How to Spot the Tech Behind Any Website

Need to confirm what powers a site before you recommend integrations or build on top of it? These fast checks reveal the platform in minutes.

Spot Immediate Clues

• Scan the footer for signatures like “Powered by WordPress” or “Built with Jekyll.”
• Append common admin paths such as /wp-admin, /ghost, or /cms to the base URL—only once and without brute forcing—to see if a login screen appears.
• Notice URL patterns: WordPress installs often expose /wp-content/ or /wp-json/, while static generators usually serve extension-free “pretty” URLs.

Scan the HTML Source

Open the page source and search for generator hints:

<meta name="generator" content="WordPress 6.3" />
<meta name="generator" content="Jekyll v4.3.2" />
<meta name="generator" content="Hugo 0.120.3" />

Also look for HTML comments such as <!-- Generated by Hugo --> or template-specific class names. These signatures are difficult to hide and usually survive minification.

Track URL and Asset Patterns

• WordPress: /wp-content/, /wp-login.php, ?p=123 style permalinks, and REST calls hitting /wp-json/.
• Jekyll: Sitemap entries end in .html, assets ship from /assets/, and content rarely uses query strings.
• Hugo: Similar to Jekyll but often keeps a /public/ directory in static asset URLs and may advertise X-Generator: Hugo headers.
• Headless stacks: Watch for /api/ calls to Contentful, Sanity, or Strapi endpoints while the HTML stays static.

Robots, sitemap, and RSS feeds reinforce these patterns—WordPress exposes /wp-sitemap.xml, while static generators keep lightweight feeds without embedded trackers.

Browser Extensions

Install a detector like Wappalyzer or BuiltWith to get instant CMS, framework, analytics, and CDN fingerprints directly in the toolbar. Pair the output with keyboard-friendly DevTools navigation—my shortcut playbook [/posts/essential-chromium-based-browser-shortcuts-for-productivity/] keeps those checks quick.

Online Scanners

• builtwith.com: Deep breakdown of server tech, CDNs, frameworks, and advertising stacks.
• whatcms.org: Focused CMS detection with high accuracy for WordPress, Drupal, Ghost, and more.
• netcraft.com Site Report: Reveals hosting provider, certificate chain, and any exposed X-Generator or X-Powered-By headers.

Use two services to cross-validate results when a site masks obvious signals.

Watch the Network Traffic

Open the Network tab in DevTools, reload, and filter for identifiers. WordPress exposes /wp-json/ API calls, Ghost returns /ghost/api/ endpoints, and Shopify serves assets from cdn.shopify.com. Static site generators usually finish loading without additional API requests.

Check HTTP Headers

Fetch the response headers (DevTools → Network → Headers) and review fields like X-Powered-By, X-Generator, and Server. A Server: nginx result doesn’t prove WordPress, but X-Powered-By: WordPress or X-Generator: Hugo is definitive.

Do a Repository Sweep

If the site links to GitHub or GitLab, open the repository and scan the README or directory structure. Presence of _posts/, config.toml, or wp-content/themes/ instantly validates the stack.

Run a Quick Workflow

1. Load the homepage and note visible branding or footer credits.
2. View source and search for generator, jekyll, wordpress, or hugo.
3. Fire up DevTools, reload, and inspect network requests for platform-specific paths.
4. Plug the URL into Wappalyzer or builtwith.com for automated fingerprinting.
5. Review headers and auxiliary files (robots.txt, sitemap.xml, RSS) for matching patterns.

Respect Privacy Limits

• Stop after the first confident match—no need to hammer private endpoints.
• Avoid intrusive scanning or brute-force path probing; stay within ethical guidelines.
• Remember that custom stacks or headless CMS setups can mask these signals, so corroborate evidence before reporting.

With these checkpoints you can confidently identify whether a site runs on WordPress, Jekyll, Hugo, a headless CMS, or something custom—without guesswork or gray-hat tactics.