See which web server, CDN, CMS, JavaScript framework, CSS library and analytics tags a public website appears to use, based on its HTTP headers and HTML.
Curious which platform a competitor's shop runs on, whether a site is behind a CDN, or which analytics tags a client's page loads? The detector fetches one page and reports the technologies it can recognise, grouped into Server, CDN, CMS, Framework, Library, CSS, Analytics and Other. Each result card shows the name, its category, a one-line description where one is available, and a High, Medium or Low confidence label. Developers, marketers doing competitive research and people auditing third-party scripts on their own site all find it useful as a first look.
example.com; https:// is added if you leave it out.The address is sent to /api/detect, a Cloudflare Pages Function on this site. It makes a single GET request to the page, follows up to three redirects (checking each new address), stops after 10 seconds, and reads at most the first 200 KB of HTML. It then runs a fixed list of about 45 pattern rules against two kinds of evidence:
server values such as nginx, Apache, LiteSpeed or IIS; x-powered-by for PHP, ASP.NET or Express; platform headers such as cf-ray (Cloudflare), x-vercel-id or x-nf-request-id (Netlify).wp-content (WordPress), /_next/ (Next.js) or /_nuxt/ (Nuxt), attributes such as ng-version (Angular) or data-v- hashes (Vue), script hosts such as googletagmanager.com, static.hotjar.com or js.stripe.com, and the page's generator meta tag.The confidence label is fixed per rule, not calculated per site. A unique header or a generator tag earns High; guesses based on class-name patterns, such as Tailwind utility classes, are marked Low. If the generator tag names something the rules do not know, it is listed under Other.
The page is read as raw HTML; no JavaScript runs. Tools that load later, inside bundled code or through a tag manager, will often be missed, so an empty or short list does not prove a technology is absent. Sites can also remove or fake headers, and a reverse proxy or CDN in front of a server usually hides what runs behind it. The rules do not check the HTTP status either, so if a site answers with a bot-challenge or error page, the results describe that page. The URL you enter goes to our function, which contacts the site from Cloudflare's network and does not store the address or the results; nothing is kept in your browser either.
Many sites behind Cloudflare or a similar service show automated visitors a challenge page instead of the real content. The detector then sees only the CDN's headers and the challenge HTML. Trying a different page on the site sometimes helps, but a protected site may simply not be scannable this way.
The rules only look for presence signals such as data-reactroot or a React script file name. Version numbers are rarely exposed consistently in production HTML, so the tool does not attempt to report them.
No. The function sends no cookies or credentials, so it sees the same page a logged-out visitor would, usually a sign-in form. Internal addresses such as localhost or 192.168.x.x are refused as well.
Extensions examine the fully loaded page inside your browser, including scripts added after load, and use much larger rule sets. This tool needs no install and works on any device, but it sees less, so treat it as a quick first check.