CMS & Version Detector
Identify what built and serves a page — with the evidence for each finding.
The page to audit
How this check works
The page and its response headers are read for markers: a generator meta tag, asset paths that belong to one platform, runtime markers left by a framework, and headers only the server can set. Findings from headers carry more weight than findings from markup, because a page can embed anyone's asset host while only the server sets its own headers. Every result is shown with the string that produced it — "WordPress, because the page links /wp-content/" is checkable and "WordPress" is not, and detectors are wrong often enough for that difference to matter.
What the results mean
- Evidence
- The exact marker that produced each finding, so you can judge whether it means what the label says.
- Version disclosed
- A version number in a header or a generator tag. Not a vulnerability, and it tells anyone scanning which published advisories to try.
- CDN and server
- Identified from response headers, which the origin or the edge sets. Stronger evidence than anything in the markup.
- Nothing detected
- The normal result for a static or hand-built site, or one behind a proxy that strips identifying headers. Not evidence of concealment.
Common problems and fixes
- It detected the wrong platform
- Check the evidence line. A site that embeds a Shopify buy button or a WordPress-hosted asset carries that marker without running either.
- It detected nothing on my site
- Static generators and hand-built sites usually leave no marker, and a CDN configured to strip Server and X-Powered-By removes the rest. That is a good outcome, not a failed check.
- My version number is showing
- Suppress the Server and X-Powered-By headers at the web server or the framework, and remove the generator meta tag if your CMS adds one. All three are configuration, not code.
Frequently asked questions
How can you tell what CMS a website uses?
From the traces each platform leaves in what it serves: a generator meta tag, asset paths like /wp-content/ or a platform CDN, runtime markers a framework needs in the page, and response headers the server sets. None of them are proof — a site can embed another platform's assets, and a proxy can remove the headers — which is why every finding here shows what produced it rather than asking you to trust the label.
Is it a security risk to show my software version?
It is not a vulnerability, and it is worth removing anyway. A version number in a Server or X-Powered-By header tells anyone scanning the internet exactly which published advisories to try against your host, which turns a broad sweep into a targeted attempt. Suppressing those headers costs a line of configuration and removes that shortcut.
Why can this see my CDN but not my server?
Because that is the point of a CDN: the edge answers the request and the origin never appears in the response. What you are seeing is the CDN correctly hiding what is behind it.