CMS Detector: What CMS a Website is Using and the Best Tools to Find Out
Reading time: 9 minutesWhether you're an online marketer doing market research, a developer, a security researcher or an SEO specialist, you must have asked yourself the question 'what CMS is this website using?' Or maybe you find yourself simply wanting to build a website—and you're interested in knowing which technology works best for different types of projects.
Whatever the reason behind finding out which CMS or website builder a website is based on, there are different ways to perform this task, from using specially designed CMS detector tools, to looking into the source code from the browser, to still others. Today, we'll explore what a CMS is and what the best online CMS detector tools are, to find out which one a website is using.
What is a CMS?
A CMS, or Content Management System, is a software that is used to build, manage and modify a website and its content. It's the best option for a less technical approach to website building, which doesn't require you to write the code for the website.
The content management system consists of two parts: a content management application or CMA; and content delivery application, the CDA. The CMA is the part you use to add and manage content on the website, the frontend interface; it's the part where other users can manage the content easily. In contrast, the CDA is the backend interface, where the content is stored and uploaded to the website.
Some of the most popular CMS examples are:
- WordPress
- Joomla
- Kinsta
- Magento
- Drupal
- Shopify
- Squarespace
- Wix
Detecting a CMS is an important part of any reconnaissance process; once you discover what CMS a target website is using, you can then perform vulnerability scanning. If, for example, it's a WordPress site, you can attempt to exploit known WordPress security vulnerabilities.
What CMS is this site using?
Detecting a CMS can be done many different ways, some slightly easier and quicker than others. It's simple to detect some of the most popular CMSs like WordPress, Joomla and Shopify but as there are many more platforms you should consider, it can get difficult using the basic checking in source code.
Before we dive into some specific CMS detector tools, let's explore some traditional ways of finding out which CMS a website is based on:
There are some obvious signs that a website owner hasn't removed, which could tell you the CMS they used:
- "Powered by": Some websites might have a "Powered by" logo followed by the name of the CMS in their footer
- In the browser tab, there could be a favicon of the CMS (Joomla sites often have this favicon)
Since many website owners customize their website and do remove these tell-tale signs, you can also check their source code directly from your browser:
- A somewhat more timely option would be to use the "Find on page" shortcut and type in the names of the CMSs, which works well for Squarespace and WordPress (wp).
- Head tag might be your friend. There, search for the <meta name="generator" ...> tag or x-powered-by header which will be followed by the CMS.
- Sometimes the generator tag is removed, so another option would be to type in some directories or tags specific for each CMS. For a WordPress website, "wp-content" or even just type in WordPress; Joomla will have a word "com_content" in their internal links; and Drupal will be "/sites/" or "/core/" folders, depending on the version.
All of these steps, besides being time consuming, aren't that reliable—developers will often remove these tags or customize them to conceal the CMS they are using. Also, if they are not using any CMS it will take plenty of separate searches before you realize you were only shooting in the dark. This is where automated online CMS detector tools come to your rescue.
Top 10 online CMS detectors
There are many CMSs you can use to build a website and there are also many CMS detector tools that help you find out about them. CMS detectors can even be paired with a vulnerability scanner to further your infosec investigation. We tested the most popular ones to give you a list of the 10 best online CMS detector tools available that help you answer the question: What CMS is this website using?
1. Wappalyzer
Wappalyzer is likely one of the most popular technographics data providers covering the industry, counting 1,000,000+ downloads at the Chrome Store, with a rating of 4.6 out of 5 stars from 1,780 users.
Its native integration with Chrome and Firefox browsers makes Wappalyzer highly accessible, providing an easy, instantaneous way to detect any software running on content management systems, ecommerce platforms, customer relationship management, marketing tools, and much more. Once you’ve installed Wappalyzer, it will be bookmarked in the search tab. Then, when you go to a website you want to inspect, simply click the Wappalyzer button to reveal everything behind the CMS, web analytics, OS, programming languages or database.
Along with the free browser extension, they also offer 50 free credits to be used with their premium services such as: Online Lookup, Bulk Lookup, API and Datasets. After using those free credits, it's likely you'll have to purchase any of their premium packages to continue using their services.
