Every website leaves fingerprints. The code a browser downloads, and the way a server responds to it, quietly reveal which content management system a site runs on, who hosts it, what plugins and analytics it uses, and more. A handful of free tools read those fingerprints for you.
This is useful well beyond curiosity. You can check whether a competitor hosts locally or offshore, audit your own site for slow or forgotten third-party scripts, or research the setup behind a site you admire before you build your own. This guide covers the tools, what they can and can’t tell you, and how a New Zealand business can put the information to work.
The tools worth knowing
There are two broad kinds. Server-side profilers like BuiltWith crawl the web on a schedule and store what they find in a searchable database — so they can show you a site’s history and let you search for every site using a given technology. Browser extensions like Wappalyzer detect live, on the page you’re looking at right now. Each suits a different job.
Tools for checking a site’s tech stack
Features and pricing change often — check each tool’s own site before relying on it.
| Tool | Best for | Free? |
|---|---|---|
| BuiltWith | Full profiles, historical stack changes, bulk lead lists | Free lookups + extension; paid for bulk/API |
| Wappalyzer | Quick live checks while browsing | Free extension; paid tiers for lookups/API |
| WhatRuns | WordPress themes and active plugins | Free extension |
| W3Techs | Market-share and adoption trends, not single sites | Free |
| Netcraft | Server, hosting provider and SSL detail | Free lookup and extension |
BuiltWith works from a scheduled crawl (cached data with history); a browser extension like Wappalyzer detects live as you browse.
BuiltWith is the most established of these. It builds a full technology profile of a domain — CMS, hosting, CDN, analytics, payment platforms and more — and keeps a historical record, so you can see when a site changed platforms or hosts. Its free lookups and browser extension cover individual checks; its paid tiers are built for sales teams pulling bulk lists of every site using a given tool, which is where most of its cost sits.
Wappalyzer is the quickest way to check a single site while you browse — a free extension that shows the stack in a click. WhatRuns is another free extension, particularly good at naming the exact WordPress theme and active plugins on a site. W3Techs is different again: rather than profiling one site, it reports market-share and adoption trends across the web, which is useful for spotting where the whole market is heading. Netcraft leans toward the server side — hosting provider, web-server software and SSL detail — and is strong for infrastructure checks.
For most people, a free browser extension plus the occasional BuiltWith lookup covers everything.
What a lookup can — and can’t — reveal
What a tech-stack lookup can show you
All from what a browser sees — front-end code and server responses.
| Layer | What it reveals |
|---|---|
| Platform | CMS (WordPress, Shopify, etc.), and often the theme and visible plugins |
| Hosting | Hosting provider, web server (Nginx, LiteSpeed), CDN, SSL certificate |
| Scripts | Analytics, tag managers, ad pixels, chat widgets and other third-party tags |
| History | On BuiltWith, how the stack has changed over months or years |
The limit: these tools see front-end signatures, not your database, custom backend code or anything server-side that isn’t exposed to the browser.
The important caveat is that all of these tools read what the browser can see: front-end code and server responses. They’re accurate for visible technologies — the CMS, JavaScript frameworks, analytics tags, the web server and CDN. They can’t see your database, your custom backend logic, or anything server-side that never reaches the browser. Detection of deeply hidden or bespoke systems is patchy, and cached profilers like BuiltWith can lag behind a site that changed its stack last week. Treat the output as a strong indication, not a guarantee.
Putting it to use as a New Zealand business
The data is only worth gathering if it changes a decision. A few genuinely useful applications:
Practical uses for a New Zealand business
- Check a competitor’s hosting. If rivals sit on overseas servers and you host locally, that’s a real latency advantage for Kiwi visitors.
- Audit your own third-party scripts. Spot leftover “zombie” tags and pixels — they slow the site and complicate your Privacy Act obligations.
- Research a host before switching. See what platform and web server a site you admire runs on before you commit.
- Diagnose a slow page. A long list of analytics and chat scripts is often the reason a site’s Core Web Vitals lag.
- Spot outdated software. An old web-server version flagged on your own site is a prompt to talk to your host.
Two of these are worth expanding on for a local audience.
