Tech stack detection: how to see what a website is built with

You can see what a website is built with by looking at the signals it sends to every visitor, such as its HTML, scripts, HTTP headers, cookies and DNS records. Detection tools read those signals and match them against a library of known technologies. You can do the same by hand in a few minutes, and the results are good enough for competitor research and due diligence, though never perfect.

This guide explains where those signals come from, how to check them yourself, what a tool adds, and how to interpret the answer without over-reading it.

Why founders care about a competitor's stack

A site's technology choices tell you a surprising amount about how a team works.

• Speed and scale. A static site on a content delivery network behaves differently from a heavy single-page app.
• Cost and hiring. If a product runs on a popular framework, it is easier to hire for. A rare stack may signal a deliberate trade-off or technical debt.
• Marketing setup. Analytics, tag managers, chat tools and email platforms show how seriously a company runs growth.
• Integration opportunities. If you sell a plugin or service, knowing which platforms a prospect uses lets you target outreach.
• Due diligence. When you consider buying a business, the stack determines how hard it will be to maintain. See the buy-a-startup marketplace for context on acquisitions.

How detection works

Every page is a bundle of public clues. Detection tools collect them and compare against fingerprints, which are patterns that identify a given technology.

HTML and meta tags

Many content management systems add a generator meta tag, or leave characteristic folder names in asset URLs. Class names, comments and data attributes can reveal a UI library or a site builder.

JavaScript files and global variables

Scripts loaded from a particular domain often identify a service, for example an analytics tool or a payment widget. Frameworks leave recognizable objects on the page, and bundle file names sometimes reveal the build system.

HTTP response headers

Servers send headers with every response. Some state the web server software, the hosting platform, or the CDN. Others add caching or security policies that hint at the infrastructure.

Cookies

Cookie names are frequently specific. An analytics service, a session library or a consent tool may each set a recognizable cookie.

DNS and network records

The name servers, mail records and IP ranges show where a domain is hosted and which email provider it uses. A TXT record that verifies a service can reveal even more. Pair this with a WHOIS or RDAP lookup, which shows the registrar and name servers.

File paths and well-known files

Files such as robots.txt, sitemap.xml and manifest files sometimes expose platform-specific paths.

How to check a site by hand

You do not need special software for a first look.

1. View the page source. Open it in your browser and search for "generator", "wp-content", "cdn" and script tags.
2. Open developer tools. The Network tab shows every request, including third-party services. The Application tab lists cookies and local storage.
3. Read the response headers. Click the main document request and inspect the headers for server, CDN and security details.
4. Look at DNS. Query the name servers and mail records with a DNS lookup tool.
5. Check the page's performance. Core Web Vitals and loading behavior can show whether a site is server-rendered or client-rendered. Google's Core Web Vitals guidance explains the targets for loading, responsiveness and layout stability.

With practice this takes about five minutes per site.

What detection tools add

Manual inspection does not scale. Tools such as Wappalyzer say they can reveal web technologies, versions and changes in a stack across external websites, and they combine this with company information and lead lists. Other services focus on large historical datasets and technology adoption trends. Each has its own coverage, pricing and rules, so read the terms before you rely on one.

The StartupsIntel traffic checker includes a tech stack section in every site report, alongside modelled traffic, an SEO audit, WHOIS data via RDAP and a homepage screenshot. That puts the technology next to the business context, which is what you usually need when comparing competitors. To scan a list of sites in one go, use the bulk checker.

Common categories you will see

Category	Examples of what it tells you
Framework	How the interface is built, and how the team hires
CMS or site builder	How content is published and who can edit it
Hosting and CDN	Performance, regions and cost profile
Analytics	What the team measures, and how mature growth is
Tag manager	Marketing tools managed outside the code
Payments	How the product is monetized
Customer support	Chat and help desk setup
Email	Which provider sends their messages
Security	Bot protection and consent tools

Reading the results with care

Detection is useful, but it is inference rather than proof. Keep these limits in mind.

Hidden or custom components

A backend can sit behind a proxy and reveal nothing. Companies may remove version numbers and generator tags on purpose. Anything running only on the server, such as databases and internal tools, is largely invisible.

Outdated fingerprints

Technologies change quickly. A detection library may lag behind new versions or miss a new framework. Treat any list as a snapshot.

Incomplete signals

The tool sees what the homepage exposes. A marketing site may use one stack, while the logged-in product uses another. Check subdomains like app. or docs. as well.

False positives

Leftover scripts or old tags may suggest tools that are no longer active. A script that loads does not prove the company pays for the service.

AI product specifics

For an AI startup, the visible stack rarely reveals the model provider. API calls usually go through the company's own backend, so you will see a front end and analytics but not which model powers the product. Do not claim to know what is under the hood from the front end alone.

Turning detection into decisions

Collect the data, then ask what it means.

• Compare ten competitors. Which front-end approach and hosting setup do the fastest sites share? Which analytics and marketing tools do the biggest players use?
• Match stack to traffic. Combine the stack with traffic estimates from the top traffic rankings to see which choices correlate with growth. Correlation is not cause, but patterns can inspire experiments.
• Spot gaps. If rivals use heavy third-party widgets and score poorly on speed, a lean site could be a competitive advantage. The SEO audit checklist shows how to evaluate your own pages.
• Plan outreach. If you sell to companies using a specific platform, build a list and tailor the message to that platform.

Ethics and legal points

Reading public signals is normal. Do not attempt to access private systems, bypass authentication or scan for vulnerabilities without permission. Respect the terms of any tool you use, and do not use detected contact data to send spam.

FAQ

Can I detect a website's technology for free?

Yes. Page source, browser developer tools and a DNS lookup cover many basics at no cost. Free versions of detection tools and the StartupsIntel traffic checker can speed this up.

How accurate is tech stack detection?

It is good for visible front-end technologies, and weaker for back-end systems. Treat the output as a strong clue, then confirm the important points by hand.

Can detection tell which AI model a startup uses?

Usually not. Model calls generally happen on the server, so the front end does not reveal the provider. Only public documentation or the company's own statements can confirm that.

Is it legal to check what a competitor uses?

Looking at publicly served pages and headers is common practice. Avoid anything that involves unauthorized access or violates a site's terms.