To recap: one of the best solutions, includes free and paid options. For us, the infosec guys, a downside is that it's geared towards marketing tools; on the other hand, a big upside is that they have the CPE names in their definitions file on GitHub, which can be used to identify vulnerabilities.
2. BuiltWith
We love BuiltWith because it shows the most thorough outline of the technologies a website uses. You simply need to input the URL of the target website and it will show you numerous technology details including the CMS + CND, analytics, used widgets, frameworks, hosting provider, SSL certificates and much more.
The reason it takes second place is because you do need to scroll through a large data list to find all the relevant information. However, it also has a feature that compares technology information with industry trends, in a pie chart:
3. What CMS?
The creators of this website provide one of the best and most reliable CMS detector tools out there and it's all thanks to a minimal design that gives you exactly what its name implies: the CMS a website uses and additional information on the programming language, database OS and server. They are currently able to recognize 492 CMSs and are constantly updating their database to include even more.
4. W3Techs
This highly reliable online CMS detector provides a comprehensive list of technologies on the target website. Simply navigate to the W3Techs "Sites" page and enter the URL.
From there, you'll be able to access information on the CMS, programming languages, libraries, SSL, hosting provider, OS, TLD, geo location and much more.
It also offers installation as a bookmarklet, so you don't even have to visit their website every time you need information on the websites you're investigating.
5. Allora / Rescan.io
Allora.io has been integrated into Rescan, but its features remain the same. It's a trusted online detector that provides a free email analysis and lists out the CMS, framework, servers, OS, programming language, hosting provider, geo location, and more.
It's easy to use. All you need is the website URL and with that, you can get all the related basic website technologies.
6. CMS Detector
This website is a well-known, straightforward online detector that will give you information about the CMS. It's the quickest ways to do so if you don't need any additional data.
Once you go to the website, simply type in the website URL, press Enter, and the results are there. While it's not 100 percent reliable and it doesn't offer any technology information, it's a speedy, handy tool when you're searching for the most well-known CMSs.
7. Netcraft Site Report
Netcraft Site Report will give you a wide range of information about the target website including the CMS, network information, hosting providers, SPF, DMARC, and other site technologies.
Other entries on this list may be more reliable, but it's one traditional tool that can come in handy.
8. Scan WP
Continuing with theme detectors, Scan WP really does provide the most knowledge on WordPress themes available, and can detect almost any plugin used on a WP website. It’s an innovative WordPress theme detector as it offers highly interesting theme information, including the standard theme name, version, and used plugins, but goes even further to provide a screenshot of the theme, theme and plugin price, tags, theme vendor, and the percentage of plugin and theme usage. Scan WP also displays information about the site including domain information, competitor intel, keywords the website ranks for, and backlink overview.
9. IsItWP
IsItWP is, just as the name says, a CMS detector focused on information about WordPress-based websites. As WordPress and its themes and plugins can often be vulnerable to threats, checking which ones a site runs can help in preventing malicious access to the website and its data. IsItWP can provide you with details on WP websites such as the used theme, plugins and hosting. It’s an easy-to-use tool that detects whether a website is using WordPress and allows you to get basic information about it.
10. What WordPress Theme Is That
Despite its long name, What WordPress Theme Is That (or WordPress Theme Search) is a pretty straightforward but, as they claim, advanced CMS and theme detection tool. Again contrary to its name, WWPTIT is compatible with platforms beyond WordPress, including Shopify, Drupal, and many others. The tool gives you more detailed information than IsItWP about the theme, the URL, author, author info, theme version, description and more.
Conclusion
There are many reasons you might need to know foundational technologies behind a website and including it in your reconnaissance process can be of great value. Specific CMSs have known vulnerabilities you might want to test, and online CMS detector tools are the fastest, most reliable ways to do so.
You might be old school and want to do it manually, but we're sure that using these free online tools, or cross-referencing a couple of them with your manual search, will yield the best results.
If you're ready to take a deeper dive and discover the entire external internet surface of your website or a target website, try out our SurfaceBrowser™. Schedule a demo with our sales team to see all the features, information and security SurfaceBrowser™ can offer!