Hosting and latency. One of the more revealing things a lookup shows is where a site is hosted. If the competitors ranking above you all sit on servers in Sydney or the US while you’re on New Zealand hosting, you have a genuine speed advantage for local visitors — data has less distance to travel. If the reverse is true, it’s a prompt to look at your own setup. Just remember server location is one modest factor among many, not a magic ranking lever.
Third-party scripts and privacy. A lookup lists every analytics tag, ad pixel and chat widget on a page. On your own site, that list is worth auditing for two reasons. First, forgotten “zombie” scripts from old campaigns slow the site down — third-party code is one of the most common drags on Core Web Vitals. Second, under the Privacy Act 2020 you’re responsible for knowing what data your site collects and shares; a script you don’t recognise is one you need to investigate or remove, and your privacy policy should reflect what’s actually running.
Where it fits in a bigger picture
Technology detection answers “how is this site built,” not “why does it rank” or “what does it earn.” Pair it with a keyword or backlink tool and it becomes more useful: if a competitor consistently outranks you, a lookup can show whether a faster host, a lighter framework or a better CDN is part of the reason — a concrete, fixable lead rather than a guess.
For your own site, the most valuable habit is the occasional self-audit: run a lookup, and if it surfaces an outdated web-server version, a pile of redundant scripts, or a plugin you no longer use, you’ve got a short, practical list of things to clean up. Fast, lean and current is the goal, and these tools make the gap between that and your current state visible. Once you know what needs to change, solid WordPress hosting and a tidy plugin set do most of the rest.
This article is provided for factual and informational purposes only. It does not constitute professional advice, and it is not a recommendation to use any particular tool. Tool features, free-tier limits and pricing change frequently — check each provider’s current site before relying on it. For your Privacy Act obligations regarding third-party scripts and data sharing, consult the Office of the Privacy Commissioner or a qualified adviser.
Reference sources
- BuiltWith — Website technology profiler
- Wappalyzer — Technology lookup and browser extension
- WhatRuns — Free technology detection extension
- W3Techs — Web technology usage statistics
- Netcraft — Site report: server, hosting and SSL
- web.dev — Reducing the impact of third-party code
- web.dev — Core Web Vitals
- Office of the Privacy Commissioner — Privacy Act 2020
Frequently asked questions
What does a tool like BuiltWith actually show?
It reads the technologies a website exposes to a browser — the CMS (such as WordPress or Shopify), the hosting provider and web server, the CDN and SSL setup, and third-party scripts like analytics, ad pixels and chat widgets. BuiltWith also keeps a history, so you can see how a site’s stack has changed over time.
Is there a free way to check a website’s technology?
Yes. BuiltWith offers free individual lookups and a browser extension; Wappalyzer and WhatRuns are free browser extensions that detect a site’s stack live as you browse; and W3Techs is free for market-share and trend data. For most people, a free extension plus the occasional BuiltWith lookup is enough — the paid tiers are aimed at bulk lead-list generation.
Can these tools see my database or backend code?
No. They read front-end code and server responses — what a browser receives. They can’t see your database, custom backend logic, or anything server-side that isn’t exposed to the browser. Detection of hidden or bespoke systems is limited, so treat results as a strong indication rather than a complete picture.
Can I tell where a website is hosted?
Usually, yes. Most of these tools identify the hosting provider and often the data-centre region, plus the web-server software and SSL certificate. Netcraft is especially strong on this server-side detail. For a NZ audience it’s useful for seeing whether competitors host locally or offshore, which affects loading speed for local visitors.
Is it legal to check what a competitor’s site is built with?
Yes. These tools only read information a website already sends to any visitor’s browser — the same data your own browser receives when you load the page. Nothing is hidden or accessed without authorisation, so using them for competitive research is legitimate.
How can this help my site’s performance?
Run a lookup on your own site and it lists every third-party script loading on it. Forgotten analytics tags, old ad pixels and unused widgets are a common cause of slow loading and weak Core Web Vitals. Trimming the ones you don’t need speeds up the site and reduces what you have to account for under the Privacy Act.
Can these tools detect WordPress themes and plugins?
Often, yes — by recognising signatures those themes and plugins leave in a page’s code. WhatRuns is particularly good at naming the exact theme and active plugins. Detection isn’t exhaustive, though: plugins that leave no front-end trace may not show up.