Skip to content
GrowthVector.io

Website Technology Lookup: Detect the Stack Behind Any Site

This website technology lookup checks a URL against a fixed list of 19 technologies and reads its HTTP security headers.

Beta

Data Extraction

Point it at any page. Get back the structured entities, contacts, files, structured data, technology, and trust signals a crawl can recover: grouped, deduped, and reconciled against Wikidata.

Checking today's extraction quota…

Only extract from sites you own or are authorized to analyze. You are responsible for respecting others' terms and intellectual property.

Example output: technology lookup

Output for https://growthvector.io, 5 pages, trimmed for display. Run the tool to get the per-page records and the full header values.

{
  "source": {
    "requestedUrl": "https://growthvector.io",
    "finalUrl": "https://growthvector.io/",
    "pagesCrawled": 5,
    "durationMs": 7086
  },
  "technology": {
    "frameworks": [
      "React SPA",
      "React/root"
    ],
    "analyticsPixels": [
      "Google Analytics"
    ],
    "cms": [],
    "cdnHints": []
  },
  "httpSecurity": {
    "exposedServers": [
      "cloudflare"
    ],
    "httpWarnings": [
      "server_header_exposed"
    ],
    "securityIssues": [
      {
        "id": "csp_unsafe_inline",
        "header": "content-security-policy",
        "severity": "medium",
        "message": "style-src allows 'unsafe-inline'."
      },
      {
        "id": "csp_wildcard_source",
        "header": "content-security-policy",
        "severity": "medium",
        "message": "connect-src includes a wildcard or broad scheme source."
      },
      {
        "id": "corp_missing",
        "header": "cross-origin-resource-policy",
        "severity": "low",
        "message": "Cross-Origin-Resource-Policy was not observed."
      },
      {
        "id": "coep_missing",
        "header": "cross-origin-embedder-policy",
        "severity": "low",
        "message": "Cross-Origin-Embedder-Policy was not observed."
      }
    ]
  },
  "siteIdentity": {
    "websiteNames": [
      "GrowthVector"
    ],
    "alternateNames": [
      "GrowthVector.io"
    ],
    "faviconUrls": [
      "https://growthvector.io/apple-touch-icon.png",
      "https://growthvector.io/favicon.ico",
      "https://growthvector.io/favicon.svg"
    ],
    "manifestUrls": [
      "https://growthvector.io/site.webmanifest"
    ]
  }
}

Download the full JSON from the tool above after your own run.

How technology lookup works

  1. Enter the site address. Technology, HTTP security and Site identity are already selected.
  2. Keep the page count small for a quick answer. The home page and a few inner pages show most of these signals.
  3. Run the extraction, read the detected technologies and header findings, then download the full JSON.

How much can a website technology lookup tell you from the outside?

Updated

A website technology lookup reads the response a site sends and the page it serves, then matches patterns. The tool reports the CMS, JavaScript frameworks, analytics pixels and A/B testing tools it recognises from a fixed list of 19 technologies, the HTTP security headers it sees, and the names and icons the site declares for itself.

Every detected technology carries a confidence score and the exact text that matched, so you can judge each signal yourself. Use it to check a site for those 19 technologies and to find missing security headers before an audit. The three sections you need are preselected.

Related guides: website data extraction tool, free marketing tools, HTML to JSON extractor, website email extractor.

Common Questions

How does the tool decide which technologies a site uses?

It matches patterns in the page and its responses against a fixed list of 19 technologies. Each signal has a kind (CMS, framework, analytics pixel, A/B testing or environment), a confidence score from 0 to 1 and the evidence string that matched. In the example, Google Analytics came from a match on google-analytics.com at a confidence of 0.8.

Why is the CMS list empty for a site I know runs a CMS?

An empty list means no known signature matched, not that no CMS exists. The lookup knows 7 CMS and headless platforms: WordPress, Shopify, Webflow, HubSpot, Contentful, Sanity and Strapi. Wix, Squarespace, Drupal and Magento are not on the list. Custom builds and sites that hide generator tags also leave nothing to match. Open the page source, search for the platform name, and treat the confidence score as the strength of the clue, not as a final answer.

Why does a React site show up as React SPA?

The tool matched a root container that single page apps use, at a confidence of 0.65. A client-rendered shell is worth knowing about, because content added after load can differ from the raw response. Pair this job with the HTML to JSON page to see which structured data the raw response already contains.

Which security headers does it report, and how are they graded?

It parses Content-Security-Policy directive by directive, reads HSTS and other response headers, and lists issues with a severity of low, medium, high or critical. In the example, it flagged unsafe-inline in style-src and a broad connect-src as medium, and two missing cross-origin policies as low.

Will it find the CDN or hosting provider?

It reports CDN hints from the origin audit and lists the Server and X-Powered-By values a site exposes. In the example, cdnHints stayed empty, but the Server header named cloudflare under exposedServers. A CDN that strips those headers can still hide its name, so read both fields together.

Can I compare the stack of several sites?

Run one site per extraction, since the free tool allows 2 a day, then compare the downloaded JSON files. The technology section aggregates names across all crawled pages and also keeps a record per page, so you can see whether an inner page loads a pixel or a framework the home page does not.