Bug Circuit

Free tool · no signup

What is that website built with?

Enter a domain and see its stack (CMS, framework, server, CDN and WAF) read from a single homepage request, alongside the security headers it does and doesn't set.

Fingerprinting, and why it cuts both ways

Every website broadcasts clues about how it was built: in its headers, its cookies, the shape of its HTML. Developers use this to research competitors and check their own leakage; attackers use the exact same signals to decide which exploit to reach for. Knowing your stack is the difference between guessing and going straight for a known weakness.

This tool reads those clues from one ordinary request and reports the stack plus your security-header posture. It is the same fingerprinting step our audits begin with. The difference is that an audit then goes on to test whether what it found is actually exploitable.

Frequently asked questions

How can you tell what a website is built with?
Software leaves fingerprints: response headers like Server and X-Powered-By, cookie names, HTML patterns, script paths and meta tags. This tool reads a single homepage response and matches those signals against known signatures for popular CMSs, frameworks, servers, CDNs and analytics tools.
Why would an attacker want to know my tech stack?
Because it tells them which exploits to try. If they know you run a specific CMS version or framework, they can go straight to the known vulnerabilities for it instead of guessing. Fingerprinting is reconnaissance, the step before the attack.
Should I hide my technology stack?
Reducing what you leak is good practice: removing a version number from a Server header costs nothing and denies an attacker a free hint. But obscurity is not security: hiding the stack does not fix an underlying vulnerability, it just makes it slightly less obvious. Fix the vulnerability; hide the version as a bonus.
Is checking a website’s technology legal?
Yes. This makes one ordinary request to the homepage (exactly what any browser does when you visit) and reads the response. It sends nothing unusual and probes nothing. Every signal used is something the site broadcasts to every visitor.

Keep reading

Subdomain FinderMap every host on the domain.Security Headers CheckerGrade those headers A–F.SSL Certificate CheckerExpiry, issuer and hostname match.Manual audit from $49Is that stack actually exploitable?Penetration test cost calculatorEstimate a fair price for your scope.Breach cost calculatorWhat a breach would cost a business your size.Free tool: Next.js Vulnerability CheckerEnter a site and see its Next.js version and every published security advisory for it.Free tool: PHP Version CheckerFind the PHP version a site runs, see if it is still supported and which security fixes it is missing.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing