How do I find out what a website is built with?

You can get most of it by reading the page: response headers, script URLs, cookie names, the JavaScript globals a bundle leaves behind, the meta generator tag. Each of those is a fingerprint, and a few hundred of them cover most of what the web runs on.

The part that reading the markup cannot give you is what actually ran. A tracking tag sitting in the HTML that never makes a network request is a tag blocked by consent or shipped and forgotten — a real difference if you are auditing a site rather than cataloguing it. Telling the two apart means executing the page in a browser and watching the requests.

A real run

{
  "urls": ["https://www.zendesk.com"],
  "includeEvidence": true,
  "includeThirdPartyDomains": true,
  "minConfidence": 50
}

{
  "A/B testing": ["Optimizely"],
  "Advertising": ["Google Ads", "LinkedIn Insight Tag", "Meta Pixel",
                  "Microsoft Advertising UET", "Reddit Pixel", "Xandr", "Google Floodlight"],
  "Analytics": ["Google Analytics 4", "Hotjar", "Segment"],
  "CDN": ["Cloudflare", "unpkg"],
  "CMS": ["Adobe Experience Manager"],
  "Consent management": ["OneTrust"],
  "Customer support": ["Zendesk"],
  "JavaScript framework": ["Next.js", "React"],
  "Marketing automation": ["Marketo"],
  "Monitoring": ["Sentry", "Datadog RUM"],
  "Programming language": ["Java"],
  "Security": ["Cloudflare", "Cloudflare Bot Management"],
  "Session recording": ["Hotjar"],
  "Static site generator": ["Next.js"],
  "Tag manager": ["Google Tag Manager"],
  "UI framework": ["styled-components"]
}

A list of names is easy to produce and impossible to check. So every detection carries what identified it — and whether it was seen only in the markup, or in the markup and on the wire:

{
  "name": "Cloudflare",
  "categories": ["CDN", "Security"],
  "confidence": 100,
  "version": null,
  "activeAtRuntime": false,
  "declaredInMarkupOnly": false,
  "sendsDataToThirdParty": false,
  "evidence": [
    { "type": "header", "source": "cf-ray: a3b987b458fb398b-IAD", "matched": "a3b987b458fb398b-IAD" },
    { "type": "header", "source": "server: cloudflare", "matched": "cloudflare" },
    { "type": "header", "source": "cf-cache-status: HIT", "matched": "HIT" }
  ],
  "evidenceCount": 3
}

{
  "name": "Google Analytics 4",
  "categories": ["Analytics"],
  "confidence": 100,
  "version": null,
  "activeAtRuntime": true,
  "declaredInMarkupOnly": false,
  "sendsDataToThirdParty": true,
  "evidence": [
    { "type": "resource",
      "source": "https://www.googletagmanager.com/gtag/js?id=G-FBP7C61M6Z&cx=c&gtm=4e69b1",
      "matched": "googletagmanager.com/gtag/js?id=G-",
      "seenIn": "markup and network" },
    { "type": "cookie", "source": "_ga (domain .zendesk.com)", "matched": "_ga" }
  ],
  "evidenceCount": 2
}

The same run listed the 58 third-party domains the page contacted, which is a different and often more interesting picture than the technology list: it includes the ad-exchange and data-broker endpoints that no fingerprint has a friendly name for.

What this does not do

• Versions only when the site exposes one. A version in a file name or a JavaScript global can be read; a CMS that says nothing about its version cannot be guessed at. Where it is unknown we return null, not a plausible number. (We learned this the hard way: a fingerprint that guessed produced “WordPress 23.9.1” on a site running 7.2.)
• Behind a CDN, the web server is usually invisible. Cloudflare, Fastly and CloudFront replace the Server header with their own, so webServer comes back null on most large sites. It is not a gap in the fingerprints; the information does not leave the origin.
• It loads one page, not the site. Checkout widgets, payment providers and review apps live on other pages and will not appear from a home page audit.
• Nothing is clicked — including the consent banner. That is what makes “which cookies are set before consent” a meaningful question to ask of it, and it also means anything that only loads after consent stays unseen.

What it costs

$0.05 per site loaded and analysed. A site that does not load, answers 4xx or 5xx, or puts up an anti-bot wall is not charged — those take browser time and produce nothing, so they are on us. Bare domains work: "shopify.com" without the scheme is accepted.