How the technology check works

Websites leave fingerprints: a content management system names itself in a page tag, a script library carries its version in the file name, a server announces itself in a header. This check collects those signs to work out what your site runs on. The result feeds the vulnerability wave check and the known flaws check, and appears in your report as the technology your site uses.

What it reads

Only what other checks already fetched: the headers, cookies, page code, script addresses and meta tags of your home page and up to two linked pages. It makes no requests of its own.

The signs are matched against the open signature collection from the webappanalyzer project, which covers several thousand products, from WordPress and Shopify to script libraries and analytics tools. The report also lists the outside services whose scripts your pages load.

What it reports

• A software version shown in page content, for example <meta name="generator" content="WordPress 6.4.2"> or a script named jquery-3.4.1.min.js. A version number is not a flaw in itself, but it tells anyone exactly which known flaws to try. Versions in headers are reported by the security headers check instead.

Everything detected, with or without a version, is listed in the report's attack-surface section.

What it cannot see

• Software that leaves no public sign, which includes most server-side code and many plugins.
• Exact versions when the site hides them, which is good practice.
• Detection is based on patterns, so it can occasionally name a product that is not there, or miss one that is. A detection is a strong hint, not proof.

What to do with the result

Ask your developer to remove version numbers from generator tags and asset file names where the platform allows it (many WordPress security plugins have a setting for this), and, more importantly, to keep the detected software up to date.