Every website leaves fingerprints. Here's how to read them — and why it matters for agencies, developers, and competitive intelligence.
Every website leaves fingerprints. The JavaScript libraries it loads, the HTTP headers it returns, the cookie names it sets, the meta tags in its HTML — all of these signals reveal the technology stack powering the site. You don't need to ask the developer. You just need to know where to look.
This guide explains how technology detection works, what signals are most reliable, and how to use this knowledge for competitive intelligence, new business pitches, and technical audits.
For agencies and consultants, knowing what technology a prospect or competitor uses is commercially valuable:
Technology detection works by reading multiple independent signals and cross-referencing them against a signatures database. Here are the five main signal categories:
The server's response headers often reveal the technology stack directly. Common examples:
| Header | What it reveals |
|---|---|
| X-Powered-By: PHP/8.1 | Server-side language and version |
| Server: nginx/1.24.0 | Web server software and version |
| X-Generator: WordPress 6.4 | CMS platform and version |
| Set-Cookie: PHPSESSID=... | PHP session handling |
| Set-Cookie: __stripe_mid=... | Stripe payment integration |
| Set-Cookie: _ga=... | Google Analytics |
Many modern sites suppress these headers for security reasons, but a significant proportion still expose them — especially older sites and those running on shared hosting.
The rendered HTML contains dozens of technology fingerprints:
Free Tool
Check your own site's score in 30 seconds
Get a free Website Intelligence Score™ — security, performance, SEO, and tech stack. No signup required.
Modern JavaScript-heavy sites expose their technology stack through global variables. A headless browser can inspect the JavaScript runtime after the page loads:
Intercepting the network requests a page makes reveals third-party integrations that may not be visible in the HTML:
This is the most comprehensive signal category because it captures lazy-loaded and dynamically injected scripts that don't appear in the initial HTML.
Cookie names are highly distinctive technology fingerprints:
| Cookie name | Technology |
|---|---|
| _ga, _gid, _gat | Google Analytics |
| _fbp, _fbc | Facebook Pixel |
| __stripe_mid, __stripe_sid | Stripe |
| intercom-id-* | Intercom |
| hubspotutk | HubSpot |
| _hjid, hjSessionUser* | Hotjar |
| PHPSESSID | PHP |
| JSESSIONID | Java/Spring |
SiteReveal uses a headless Chromium browser (Playwright) to load the target URL in an isolated context. This means it sees the fully-rendered page — including all JavaScript-injected content, lazy-loaded scripts, and dynamically set cookies — rather than just the static HTML.
The detection engine then cross-references all five signal categories against a signatures database covering 60+ technology categories:
Each detected technology receives a confidence score (0–1) based on how many independent signals corroborate the detection. A technology detected via three independent signals (e.g. a script URL, a global variable, and a cookie) receives a higher confidence score than one detected via a single signal.
Before a pitch meeting, run the prospect's site through SiteReveal. You'll know:
This lets you walk into the meeting with specific, informed observations rather than generic questions.
Run your top 5 competitors through SiteReveal and compare their technology stacks. Are they investing in personalisation tools you're not using? Are they running A/B tests? Do they have a more sophisticated analytics setup? Are they on a faster CDN?
Before taking on a client or acquiring a website, a SiteReveal scan gives you a technology inventory in 30 seconds. You'll know immediately if the site is running end-of-life software, missing security headers, or using deprecated libraries.
Enter any URL and SiteReveal will return a full technology stack breakdown in under 30 seconds, with confidence scores for each detected technology and a complete signal evidence list.
Get a free Website Intelligence Score™ covering security, performance, SEO, and technology stack.
The best agencies don't walk into a pitch blind. Before every new business meeting, they run a quick intelligence check on the prospect's website. Here are the 6 things they look for — and how to check all of them in under 2 minutes.
Most agency website audits take hours. Here's how to run a complete, professional audit for any client in under 30 seconds — and send them a branded PDF report the same day.
SEMrush is the industry standard for SEO agencies. SiteReveal is built for website intelligence. Here's an honest comparison of both tools — what each does best, where each falls short, and which one is right for your agency.
The SiteReveal team builds tools that help developers, marketers, and founders understand what's really happening under the hood of any website — from security posture to performance bottlenecks and technology stack fingerprinting.
