Stack Detector

Ever loaded a competitor’s site and wondered what’s actually running it? Stack Detector answers that in one search. Paste a URL and it fetches the page the same way a browser would, then matches the response against a curated database of nearly 80 platform fingerprints: CMS and page builders, ecommerce platforms, JavaScript frameworks, UI libraries, CDNs, hosting providers, server software and security services. Every detection ships with a confidence score and the actual evidence behind it, so you’re never just trusting a logo grid.

How fingerprinting actually works

No website announces “I’m running WordPress 6.5 on nginx behind Cloudflare” in plain English, but it doesn’t need to. Every platform leaves a trail of small, mostly-unavoidable tells:

• Asset paths. WordPress serves its themes and plugins from /wp-content/ and /wp-includes/; Shopify pulls everything from cdn.shopify.com; Next.js ships its build output under /_next/static/. These paths are structural: a site can’t easily rename them without breaking its own functionality.
• Meta generator tags. Many platforms stamp <meta name="generator" content="…"> right into the page: WordPress, Drupal, Joomla, Wix, Squarespace, Webflow, Ghost and more all do this by default (though it can be stripped).
• Response headers. The server itself often talks: cf-ray means Cloudflare is in front, x-vercel-id means Vercel is serving the request, x-powered-by: WP Engine names the exact managed-WordPress host. These are set by the infrastructure, not the site owner, so they’re usually the most reliable signal of all.
• Cookies. Session and cart cookies follow predictable naming per platform, woocommerce_cart_hash, _shopify_s, CraftSessionId, OCSESSID for OpenCart.
• Framework markers in the HTML itself. React apps carry data-reactroot; Next.js embeds a __NEXT_DATA__ script; Vue apps use data-v-app; Astro renders <astro-island> custom elements; Angular writes its version straight into ng-version="17.0.2".

Stack Detector runs dozens of these checks per category and adds up the weight of everything that matches, capped at 100. A single strong signal (a meta generator tag, a unique header) is enough to call a platform with medium-to-high confidence. Multiple independent signals agreeing (asset paths and a header and a cookie, say) push a detection into the high-confidence band. We also derive secondary detections: finding WooCommerce implies WordPress underneath it; finding Next.js implies React; finding Kinsta’s cache header implies WordPress (Kinsta is WordPress-only hosting): each derived call carries a lower confidence than a direct one, and always says so.

Reading the results

Detections are grouped into panels by category (CMS, Site Builder, E-commerce, JS Framework, UI/CSS, CDN, Hosting/PaaS, Server & Language, Security, Fonts) so a WordPress-on-Elementor site run through Divi’s theme, cached by Cloudflare and served by LiteSpeed, shows as several small, readable cards rather than one overwhelming list. Every card has a confidence bar (High ≥80% / Medium ≥45% / Low under 45%) and an expandable Evidence list naming exactly which signals fired, meta generator: WordPress 6.5, cookie: _shopify_s, header cf-ray present. Nothing is a black box. At the top, a one-line summary auto-composes the highlights into a sentence: “Built on WordPress 6.5, hosted behind Cloudflare, served by LiteSpeed.” That’s honestly the single most useful line on the page if you’re triaging a lot of sites.

Analytics and marketing tags (Google Analytics, Meta Pixel, HubSpot, and dozens more) aren’t re-analysed here: that’s a deep, separate job our Tag Explorer already does properly. Stack Detector shows a one-line count with a direct link across, so you get the full picture across both tools without either one duplicating the other’s work.

How to hide your stack (and why most sites don’t bother)

If you’d rather competitors, recruiters or curious visitors couldn’t tell what you’re running, a few things actually move the needle: remove the generator meta tag (most CMSs and page builders let you filter it out via a plugin or a one-line template edit), rename or proxy obvious asset paths, strip identifying response headers at your CDN or reverse proxy (Cloudflare Workers and nginx proxy_hide_header both do this cheaply), and avoid platform-specific cookie names where your framework allows renaming them. In practice almost nobody does all of this: it adds real maintenance overhead for a fairly small privacy win, and infrastructure-level headers (CDN, hosting) are the hardest tells to hide because they’re set by services you don’t fully control. That’s exactly why a tool like this stays useful: the honest majority of the web is running recognisable, well-fingerprinted platforms.

Choosing a platform, once you can see what everyone else picked

Part of the fun of a tool like this is competitive research: scan a handful of businesses in your niche and you’ll quickly see patterns: whether your competitors lean Shopify or WooCommerce, whether the fast-loading ones share a hosting provider, whether everyone in your space still runs WordPress with the same three or four page builders. If you’re evaluating a rebuild or a migration yourself, that’s real signal: a platform doing well for a dozen businesses like yours is a safer bet than a genuinely obscure one, and the CDN/hosting layer is often the difference between a site that loads instantly and one that doesn’t. If what you find is a slow, dated stack, or you’re simply tired of fighting a platform that fights back, Nitro Sites builds fast, modern websites without the plugin sprawl and hosting compromises this tool tends to surface.

For AI agents

This tool exposes a plain-text endpoint designed for language models and agents:

GET https://nitrosites.com/tools/stack-detector/scan.php?url=<target>&format=agent

It returns a token-cheap digest of the same analysis shown on this page: the auto-composed summary sentence, every detection grouped by category with its confidence score, and an analytics tag count with a cross-link to Tag Explorer’s own agent endpoint for the full marketing-tag breakdown. Soft rate limits apply; results are cached briefly. No key or login required.

Frequently asked questions

How does website technology detection work?

Every platform leaves fingerprints: asset paths like /wp-content/, response headers like cf-ray, cookies, meta generator tags and framework markers in the HTML. Stack Detector matches dozens of these signals and scores its confidence, showing you exactly which clues it found.

Can it tell which WordPress theme or page builder a site uses?

It detects the major page builders (Elementor, Beaver Builder, Divi and more) and key plugins when their fingerprints are visible. Heavily cached or minified sites can hide some signals.

Why does it say "possibly custom-built"?

Some sites are hand-coded or aggressively strip identifying headers and paths. When nothing matches, we show you the raw signals we did see instead of guessing.

Is this the same as checking tracking tags?

They're siblings: Stack Detector covers the platform (CMS, framework, hosting), while our Tag Explorer breaks down every analytics and marketing tag in depth. The results cross-link.

Is it legal to check what a website is built with?

Yes, the tool reads only what any browser receives when loading the public page. It never probes, logs in, or accesses anything non-public.