CMS Identification Guide
This guide shows you how to identify the CMS, e-commerce platform, framework, web server, CDN, and analytics behind any website by reading its own page source. Enter a URL and you get the exact links, file paths, and header signatures to check in view-source and DevTools. Free, no signup.
Please enter a valid URL
Couldn't build the investigation
Check the URL format and try again.
The theStacc CMS Identification Guide teaches you to read the content management system, e-commerce platform, framework, web server, programming language, CDN, hosting platform, and analytics stack straight out of a website's own page source. Enter any URL and you get the links to open, the three places the answer hides, and the fingerprint each major platform leaves behind — plus the six security headers worth checking while you are in DevTools. Nothing is fetched or detected for you: this is a reference you apply yourself, which is why it also explains why each signal means what it means. Built for SEO professionals, agencies, and business owners planning migrations, audits, or competitive research.
What Is a CMS and Why Does It Matter?
A Content Management System (CMS) is the software that lets you create, edit, and publish web pages without writing HTML by hand. Behind the scenes, it stores your content in a database, generates HTML when someone visits, and gives non-technical users a friendly editor for managing pages, blog posts, products, and media.
Knowing which CMS a website uses tells you a lot about how it operates. WordPress sites can be extended with plugins and themes, Shopify sites have a fixed e-commerce structure but easy storefront customization, Webflow sites give designers visual control without code, and custom-coded sites offer maximum flexibility but require developer time for every change. The CMS choice affects your SEO options, your content velocity, your hosting costs, and your migration difficulty.
For agencies, knowing a prospect's CMS upfront saves hours of qualification. For competitive researchers, identifying competitors' stacks reveals what tools are working in your industry. For business owners who inherited a website without documentation, reading the page source is often the fastest way to figure out what you actually own and what it would take to change anything.
How CMS Identification Works
Every CMS leaves fingerprints in the pages it generates. Some are intentional, like the <meta name="generator"> tag that WordPress, Drupal, and Astro add to identify themselves. Some are structural, like WordPress's /wp-content/ directory paths or Shopify's cdn.shopify.com asset URLs. Some are protocol-level, like Cloudflare's cf-ray header or Vercel's x-vercel-id.
A reliable identification aggregates many signal types: HTTP headers from the server response, cookies set on first load, meta tags in the HTML, recognizable markup patterns, the URLs of loaded scripts and stylesheets, and the hostname itself. Each signal contributes to a confidence score. A site that emits the WordPress generator meta tag, sets WordPress login cookies, AND links to /wp-content/ assets is almost certainly WordPress. A site with only one weak signal is "possibly" something but might be a false positive.
Modern frameworks like Next.js, Nuxt, Astro, and SvelteKit are detected via their build artifacts: directories like /_next/static/, /_nuxt/, /_astro/, and global JavaScript variables like __NEXT_DATA__ or __NUXT__. CDNs and hosting platforms surface in custom HTTP headers that they always set on every response.
What You Can Do With This Information
Plan a migration: If you discover a prospect runs WordPress, you know they can move to a different host with a couple of plugins and a few hours of work. If they run Webflow, migrating means rebuilding from scratch — a different conversation entirely. Quoting accurately starts with knowing what you are quoting against.
Diagnose SEO issues: Some CMS configurations have known SEO weaknesses. Default Wix sites historically had limited control over meta tags. Some Shopify themes auto-generate canonical tags incorrectly. Knowing the platform tells you which checklist to run and which specific gotchas to look for.
Compete more intelligently: If your top competitor ranks well on Shopify, that tells you Shopify SEO is strong enough to win in your niche — no need to over-engineer. If they run a Next.js stack with custom React components, that signals heavy engineering investment and a different competitive playing field.
Audit your own site: Sometimes the answer is "we don't actually know." A site you inherited, a project a former contractor built, a brand acquisition with no docs. Reading the source is the fastest way to start mapping what you own and where to invest next.
How This Guide Compares to Detection Tools
| Feature | theStacc | Wappalyzer | BuiltWith | What CMS |
|---|---|---|---|---|
| Price | Free | Freemium | Paid ($295+/mo) | Free |
| Detects the stack for you | No — you read the signals | Yes | Yes | Yes |
| Signup required | No | No (extension) | Yes | No |
| Browser extension needed | No | Yes | No | No |
| Explains why each signal means what it does | Yes | No | No | No |
| Security headers covered | Yes — 6, with what each does | No | No | No |
| Historical stack data | No | Limited | Yes | No |
| Copy checklist to clipboard | Yes | No | Yes | No |
Use Cases by Role
SEO Agencies & Consultants. Before pitching a prospect, spend a minute in their page source. If they are on WordPress with Elementor, you know exactly which plugins to recommend and what SEO limitations to address. If they are on Shopify, you know the URL structure constraints and which apps handle SEO. This intel turns generic pitches into specific, credible proposals that close faster.
Web Developers & Freelancers. When inheriting a project with no documentation, the page source and response headers reveal the entire stack in a minute. Is it a custom Next.js app on Vercel? A WordPress site on shared hosting? A Webflow site that the client wants migrated? Knowing the full tech stack — including the CDN, analytics, and marketing tools — lets you scope projects accurately and avoid nasty surprises mid-build.
Marketing Teams. Discover which tools your competitors use for analytics, marketing automation, and conversion tracking. If a competitor uses HubSpot, Hotjar, and Intercom, they are running a sophisticated inbound marketing operation. If they use only Google Analytics, there is an opportunity gap. Use this intelligence to benchmark your own martech stack and justify budget for missing tools.
