Bug Circuit
Free tool · no signup

What is that website built with?

Enter a domain and see its stack — CMS, framework, server, CDN and WAF — read from a single homepage request, alongside the security headers it does and doesn't set.

Fingerprinting, and why it cuts both ways

Every website broadcasts clues about how it was built — in its headers, its cookies, the shape of its HTML. Developers use this to research competitors and check their own leakage; attackers use the exact same signals to decide which exploit to reach for. Knowing your stack is the difference between guessing and going straight for a known weakness.

This tool reads those clues from one ordinary request and reports the stack plus your security-header posture. It is the same fingerprinting step our audits begin with — the difference is that an audit then goes on to test whether what it found is actually exploitable.

Common questions

How can you tell what a website is built with?
Software leaves fingerprints: response headers like Server and X-Powered-By, cookie names, HTML patterns, script paths and meta tags. This tool reads a single homepage response and matches those signals against known signatures for popular CMSs, frameworks, servers, CDNs and analytics tools.
Why would an attacker want to know my tech stack?
Because it tells them which exploits to try. If they know you run a specific CMS version or framework, they can go straight to the known vulnerabilities for it instead of guessing. Fingerprinting is reconnaissance — the step before the attack.
Should I hide my technology stack?
Reducing what you leak is good practice — removing a version number from a Server header costs nothing and denies an attacker a free hint. But obscurity is not security: hiding the stack does not fix an underlying vulnerability, it just makes it slightly less obvious. Fix the vulnerability; hide the version as a bonus.
Is checking a website’s technology legal?
Yes. This makes one ordinary request to the homepage — exactly what any browser does when you visit — and reads the response. It sends nothing unusual and probes nothing. Every signal used is something the site broadcasts to every visitor.

Keep reading

Subdomain FinderMap every host on the domain.Security Headers CheckerGrade those headers A–F.SSL Certificate CheckerExpiry, issuer and hostname match.Manual audit from $49Is that stack actually exploitable?

See what attackers see — free

Run the free passive check on your domain. No login, no impact on your site, results in seconds.

Passive recon only. No login, and no impact on your site. Deeper testing needs domain verification.

Ready for the full manual audit? See transparent pricing →