scan.now
Premium Scan a site

Technology Stack Scanner for Any Website

Enter a public website to identify its technology stack, redirects and infrastructure. The scan checks representative pages, assets, headers, cookie names and DNS records, then explains every match in plain language.

A bounded public scan of representative pages, common address redirects and DNS records. No scripts are executed, forms submitted or cookie values stored. How we scan · Acceptable use

How it works

  1. Check representative pages

    Scan.now starts at the address you enter, then checks up to three useful same-site pages. It does not log in, execute scripts or submit forms.

  2. Inspect the public clues

    Locally maintained fingerprints inspect metadata, markup, assets, headers, cookie names and DNS records. Cookie values are never retained.

  3. Explain the stack

    The report groups products by purpose, explains what each one does and keeps the technical evidence inside an optional detail.

What is a technology stack scanner?

A technology stack scanner reads the public clues a website sends to every visitor and turns them into a simple software inventory.

A website is rarely one product. It may use a content management system for publishing, a framework for the interface, a content delivery network for speed, an analytics service for measurement and a separate provider for payments or customer support. The combination is its technology stack.

Scan.now checks several public pages, their asset URLs, response headers, cookie names and DNS records. It also tests common address variants so you can see where HTTP, HTTPS, www and non-www visitors end up. Every named product comes with the signal that produced the match.

Put this result in context

This scanner answers one part of the review. Continue with SEO Audit for crawl, titles, links, speed, structured data, then JavaScript Libraries for outdated libraries with known cves. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.

For the background behind these signals, read Website Security: What a Vulnerability Scan Looks For and How to Fix It and Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.

Technology categories this scanner can identify

The report groups products by purpose so you can understand the site without knowing every brand name.

Publishing and commerce

Content management systems, site builders and ecommerce platforms such as WordPress, Drupal, Shopify, WooCommerce, Magento, Wix and Webflow.

Frameworks and libraries

Front-end and application software such as Next.js, Nuxt, React, Vue, Angular, SvelteKit, jQuery, Bootstrap and Tailwind CSS.

Analytics and advertising

Tag managers, analytics, conversion tracking, advertising and consent tools, including their public account identifiers when exposed.

Hosting and delivery

Public evidence for content delivery networks, reverse proxies, hosting platforms and web servers such as Cloudflare, Fastly, Vercel and nginx.

Payments and customer tools

Payment, marketing, chat and support services such as Stripe, PayPal, HubSpot, Intercom, Zendesk and Mailchimp.

Domain infrastructure

A, AAAA, CNAME, nameserver, mail and certificate-authority records that reveal the public services supporting the domain.

How website technology detection works

No single clue is reliable enough on its own, so the scanner compares several kinds of evidence.

SignalSimple exampleWhat it can reveal
Page metadatagenerator: WordPress 6.xA CMS and sometimes its disclosed version
Asset paths/wp-content/ or /_next/static/CMS, framework, plugins and libraries
Response headersCF-Ray or X-Vercel-IDCDN, proxy, hosting platform or server
Cookie names__cf_bmThe service setting the cookie, never its value
Public identifiersGTM-XXXXAnalytics, advertising or tag-manager accounts
DNS recordsNameservers, MX and CNAME recordsDNS, hosting, CDN and email providers

Redirect and domain setup

The same website may answer at four common addresses: HTTP and HTTPS, with and without www. The scanner follows each public redirect path and shows the final destination, status codes and whether visitors finish on a secure HTTPS address.

This helps find unnecessary redirect hops, inconsistent hostnames and an HTTP variant that fails to upgrade to HTTPS. It is a live check of the current setup, not a historical list of every domain that has redirected here.

Public relationship signals

Some services place a public account identifier in the page, such as a Google Tag Manager container, Google Analytics property, advertising account or Meta Pixel ID. Scan.now lists these identifiers and can show another recently scanned domain when the exact same public signal appears there.

A shared identifier can result from a common owner, agency, template or service provider. It is evidence of a technical connection, not proof that the domains have the same owner.

Why check a website's technology stack?

A clear inventory is useful for development, security, SEO, sales research and migration planning.

Audit your own website

Find services that are still loading after a migration, spot duplicated analytics tools and confirm that visitors reach one canonical HTTPS address.

Prepare a redesign or migration

Understand the visible CMS, framework, hosting and third-party dependencies before estimating the work or moving platforms.

Review third-party exposure

See which outside hosts receive browser requests and which public identifiers connect analytics, advertising and support services.

Verify an implementation

Confirm that a tag manager, analytics property, CDN or payment integration is visible where it is expected to be.

What a public technology scan cannot prove

Server-side software can be completely hidden. A reverse proxy can remove headers, assets can be renamed or bundled, consent controls can delay scripts and different sections of a large site can use different stacks. “Not detected” means no supported fingerprint appeared in the bounded pages and records checked. It does not mean the product is absent.

Scan.now reports live evidence and retains a short observation history. It is not a decades-long historical web index. Results should be treated as a current, evidence-backed starting point for review.

Related tools

Continue the review with four checks that cover adjacent parts of the same attack surface.

All tools
Websites SEO & Site Health Audit

Crawl, titles, links, speed, structured data
Websites JavaScript Library Vulnerability Scanner

Outdated libraries with known CVEs
Websites WordPress Vulnerability Scanner

Plugins, themes, core and known CVEs
Websites Common Crawl Harmonic Centrality Checker

Web graph centrality and PageRank positions

Guides for this tool

Background reading written to go with these results.

13 min read · Updated Sep 13, 2026 Website Security: What a Vulnerability Scan Looks For and How to Fix It

A website vulnerability scan checks the parts of a site an attacker can reach without logging in: Transport security, HTTP headers,...

Read the guide
8 min read · Updated Sep 20, 2026 Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them

A page that ships an old library ships its known vulnerabilities. How Retire.js-style detection works, the most common vulnerable...

Read the guide
9 min read · Updated Sep 18, 2026 How to Read a Security Scan Report: Severity, False Positives and What to Fix First

A scan report is a list of findings with severities, and the hard part is deciding what matters. How severities are assigned, how to...

Read the guide

Frequently asked questions

Is this BuiltWith or Wappalyzer?

No. It provides a similar public technology inventory, but Scan.now uses its own maintained signatures and shows the evidence behind every match. It does not copy Wappalyzer's GPL fingerprint database or call BuiltWith.

How can a website reveal its stack?

Products leave public signals in generator tags, asset paths, HTML attributes, response headers and cookie names. A WordPress page commonly loads wp-content assets; a Cloudflare response commonly carries a CF-Ray header.

Can it detect software hidden behind a reverse proxy?

Only when the public response preserves a distinctive signal. A proxy can remove server headers and a build pipeline can rename assets, so an absent product means no supported public fingerprint was found, not that the product is certainly unused.

Does it run JavaScript or log in?

No. It checks up to four public pages, follows public redirects and examines returned HTML, headers and DNS records. It does not execute scripts, submit forms or use credentials.

Are detected versions always exact?

No. A version is shown only when a public signal includes one. Many production sites deliberately suppress versions, and the report leaves those versions unknown instead of guessing.