Website technology detector
Find out what a website is built with: its CMS or site builder, WordPress theme and plugins, frameworks, analytics, widgets, CDN and web server. Every result shows the clue it was found from.
- About 80 technologies, with evidence
- WordPress theme and plugin details
- No signup needed
Built with
Enter a URL to start
- URLWaiting for inputThe page you entered
- Response—Status and headers
- Platform—CMS or framework
- Add-ons—Scripts, widgets and tags
Technology report
Enter a website above to see its technology stack grouped by category, with the evidence for each result and WordPress theme and plugin details.
Fair-use limit: 20 scans per hour and 100 per day for each visitor IP address.
How technology detection works, and its limits
Websites leave clues in the code they send. Reading those clues well means knowing which ones can be trusted.
Every tool leaves fingerprints
WordPress loads files from /wp-content/, Shopify from cdn.shopify.com, Next.js from /_next/. Servers and CDNs add their own headers. Matching these patterns reveals most of a site's stack in one request.
Not found is not the same as not used
Headless sites hide their CMS, CDNs strip server headers, and optimisation plugins rename files. Treat a missing result as unknown, never as proof that a technology is absent.
Version numbers are hints
Versions come from generator tags and ?ver= numbers on files. They are usually right, but caching and security plugins can change or remove them. Treat them as a starting point for an audit, not a final answer.
Tag managers hide the marketing stack
When a site uses Google Tag Manager, most tracking tools load inside the container after the page opens. This tool sees the tag manager, but not every pixel loaded through it.
The signals this detector reads
Where each clue comes from, what it reveals and whether a site can hide it.
| Signal | Example | What it reveals | Can it be hidden? |
|---|---|---|---|
| Meta generator tag | <meta name="generator" content="WordPress 6.6"> |
The CMS or site builder, often with its version. | Yes, most security plugins remove it. |
| Script and style URLs | /wp-content/plugins/, cdn.shopify.com, /_next/static/ |
CMS, plugins, frameworks, analytics and widgets. | Partly, by combining or renaming files. |
| HTTP headers | server: nginx, cf-ray, x-powered-by: PHP/8.2 |
Web server, CDN and backend language. | Yes, many sites strip them. |
| Cookie names | laravel_session, _shopify_y, PHPSESSID |
Backend framework or platform. | Rarely, cookie names are hard to change. |
| HTML markers | __NEXT_DATA__, data-wf-page, ng-version |
Frameworks and site builders. | Rarely, they are part of how the page works. |
| Theme style.css | Theme Name: Astra, Version: 4.8 |
The exact WordPress theme, version and parent theme. | Only by hiding theme folders. |
How this tool works
What happens between entering a URL and seeing the stack.
The URL is checked
Only public http and https addresses on ports 80 and 443 are accepted. The domain is resolved and private, internal or reserved addresses are refused.
One page is fetched
Our server requests the page as AllInOneToolsTechDetector, following up to 5 redirects and checking each new address again. JavaScript is not run.
Fingerprints are matched
About 80 technologies are matched against the generator tag, script and stylesheet URLs, response headers, cookie names and HTML markers. Every match keeps its evidence.
WordPress gets a closer look
For WordPress sites we read the theme's public style.css and look up up to 10 plugins on WordPress.org, sending only the plugin name.
You get the report
Results are grouped by category and go straight to your browser without being saved.
What this tool does, and what it doesn't
A plain list, so you know exactly what to expect.
This tool does
- Detect CMSs, site builders and e-commerce platforms
- Name the WordPress theme, parent theme and plugins
- Find frameworks, analytics, chat and payment tools
- Read CDN, web server and backend headers
- Show the evidence behind every result
- Export the report as JSON
This tool does not
- Run JavaScript or see tools loaded later
- Test for vulnerabilities or probe admin pages
- Get past firewalls or bot protection
- Name the hosting company
- Scan private or internal sites
- Store the sites you scan
Where your data goes
Our server fetches the page you enter, and for WordPress sites the theme's public style.css, identifying itself as AllInOneToolsTechDetector. Plugin names, but not the site URL, are sent to the WordPress.org plugin directory for details, which are cached for 24 hours. The website sees our server, not you, and the result goes straight to your browser without being stored. Like any website, our server may keep normal access logs, as described in our privacy policy.
Run a WordPress site? The official hardening guide explains what is worth hiding and what is not.
Why your results might look unexpected
The six surprises people run into most, and what each one means.
No CMS detected
The site may be custom-built, static, headless (a CMS behind a JavaScript front end) or hiding its generator tag.
WordPress, but few or no plugins
Optimisation plugins combine and rename files, and some security plugins rename the plugins folder, so folder names disappear.
Analytics you expected are missing
Tools added through Google Tag Manager load later in the browser and are not in the HTML this tool reads.
Only Cloudflare in the infrastructure list
A CDN in front of the site replaces the server header and hides the origin server.
A 403 error or a security check
Bot protection blocked our server. Browser extensions still work there because they read the page you already opened.
An older version number than expected
Version numbers in file URLs can be stale or changed on purpose. Compare with the latest version listed.
Questions about detecting website technology
Which technologies can this tool detect?
About 80, including WordPress, Shopify, Wix, Squarespace, Webflow, Drupal, Joomla, Magento and Ghost, frameworks such as Next.js, Nuxt, React, Vue and Angular, analytics and marketing tags, payment and chat widgets, CDNs such as Cloudflare and CloudFront, web servers and backend languages. Each result shows the clue it was found from.
Why is a technology I know the site uses missing?
The tool reads the HTML your server sends, without running JavaScript. Tools loaded later by Google Tag Manager or another script, technology behind a CDN that hides headers, and files renamed or combined by optimisation plugins leave no visible clue. Not found means not visible, not absent.
Are the WordPress plugin versions accurate?
They are a strong hint, not proof. The version shown comes from the ?ver= number on the plugin's files, which is usually the plugin version but can be changed or removed by caching and security plugins. The latest version on WordPress.org is shown separately, so you can compare.
Why do some plugins show no details?
Details come from the free WordPress.org directory. Premium plugins sold elsewhere, custom plugins and plugins that have been removed from the directory are listed by their folder name only.
Can it tell me who hosts the website?
It shows the web server and any CDN in front of the site, but not the hosting company. For that, use our Hosting Checker, which looks up the IP address owner, nameservers and other hosting clues.
Is it okay to check another company's website?
Yes. The tool only reads what any browser receives when it opens the public page, the same information that browser extensions for technology detection use. It does not test for vulnerabilities, guess admin pages or bypass any protection.
Are the sites I scan stored?
No. The page is fetched and scanned, and the result goes straight to your browser without being saved. WordPress.org plugin details are cached for 24 hours by plugin name only. A hashed, temporary copy of your IP address is used for rate limiting and expires within 24 hours. Like any website, our server may keep normal access logs, as described in our privacy policy.