How to Find Out What CMS a Site is Built On
Identifying the CMS answers the question "what is the site built on". This rarely concerns your own site, but is constantly relevant when analyzing competitors, evaluating someone else's project before purchase, or preparing for an audit. You can check it using the CMS detector.
How It Is Determined
The tool looks for characteristic traces: paths to themes and plugins, meta-generator, cookies, server headers, typical admin panel addresses, and files of specific engines. Therefore, the result is a probability, not a passport: a well-configured site hides traces, while constructors are immediately visible.
Why This Matters in Practice
- Assess labor costs. Edits on a constructor and a custom engine cost differently.
- Understand limitations. Some constructors do not allow changing meta-tags and robots.txt — this is important to know before starting work.
- Check security. A well-known CMS with an outdated version is a common cause of hacks, see Shield.
- Understand someone else's project before purchase or handover for work.
What the Engine Often Reveals
| Feature | What It Indicates |
|---|---|
Paths like /wp-content/, /bitrix/, /local/ | Classic CMS with predictable structure |
| Meta-generator in the page code | Engine and sometimes its version — it's better to hide the version |
| Server cookies and headers | Platform and caching settings |
| Static domains of the constructor | The site is built on a constructor, edits are limited by its capabilities |
Should the Engine Be Hidden?
Knowing the CMS itself does not harm anyone, but the engine version in plain sight is a hint for automatic vulnerability scanners. Removing the meta-generator and version from response headers takes a minute and reduces one reason for hacking.
What to Check Next
- robots.txt — is the site closed by the standard template of the engine?
- Meta-tags — template headers on all pages indicate an unconfigured CMS.
- Speed — heavy themes and unnecessary plugins are immediately visible.
- Response headers — the engine version in headers helps not you, but those looking for vulnerabilities.