We send one GET from our server (following redirects safely), read the final response headers and up to 512 KiB of HTML, then show Configuration (six security headers, caching/delivery and page tags), SEO & Crawlability, Technology signatures, and - when WordPress context is detected - WordPress Plugins. No AI guesses and no crawl of every asset or sub-page.
Compathub requests the URL you enter with GET, follows up to ten redirects with the same safety rules as our other URL tools, then inspects the final response headers and the first portion of the HTML body (up to 512 KiB). The report includes selected security headers, caching/delivery fields, basic page metadata and fingerprint-based technology clues. Missing items in a partial scan do not prove they are absent from the full site.
Each finding includes a confidence level. Detected means a strong, specific signature (for example /wp-content/ or a GTM container script). Possible means a weaker hint that could appear on unrelated sites - treat it as a lead, not proof.
When WordPress evidence is present, a separate WordPress Plugins section looks for /wp-content/plugins/{slug}/ paths only in resource attributes (src, href, srcset on tags such as script, link, and img) for common plugins (SEO, builders, commerce, caching, security and forms). Paths mentioned in plain text, HTML comments, or inline script strings are ignored. That list is best-effort: renamed folders, must-use plugins, or assets loaded only after JavaScript runs may not appear. Missing plugins are not proof they are absent.
The SEO & Crawlability section runs nine checks on parsed HTML and the final response headers: page title, meta description, H1 count, canonical URL, robots directives (including X-Robots-Tag), viewport, Open Graph tags, JSON-LD blocks, and in-page attribute links to robots.txt or sitemap XML (those URLs are not fetched). Each check uses its own status - Pass, Warning, Info, or Unable - separate from technology Detected/Possible levels. If the body is compressed (Content-Encoding), HTML-based checks show Unable; if HTML was truncated to 512 KiB, some missing tags are reported cautiously for the scanned prefix only. This is not a full crawl, index-status check, or ranking prediction.
The six security headers in Configuration are a focused subset of what our dedicated Security Headers Checker reports on the same URL. For certificate expiry and issuer details, use the SSL Certificate Checker on the site hostname.
| Level | Meaning |
|---|---|
| Detected | Specific path, header or script URL strongly associated with the named technology. |
| Possible | Generic marker that may appear on sites using that stack - or coincidentally on others. |
The rule set focuses on widely used, fingerprint-friendly stacks - not every library on the web. Signatures are updated over time; absence of a match is not proof a site avoids that technology.
| Category | Examples |
|---|---|
| CMS & platforms | WordPress, WooCommerce, Shopify, Magento, BigCommerce, PrestaShop, OpenCart, Drupal, Joomla, Wix, Squarespace, Webflow, Ghost, TYPO3, Framer, Duda (fingerprint-based from public HTML - custom, headless or heavily cached sites may not match) |
| WordPress plugins | Yoast SEO, Rank Math, All in One SEO, SEOPress, Elementor, Beaver Builder, WPBakery, Divi Builder, WooCommerce, Easy Digital Downloads, WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, Wordfence, Solid Security, Contact Form 7, Gravity Forms, WPForms, Ninja Forms (src/href/srcset on resource tags only) |
| Frameworks & libraries | Next.js, Nuxt, React, Vue.js, Angular, jQuery, Bootstrap, Tailwind CSS |
| CDN, server & hosting | Cloudflare, Nginx, Apache, LiteSpeed, Vercel, Netlify (from response headers) |
| Analytics & tags | Google Tag Manager, Google Analytics (GA4 / legacy), Meta Pixel, Plausible, Fathom, Matomo, Microsoft Clarity, Hotjar, HubSpot |
Migration planning. Confirm whether a staging URL still serves WordPress assets before cutover.
Vendor review. See whether a partner site loads Google Tag Manager or Meta Pixel from the homepage HTML.
Competitive research. Compare which CDN or CMS fingerprints appear on a competitor’s public homepage - always treat “possible” hits as leads to verify.
After redirects. Pair with the Redirect Checker when the interesting content lives behind marketing redirects; the stack scan follows the same safe redirect rules and analyses the final response.
Latency checks. Use the Website Response Time Checker when you want total elapsed time and status on the final URL without downloading full HTML for signature matching.
Why only one page? Keeping the scan to a single response limits load on target sites and reduces SSRF risk. Deeper scans belong in dedicated security workflows.
Can I scan localhost? No. Private IP ranges, metadata hosts and Compathub itself are blocked.
Questions or missing signatures? Use the contact form. For TLS certificates, use the SSL Certificate Checker; for response headers, use the Security Headers Checker; for DNS, use DNS Lookup.