Identify technology on websites

Wappalyzer is a cross-platform utility that uncovers the technologies used on websites. It detects content management systems, ecommerce platforms, web frameworks, server software, analytics tools and many more.

Developer Documentation


Contributing

Wappalyzer is open-source. Anyone who wishes to contribute is welcome to do so! Wappalyzer has been improved by hundreds of people over the years.

Getting started

To get started, install Git and Docker on your system. This will allow you to install and run the Wappalyzer development environment which comes bundled with the required tools.

Next, create a fork of the Wappalyzer repository on GitHub, clone it and execute ./run links in Bash.

$ git clone https://github.com/<your_github_username>/Wappalyzer.git
$ cd Wappalyzer
$ ./run links

Drivers

Wappalyzer is a cross-platform application, written in JavaScript. Platform specific code can be found in src/drivers. Shared functionality is contained within src/wappalyzer.js.

To test your local changes in a browser, refer to the links below. The extension files are located in src/drivers/webextension.

Installation and usage instructions for NPM and Docker can be found on the download page.

Submitting changes

When you're done making changes, run ./run validate. If no errors are reported, push your commits to a new branch on your own repository.

Finally, open a pull request on the Wappalyzer repository. If the automated checks or members of the community report any issues, please resolve them or your pull request may get rejected.

Adding a new application

To add a new application, edit src/apps.json and add a square icon to src/icons (preferably an SVG file, otherwise a 64x64 or 32x32 PNG file).

Only widely used applications should be added. When creating a pull request, please include ten or more links to websites that use the application, a GitHub page with at least 1,000 stars or anything that will help establish the size of the user base.

Wappalyzer uses regular expressions to fingerprint web applications. Refer to the specification for more detail.

Adding a new category

Please open an issue on GitHub first to discuss the need for a new category. To add one, edit src/apps.json and update the translations (it's acceptable to include the English string in any or all of them).

Adding a new translation

To add a new translation, copy the en folder in src/drivers/webextension/_locales, rename it to the relevant two-letter country code and update the containing messages.json.

Adding a new feature

Please open an issue on GitHub first. New features and large changes are rarely accepted without prior discussion.



Specification

A long list of regular expressions is used to identify technologies on web pages. Wappalyzer inspects HTML code, as well as JavaScript variables, response headers and more.

src/apps.json

Patterns (regular expressions) are kept in src/apps.jon. The following is an example of an application fingerprint.

Example

"Application Name": {
  "cats": [
    "1"
  ],
  "env": "ApplicationName",
  "excludes": "Other Application Name"
  "headers": {
    "X-Powered-By": "Application Name"
  },
  "html": "<link[^>]application-name\\.css",
  "implies": "PHP\\;confidence:50",
  "meta": {
    "generator": "(?:Application Name|Alternative Application Name)"
  },
  "script": "application-name-([0-9.]+)\\.js\\;confidence:50\\;version:\\1",
  "url": ".+\\.application-name\\.com",
  "website": "https://example.com",
}

JSON fields

Find the JSON schema at schema.json.

Properties (required)

Field Type Description Example
cats Array One or more category IDs.

Search for "categories" in src/apps.json to find the complete list.
[ 1, 6 ]
icon String Application icon filename. "WordPress.svg"
website String URL of the application's website. "https://example.com"

Implies and excludes (optional)

Field Type Description Example
implies String | Array The presence of one application can imply the presence of another, e.g. WordpPress means PHP is also in use. "PHP"
excludes String | Array Opposite of implies. The presence of one application can exclude the presence of another. "Apache"

Patterns (optional)

Field Type Description Example
env String | Array Global JavaScript variables.

Members of the window object only; "^jQuery.fn$" won't work. Avoid short patterns to prevent matching minified code.
"^jQuery$"
headers Object HTTP response headers. { "X-Powered-By": "^WordPress$" }
html String | Array HTML source code.

Patterns must include an HTML opening tag to avoid matching plain text.
"<a [^>]*href=\"index.html"
url String Full URL of the page. "^https?//.+\\.wordpress\\.com"
meta Object HTML meta tags, e.g. generator. { "generator": "^WordPress$" }
script String | Array URLs of JavaScript files included on the page. "jquery\\.js"

Patterns

Patterns are essentially JavaScript regular expressions written as strings, but with some additions.

Quirks and pitfalls

  • Because of the string format, the escape character itself must be escaped when using special characters such as the dot (\\.). Double quotes must be escaped only once (\"). Slashes do not need to be escaped (/).
  • Flags are not supported. Regular expressions are treated as case-insensitive.
  • Capture groups (()) are used for version detection. In other cases, use non-capturing groups ((?:)).
  • Use start and end of string anchors (^ and $) where possible for optimal performance.
  • Short or generic patterns can cause applications to be identified incorrectly. Try to find unique strings to match.

Tags

Tags (a non-standard syntax) can be appended to patterns (and implies and excludes, separated by \\;) to store additional information.

Tag Description Example
confidence Indicates a less reliable pattern that may cause false positives. The aim is to achieve a combined confidence of 100%. Defaults to 100% if not specified. "env": "Mage\\;confidence:50"
version Gets the version number from a pattern match using a special syntax. "script": "jquery-([0-9.]+)\.js\\;version:\\1"

Version syntax

Application version information can be obtained from a pattern using a capture group. A condition can be evaluated using the ternary operator (?:).

Example Description
\\1 Returns the first match.
\\1?a: Returns a if the first match contains a value, nothing otherwise.
\\1?a:b Returns a if the first match contains a value, b otherwise.
\\1?:b Returns nothing if the first match contains a value, b otherwise.
foo\\1 Returns foo with the first match appended.