Free tool

What's This Site Built With?

Detect a website's CMS, frameworks, server and tools, and spot outdated software.

Passive fingerprinting from public response headers and page source only.

What this checks

Reads the Server and X-Powered-By response headers to identify web servers such as Nginx, Apache and LiteSpeed, and languages or frameworks such as PHP, Express and ASP.NET.
Spots platforms such as Cloudflare and Vercel from their headers.
Scans the page source for WordPress (including its version if the generator tag is present), Joomla, Drupal, Shopify, Wix, Squarespace and the Elementor page builder.
Detects front end libraries and services: Next.js, React, Angular, jQuery, Google Analytics and Google Fonts.

Why it matters

Attackers use automated scans that look for specific software versions with known flaws, especially in popular content management systems and plugins. If your site advertises its exact versions, it is easier to match against public vulnerability lists. Knowing what your site runs also helps when you hire a developer or check that a supplier built what they said they would.

How to read the result

Any version number shown, for example in a WordPress generator tag or a Server header, can be compared with the current release on the vendor's site.
A WordPress site is only as secure as its least maintained plugin; the core version alone does not tell the whole story.
Not seeing a technology does not mean it is absent. Detection relies on visible markers, and well configured sites often hide them.
Headers that reveal exact versions, such as X-Powered-By: PHP followed by a number, give attackers free information.

How to fix what it finds

Update your CMS core, themes and plugins, and remove any you no longer use.
Hide version details: set server_tokens off in Nginx, ServerTokens Prod in Apache and expose_php = Off in php.ini.
Remove the WordPress generator meta tag, which most security plugins can do for you.
Subscribe to security announcements for each platform you use so you hear about urgent patches promptly.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

How can I tell what CMS a website uses?

Enter the address above. The tool looks for markers such as wp-content paths, generator tags and platform specific scripts in the page source, and for clues in the response headers.

Is it a problem that people can see I use WordPress?

Not on its own; a large share of the web runs WordPress. The risk comes from running outdated versions or plugins, and from advertising exact version numbers.

Does this tool find vulnerabilities?

No. It identifies technology and any exposed version strings. Matching those against known vulnerabilities, and testing your site properly, is the job of a security audit.