Type a URL to start.
Privacy: the URL is sent to our function on Cloudflare, which reads headers and <head> and stores nothing. The domain’s IP is looked up by your browser against Cloudflare DNS and Team Cymru.
Where it is hosted
If a CDN sits in front (Cloudflare, Fastly, Akamai…), this IP belongs to the CDN and the real server stays hidden behind it. That is normal and intentional.
What this tool cannot see
Only the server’s initial response is read: the headers and the document <head>. Anything a site loads afterwards with JavaScript — pixels injected by a tag manager, a chat widget, an embedded booking system — stays out of view. If something you know is there is missing, it almost certainly arrives that way.
No technology was recognised in the headers or the <head>. The site may hide them on purpose, load everything with JavaScript, or use something that is not in our signature list.
How to use it
01
Type the URL
The home page or any inner page. Our function reads it once and returns headers and <head>.
02
Look at the clues
Each technology comes with the evidence that gives it away, so you can check it yourself in the source.
03
Understand the hosting
The IP and the autonomous system tell you which provider the site lives on, or which CDN hides it.
The clues that give the most away
- wp-content
- The WordPress themes and plugins folder. It shows up in almost every image and script URL.
- cdn.shopify.com
- Every asset of a Shopify store comes from there, even on a custom domain.
- meta generator
- A tag many systems add by themselves with their name. The most honest clue, and the first one removed.
- server
- The header the server introduces itself with: nginx, Apache, cloudflare… Many hide it.
- x-powered-by
- Server-side language or framework: PHP, ASP.NET, Express, Next.js. Good practice is not to send it.
- cf-ray
- The identifier Cloudflare adds to every request that goes through its network.
Knowing what it is built with is half the diagnosis
A 2015 WordPress on shared hosting, with twelve plugins and a visual builder, behaves in a very specific way: it is slow, it falls over under traffic and every update breaks something. A Shopify with a custom theme has different problems. Recognising the stack is the first thing we do when someone asks for help with an inherited site.
What comes next is deciding what is worth keeping and what has to be migrated without losing rankings. That is what our modernisation work is about.
Frequently asked questions
Why does it miss something I know the site uses?
Because we only read the server’s initial response: the headers and the document <head>. Whatever a site loads afterwards with JavaScript — a pixel injected by Google Tag Manager, a chat widget, a map — is not in that first HTML, so we cannot see it. Nor do we see what the site hides on purpose: removing the generator tag and the server header is common practice.
Is it legal to analyse someone else’s website?
Yes. The tool makes a single public request, the same one your browser makes when opening the page, and reads what the server returns to anyone. It does not enter private areas, test passwords or look for vulnerabilities. It is information the site publishes.
Does it detect the WordPress or server version?
No, on purpose. The exact version is mostly useful for looking up known flaws of that version, and that is not what this page is for. To know whether a site is out of date, what matters is whether it is maintained, and that shows better in plugin status and post dates.
How do I know if a website is built with WordPress?
The three most reliable clues: paths containing /wp-content/ or /wp-includes/ in images and scripts, the <meta name="generator" content="WordPress"> tag in the <head>, and the existence of /wp-json/ on the domain. This tool looks for all three. A site can hide the first two; the third almost never.
What is an autonomous system (ASN)?
A block of IP addresses managed by one organisation: a hosting provider, a telecom carrier, a large company. Each one has a number. Knowing the ASN of a site’s IP tells you who gives it connectivity, which is almost always who hosts it: AS13335 is Cloudflare, AS16509 is Amazon, AS24940 is Hetzner.
Why does the IP say Cloudflare when the site is on another provider?
Because Cloudflare, and any other CDN, sits in front of the real server: the domain points to their IPs and they forward requests to the origin. That is exactly what a CDN is for, and it means the server’s real IP stays hidden. In that case the tool tells you the CDN, not the hosting behind it.
Is the URL I type stored?
No. The URL reaches our function on Cloudflare, which downloads the page, returns headers and <head> to your browser and logs nothing. The result is cached for ten minutes so the same page is not requested twice in a row. The domain’s IP and its autonomous system are looked up by your own browser against Cloudflare’s DNS resolver.
Background reading
Explained on the blog
Critical PHP and Node.js vulnerabilities: what happened and what to do
On October 21, PHP and Node.js shipped fixes for serious flaws that allow code to run on the server. What they mean in plain language, which versions fix them and what to do this week.
How to find out what a website is built with
The clues any site leaves about its CMS, its framework and its hosting, how far you can trust them, and why it helps to know before a redesign or a migration.
What is a vulnerability, and why does your website need maintenance?
What a software vulnerability is, why small websites are exposed too, what happens between the day a flaw is published and the day someone exploits it, and what keeping a site up to date actually involves.
Is your site one of those nobody dares to touch?
If every change is scary and every update breaks something, it is not your fault: it is the stack. We tell you what to keep, what to migrate and in which order, without losing what already ranks.
We reply within one business dayBogotá · UTC−5