Skip to main content
Free Tech Stack Detector

Free Website Technology Stack Checker

Fingerprint the technology behind any website — web server, CMS, frameworks and JavaScript libraries — and surface the software versions a site discloses in its headers and markup.

By scanning, you confirm you own or have permission to test this domain. Not a substitute for manual penetration testing.

What this technology checker checks

Web server and X-Powered-By disclosure
CMS / generator detection
Frontend frameworks and JS libraries (fingerprinted)
Software versions disclosed in headers or markup
CDN / WAF detection (Cloudflare, Akamai, CloudFront, Imperva…)
Shodan-compatible favicon hash (mmh3) for asset correlation

How it works

Read-only· one HTTPS request
  1. We fetch your homepage once and fingerprint it from response headers, HTML markup, cookies and bundled JavaScript.
  2. We identify the web server, CMS/generator, frameworks and libraries, surface any version numbers they disclose, and detect the CDN/WAF in front.
  3. We also compute a Shodan-compatible favicon hash (mmh3) so you can see what an attacker can correlate about your asset.

What it doesn’t do: It reports what is disclosed; it does not exploit anything or confirm a version is vulnerable.

Why it matters

Attackers fingerprint your stack first, then look up public exploits for the exact versions you run. Knowing what you expose — and which versions are disclosed — lets you reduce that footprint before it's weaponised.

Frequently asked questions

Is the technology checker free?

Yes — technology fingerprinting runs as part of the free ONEROXE recon scan, with no sign-up.

Can attackers see my tech stack too?

Yes. Server headers, response patterns and bundled libraries reveal your stack to anyone — which is exactly why you should know what you expose and keep it patched.

Does it flag known-vulnerable libraries?

This quick check fingerprints technologies and any versions they disclose. For end-of-life and known-CVE correlation against a vulnerability database, run the full recon scan at /scanner.

Some of our JavaScript frameworks are not showing — why?

Technology detection reads HTTP headers and the initial HTML response. Frameworks that bootstrap after JavaScript runs (React, Vue, Angular) may not appear here. For a complete picture, check your own package.json or use a browser extension like Wappalyzer.

More free security tools