Online CMS detector

>

Enter a website address to find out which CMS it runs on. If an outdated version is visible, it is time to update: old CMS versions get hacked the most.

How the CMS detector works

The detector downloads the page and looks for the traces a site engine leaves behind: the generator meta tag, typical paths such as /wp-content/, platform-specific script and file addresses, and server headers like X-Powered-By. It recognises WordPress, Joomla, Drupal, OpenCart, PrestaShop, 1C-Bitrix, MODX, Shopify, Wix, Tilda, Squarespace and Webflow.

If the generator tag includes a version number, the result shows it. That is the main reason to run the check on your own site: a visible old version tells attackers exactly which known vulnerabilities to try.

How to read the result

  • This site is built with: the platform that was found and, if published, its version.
  • Version: shown only when the site publishes it in the generator tag. Many sites hide it, so no version does not mean the site is up to date.
  • Web server and X-Powered-By: the server software and sometimes the PHP version. Showing them is harmless on an updated server and useful to attackers on an old one.
  • CMS not detected: a custom-built site, a rare platform, or one that hides its traces.

Related errors and guides

Frequently asked questions

Should I hide my CMS version?
It is a good habit, but not real protection: scanners identify versions by files and behaviour anyway. Keeping the CMS, plugins and themes updated is what actually protects the site.
Why was my WordPress site not detected?
Some security and optimisation plugins remove the generator tag and rewrite file paths. The site may also be served as static pages from a cache or built as a headless front end.
Can it detect plugins and themes?
No, it only identifies the platform and the version it publishes. Detecting plugins requires probing many paths on the site, which this tool deliberately does not do.