into other tooling.

Responsible use: TechDetect performs a single passive GET request to a URL you supply, the same as a normal browser visit. Use it for security research, asset discovery, and competitive analysis of sites you own or are authorised to assess. Detection is best-effort and signature-based — absence of a technology is not proof it is not in use.

Frequently asked questions

How do I find out what technology a website is built with?

Enter the site's URL into TechDetect. It fetches the page server-side and fingerprints response headers, HTML, cookies, and linked scripts against a Wappalyzer-format ruleset to identify the CMS, JavaScript frameworks, web server, analytics, CDN, ecommerce platform, and more — often with version numbers and implied dependencies.

How is TechDetect different from a browser extension like Wappalyzer?

TechDetect runs entirely server-side, so there is nothing to install and the target site cannot see a browser extension. It uses a Wappalyzer-format ruleset with version detection and implied-tech cascades, and can optionally fetch linked JavaScript files to catch bundled libraries.

Does TechDetect check a site's security headers?

Yes. Alongside the technology list, TechDetect grades the target's response security headers (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cross-origin policies) into an A–F scorecard, audits every cookie for the Secure, HttpOnly and SameSite flags, flags software-version disclosure, and inventories the third-party hosts the page loads. All of this comes from the single page fetch — no extra requests to the target.

Is TechDetect free?

Yes, TechDetect is free with no account or API key required, and it does not store the URLs you scan. Results export to JSON, CSV or Markdown, and every scan produces a shareable link.