Business Owners. If you inherited a website from a former employee, contractor, or acquisition, you may not know what platform it runs on or how to update it. The fingerprint list tells you where to look. It also covers security headers, which matter for compliance and customer trust. A site missing basic security headers signals neglect — something to address before it becomes a liability.
Investors & Acquirers. Due diligence on digital assets starts with understanding the tech stack. A SaaS company running on a modern Jamstack framework signals engineering maturity. An e-commerce site on a deprecated Magento version signals technical debt and migration risk. The public page source gives you this in a minute, without needing access to the company's internal systems.
CMS Choice and SEO Performance
All major CMSes can rank well on Google if configured correctly, but each has different default strengths and weaknesses. WordPress with a good SEO plugin (Yoast or RankMath) gives you full control over titles, descriptions, schema, redirects, sitemaps, and crawl directives — at the cost of having to maintain plugins and updates. Shopify handles e-commerce SEO well by default but limits control over URL structure and some technical SEO features.
Webflow gives designers strong control over on-page elements and clean code output, but its CMS collections have caps on item counts and some operations require manual export. Wix has improved SEO significantly in recent years with full control over titles, descriptions, structured data, and sitemap. Squarespace handles basic SEO well out of the box but offers fewer technical controls than WordPress for advanced cases.
Modern Jamstack frameworks like Astro, Next.js, and SvelteKit produce extremely fast, well-structured sites that rank well on technical merit but require developer involvement for content changes. Headless CMS setups (Contentful, Sanity, Strapi powering a custom frontend) combine flexible authoring with custom-built frontend SEO, but cost more to build and maintain.
Frequently asked questions
It means working out which content management system, e-commerce platform, framework, web server, and other technologies power a website, by reading the fingerprints those tools leave in HTTP headers, HTML markup, cookies, meta tags, and script URLs. People do it to plan migrations, diagnose SEO issues, research competitors, or audit a site they inherited without documentation.
Enter a URL and the page builds you a short investigation: direct links to that site and its robots.txt, the view-source and DevTools steps that expose its response headers, and a reference of the fingerprints each major platform leaves behind. You do the looking — the page does not fetch the site, run any detection, or return a result for you.
Automatic detection needs a server that fetches the page on your behalf, and this page has none. Rather than show you a guess dressed up as a result, it hands you the same signatures a detector would use. Reading them yourself takes about a minute per site and you can see exactly why the answer is what it is — which matters when a site is customised enough that automated tools disagree.
CMS platforms (WordPress, Drupal, Joomla, Ghost, TYPO3, Wix, Squarespace, Webflow, Weebly, Duda), e-commerce platforms (Shopify, WooCommerce, Magento, BigCommerce, PrestaShop, OpenCart), modern frameworks (Next.js, Nuxt, Gatsby, Astro, Remix, SvelteKit), web servers (Nginx, Apache, IIS, LiteSpeed), programming languages (PHP, Node.js, Ruby, Python, ASP.NET, Java), CDNs (Cloudflare, Fastly, Akamai, CloudFront), hosting platforms (Vercel, Netlify, Heroku, Render), analytics tools (Google Analytics, Plausible, Mixpanel, Hotjar), marketing platforms (HubSpot, Mailchimp, Intercom), page builders (Elementor, Divi, WPBakery), and CSS frameworks (Bootstrap, Tailwind, Material UI).
A few reasons: the site may be a static HTML build with no CMS at all (common for portfolio sites and landing pages), the CMS may strip its identifying headers and meta tags for security, or it may use an uncommon platform with no distinctive fingerprint. Try a different page on the same domain — homepages are often hand-built while blog and product pages still show the platform underneath.
Partly. Page builders like Elementor, Divi, and WPBakery leave obvious CSS class prefixes in the markup, and themes usually appear in the /wp-content/themes/theme-name/ paths of their stylesheet URLs. Plugins are harder — many load assets from /wp-content/plugins/plugin-name/, so searching the page source for that path lists most of them.
Wappalyzer is a browser extension that inspects pages as you browse, and BuiltWith is a paid lookup service with a large historical database — both actually perform detection, which this page does not. Use them when you need an answer at scale. Use this guide when you want to understand the signals yourself, or you are on a machine where you cannot install an extension.
Yes, 100% free with no signup. Everything runs in your browser and there are no limits.
Security headers are HTTP response headers that tell browsers how to handle your website securely. The six we check are Strict-Transport-Security (forces HTTPS), Content-Security-Policy (prevents XSS attacks), X-Frame-Options (prevents clickjacking), X-Content-Type-Options (prevents MIME sniffing), Referrer-Policy (controls referrer data), and Permissions-Policy (restricts browser features). Missing security headers do not directly affect SEO rankings, but they signal site maturity and protect your visitors. Google has indicated that site security is a minor ranking factor.
Knowing your competitors' tech stacks reveals strategic intelligence. If your top competitor ranks well on Shopify, that tells you Shopify SEO is strong enough to win in your niche. If they run a Next.js stack with custom React components, that signals heavy engineering investment. If they use HubSpot for marketing automation, they likely have a dedicated marketing team. This intelligence helps you benchmark your own investment, identify platform-specific SEO opportunities, and choose the right tools for your own stack.
Free tools are great. Automation is better.
Detecting a CMS is free. theStacc publishes SEO-ready posts straight into WordPress for you.
Sign up for free →