Technology detection

What we detect

The result lists the technology we found on your site, each with its source. That includes the web server, such as nginx or Apache, the programming language, such as PHP, the system, such as WordPress, and widely used JavaScript libraries such as jQuery or React. Where a version number is visible, it is shown too.

An entry looks like this: nginx 1.18.0, found in the Server header. Or: jQuery 3.4.1, found in an included script. The list is not a rating. It shows what any curious visitor can see too.

How we see it

• In the Server header, many servers name themselves, often with their version.
• In the X-Powered-By header, PHP or Express, for example, introduce themselves.
• Systems such as WordPress set the generator tag in the HTML.
• Addresses of included files such as bootstrap-4.3.1.min.js reveal library and version.

What the homepage sends is enough for this. How we compare detected versions with known vulnerabilities is described in Software with known vulnerabilities.

Platforms and hosts

Separately, the result shows what an app was built with and where it runs. That way you quickly see which guide applies.

• We detect Lovable, Bolt, v0, Replit and Base44 by the app’s address, such as name.lovable.app, or by platform scripts in the HTML.
• We detect Vercel and Netlify by their response headers.
• We detect Next.js and Vite by the paths of their JavaScript files.
• We detect Supabase and Firebase by their addresses in the JavaScript files.

Apps built with Cursor, Claude Code or Codex carry no trace of the tool. For those you only see host and framework. How to secure such apps is described in Securing vibe-coded apps.

Is this a problem?

It does no harm if someone sees what your site is built with. The exact version is a different matter: anyone who knows a vulnerability in a specific version searches for sites that reveal that version.

Hiding it makes your site less conspicuous, but not more secure. Only the update protects you. That is why a visible server version and X-Powered-By are only notices for us and cost no points.

Hiding versions

Here is how to turn off these details in the most common places:

server_tokens off;

ServerTokens Prod
ServerSignature Off

expose_php = Off

Header unset X-Powered-By

app.disable("x-powered-by");

const nextConfig = { poweredByHeader: false };

remove_action('wp_head', 'wp_generator');

In Apache, ServerTokens and ServerSignature only work in the main configuration, not in .htaccess. Some hosts set these headers themselves. Then only their control panel or support can help.

Then check again. The notices disappear and the technology list gets shorter. What remains usually comes from the addresses of included files. The list itself costs no points.

Still have questions? Email us.