Website Technologies Check

Website Technologies Check

Enter a domain or IP address and click Analyze Website. The tool loads the page, reads its HTML, response headers and cookies, and matches them against around 140 known technologies:

• CMSs and e-commerce platforms
• Frameworks and JavaScript libraries
• Web servers and CDNs
• Hosting platforms
• Analytics and marketing tags, live chat, payments and cookie banners

In the same pass it checks compression, HTTP/2 and HTTP/3, security headers, the SSL certificate and where the site is hosted.

How detection works

Most software leaves fingerprints in the page it produces. A few examples of what the tool looks for:

• WordPress: paths like /wp-content/ in the HTML, a generator meta tag, or a Link header pointing to api.w.org.
• Laravel: a laravel_session cookie, or an XSRF-TOKEN cookie next to a session cookie, which still catches sites that renamed their session cookie.
• Next.js: a __NEXT_DATA__ script or files loaded from /_next/static/.
• Cloudflare: a cf-ray response header.
• Tailwind CSS: its --tw- CSS variables.

Some technologies are inferred from others. WooCommerce means WordPress is there too. Next.js means React and Node.js.

Version numbers appear when a site gives them away, usually in a generator tag, a Server header or a script filename.

Reading the results: scohostings.com

Detected technologies: Next.js, React, Node.js, Cloudflare. Next.js was found directly in the page. React and Node.js are listed because Next.js is built on them. The server never announced "Node.js" itself, and backend languages almost never do.

Web server: cloudflare. The site sits behind Cloudflare, which replaces the Server header with its own. Whatever web server runs the site underneath is hidden.

Hosting: 104.21.82.207, Cloudflare (AS13335), Toronto. For the same reason, this is Cloudflare's edge server, not where the site actually runs. When a site uses a CDN, the hosting section describes the CDN. The nameservers (lola and theo.ns.cloudflare.com) show the domain's DNS is on Cloudflare as well.

Response time: 178 ms. This is how long the page took to start arriving at our server. It's a single measurement, so treat it as a rough indication, not a benchmark.

Compression

• Gzip is the baseline every browser supports.
• Brotli usually produces noticeably smaller files for HTML, CSS and JavaScript.
• Zstandard is the newest, supported by recent Chrome and Firefox versions.

A site that offers none of them is sending text files at full size. The GZIP Compression Test gives more detail.

Modern protocols

• HTTP/2 loads many files over one connection.
• HTTP/3 runs over QUIC instead of TCP and copes better with patchy mobile connections.
• IPv6 Enabled means the site has an AAAA record and answers over IPv6.

Security headers

Each of these tells the browser to enforce a rule:

A missing header isn't automatically a vulnerability, but each one closes off a class of attack. The Security Headers Auditor explains each result, and the CSP Header Generator helps you write the trickiest one.

SSL certificate

The certificate was issued by Google Trust Services and runs from 18 September to 17 December 2026, a 90-day lifetime. Short certificates like this are renewed automatically, so 76 days left is normal, not a warning. Public certificates are getting shorter-lived across the industry anyway, with the maximum lifetime being cut in stages to 47 days by 2029. A certificate that isn't renewed automatically will become a regular chore.

TLS 1.3 is the current protocol version and makes connections faster to set up. An ECDSA 256-bit key is roughly as strong as a 3072-bit RSA key while being much smaller.

Covered names shows which hostnames the certificate is valid for. Here that's scohostings.com and *.scohostings.com. A wildcard covers only one level of subdomain: blog.scohostings.com works, dev.blog.scohostings.com doesn't. For a deeper certificate check, use the SSL Checker.

What it's useful for

Seeing what your own site gives away

Check your site and look at what it announces. A header like Server: nginx/1.18.0 (Ubuntu) or X-Powered-By: PHP/8.1.2 tells anyone exactly which versions you run. Automated scanners use that to match you against known vulnerabilities, which you can look up with CVE Lookup.

Hiding version numbers doesn't fix outdated software, but it stops easy matching:

• nginx: server_tokens off;
• Apache: ServerTokens Prod and ServerSignature Off
• PHP: expose_php = Off

Checking a deployment

After a launch or a server move, confirm:

• Compression is on.
• HTTP/2 or HTTP/3 is working.
• The certificate covers both the root domain and www.
• Your security headers survived the move.

Researching competitors

Find out which CMS, shop platform, analytics, chat widget or payment provider another site uses. Agencies do the same before taking over a site, so they know what they're inheriting.

Limits worth knowing

Server-side software is mostly invisible. Databases, backend languages, payment calls made from the server, and anything else that leaves no trace in the page, headers or cookies can't be seen from outside.

Behind a CDN, you see the CDN. The web server, IP and hosting details belong to Cloudflare, Fastly or whichever CDN is in front.

"Not detected" doesn't mean "not used." Detection relies on recognizable names and paths, so things go missing:

• Sites can remove generator tags and rename cookies.
• A build tool can bundle jQuery into a file called app.3f9c1.js, which no longer looks like jQuery.
• The check reads the page as delivered, without running its JavaScript. Tags that Google Tag Manager adds in the browser usually show up only as Google Tag Manager.

One page at a time. Something that loads only on certain pages, like Stripe on a checkout page, won't appear in a check of the homepage.

Bot protection can get in the way. If a site shows a challenge page to automated visitors, that challenge page is what gets analyzed. A 403 or 503 status in the overview is the giveaway.

IP addresses give partial results. A shared hosting server can carry hundreds of sites, and requesting the bare IP usually returns a default page. The certificate will also show as mismatched, because it was issued for a domain name, not the IP.

FAQ

Can I find the real server behind Cloudflare?

Not with this tool. Hiding the origin server is one of the things a CDN proxy is for.

Why are React and Node.js listed when the site never mentions them?

They're implied by something that was detected directly. Next.js only runs on React and Node.js, so finding Next.js means both are there.

Is it the same as checking the response headers myself?

Headers are one of three sources the tool reads. To see a site's raw headers, use the HTTP Headers Parser.