marvelapp.com

Tech-stack detection is forensic work applied to publicly visible signals — not guesswork not database lookups and not active probing of private paths. com and inspect five independent evidence channels simultaneously.

First HTTP response headers: Server X-Powered-By Via Set-Cookie naming patterns and the origin hostnames referenced in Content-Security-Policy directives each leave distinct fingerprints for the hosting layer and any middleware.

Second the rendered DOM: class-name conventions (for example Tailwind's utility-first prefixes or Bootstrap's component classes) bundler-generated asset manifest paths and inline data attributes added by specific frameworks.

Third external script and stylesheet origins: the CDN domain serving your JavaScript bundles third-party tag managers analytics libraries and chat widgets all have recognisable URL patterns. Fourth HTML meta tags: and are added by most CMSes and site builders. Fifth JavaScript globals: framework-specific window properties and module identifiers exposed in the initial render without authentication.

Confidence varies by signal Server: cloudflare or Server: nginx header is a high-confidence detection; inferring a frontend framework from a single ambiguous CSS class name is medium confidence. We label uncertain detections accordingly.

Tech-stack fingerprints serve three distinct professional audiences each with a different read on the same data. Competitive intelligence teams use stack information to understand a rival's performance ceiling infrastructure costs and migration risk.

Knowing that a competitor is on a specific CMS with a given CDN and a particular analytics platform tells you what their engineering bottlenecks are what a platform migration would cost them in time and money and which vendors they are committed to. That context is more strategically useful than traffic estimates alone.

Sales and account-qualification teams use the same fingerprint to size an account before the first call: a domain running a templated site builder with a consumer-tier analytics tag and a shared-hosting server signature patterns to an SMB self-serve prospect; a domain on an edge-runtime frontend framework with a headless CMS a data-warehouse analytics pipeline and a Datadog or New Relic performance monitor patterns to an engineering-forward team with enterprise-tier budget.

Security and compliance teams care because every detected component is simultaneously a dependency in the supply chain: your CMS has its own vulnerability history. com is a third-party script executing in your visitors' browsers each with its own trust boundary.

Teams that can enumerate their third-party surface in minutes rather than hours consistently answer security disclosures SOC 2 audit questions and GDPR data-mapping exercises faster than those who need to reverse-engineer their own stack each time.

The scope of this report is deliberately limited to publicly visible unauthenticated signals — and that boundary is a feature not a gap. We don't enumerate CMS admin paths (no /wp-admin probing) don't attempt plugin or theme enumeration don't scrape version numbers from error pages and don't perform any active vulnerability scanning.

That line separates a public fingerprint from a security assessment; anything on the other side of that line requires explicit authorisation and is out of scope for a passive public-facing report.

What this report doesn't cover that complementary tools do: JavaScript bundle composition and third-party script performance impact (use the Speed checker) broken or redirect-looping internal links (Broken Links checker) security header coverage (HTTP Headers and CSP checker) and the SSL/TLS configuration that underpins all of the HTTPS signals we rely on for detection (SSL checker).

com after major changes — a CMS upgrade a CDN cutover an A/B testing platform swap — and diff the two snapshots side by side. A quietly added third-party tag or a replaced frontend framework that slips past code review will surface clearly in a before-and-after comparison.

A tech-stack report is most valuable as an input to a workflow rather than a standalone data point.

com against two or three rivals in the same category and read the deltas — a competitor on an edge-rendered framework with a headless CMS and a server-side analytics pipeline has a different performance ceiling engineering cost structure and competitive moat than one on a monolithic CMS with client-side tag management.

The choice of experimentation and personalisation tooling in a competitor's stack is also a signal: teams running full-stack experimentation platforms are typically more data-driven in their product decisions than teams with only a basic analytics script. For sales and partnerships: the stack fingerprint qualifies an account before the first call and informs the pitch angle.

A domain on infrastructure that signals engineering maturity will respond to a different sales motion than one on a consumer site builder and knowing this before the discovery call is a meaningful efficiency gain. For internal governance and security: run this report on your own domain and treat every detected component as a line item in your software bill of materials.

Each detected library CDN analytics platform and chat tool carries its own CVE feed patch cadence and data-processing agreement — the teams that enumerate this surface systematically are the ones that answer a vulnerability disclosure or a GDPR data-subject request in hours rather than scrambling for days.

com on a regular schedule — quarterly is usually sufficient for fast-moving teams — and compare captures over time. Platforms accumulate third-party tags silently as each team adds their own tool without removing anything and a scheduled tech-stack diff is one of the cheapest ways to catch that before the page weight and privacy surface grow unmanageable.