---
title: What CMS Is This Site Using? — Free Detector
slug: detect-cms
last_reviewed: 2026-06-30
author: editorial
source: LemAudit Free Tools
---

## Intro

You can usually tell what CMS a site runs in 5 seconds by viewing the source — but only if you know the fingerprints. This tool does that automatically and adds the seven things the Wappalyzer browser extension never shows you: the site's AI-bot policy, its agent-interface readiness, its DNS email auth, its server headers, its meta-tag preview, its analytics stack, and a confidence score for the CMS detection itself.

Everything runs in real time when you paste a URL. We fetch the live HTML, parse the response headers, fetch the site's `/robots.txt` and `/llms.txt`, and match the responses against a pattern library covering 60+ CMS platforms (WordPress, Shopify, Webflow, Wix, Squarespace, Ghost, Drupal, Joomla, Magento, Sitecore, Contentful, Sanity, Strapi, etc.), 30+ JavaScript frameworks, and 25+ analytics tags.

The whole audit takes 4–8 seconds and costs nothing. There's no signup, no API key, no rate limit on casual use, and no email gate before you see the result.

## When not to use this

This is a single-URL detection tool. If you need to build a **list** of every Shopify store on the internet, or every site that uses Klaviyo, you want a crawl-based service like [BuiltWith](https://builtwith.com), [Bloomberry](https://bloomberry.com) or [StoreLeads](https://storeleads.app) — they crawl millions of sites and let you filter and export. We're the opposite tool: one URL, deep report, no database lookups.

The detection also can't catch:

- Custom CMSes that don't ship any public fingerprint
- Pages served from a CDN edge that strips the underlying server headers
- Sites that intentionally obfuscate their stack with a reverse proxy or static export
- Server-only analytics (Snowplow, Segment server-side) where the SDK never touches the browser

If we report "no CMS fingerprint matched", that usually means one of those four — not that the site is broken.

## FAQ

### Is this really free?

Yes, with no signup. We run the probe server-side because some checks (robots.txt, DNS, headers) can't run from a browser. Results aren't saved unless you click "Save report".

### How accurate is the CMS detection?

Each match comes with a confidence score from 0 to 100%. Anything above 80% is multiple independent signals agreeing (e.g. a `wp-content/` asset URL **and** a `generator` meta tag **and** a `wp-json` REST endpoint). Below 60%, treat the result as "best guess based on one weak signal".

### Why include AI-bot policy and DNS checks?

Because that's the gap competitors don't fill. Knowing the CMS is table stakes; knowing whether the site is blocking GPTBot, missing SPF, or has no `llms.txt` is what tells you whether the site is technically ready for the next two years of search. We surface those signals in the same report so you don't need three separate tools.

### Can I detect multiple URLs at once?

Not from this page. For bulk detection of up to 50 domains in one batch, log into the LemAudit dashboard and use the bulk scanner — it runs the same probe per domain and gives you a CSV export.

### Does this replace the Wappalyzer browser extension?

For the technology-detection slice, yes — and it adds the AI-readiness signals Wappalyzer doesn't ship. The browser extension is still nicer for casual click-through-many-sites browsing because it lives in your toolbar. We're built for the moment you've already landed on a URL and want a full audit-class report.

### How does the AI-bot policy check actually work?

We fetch `/robots.txt` from the target domain and parse every `User-agent:` block. For each known AI crawler — `GPTBot`, `ChatGPT-User`, `ClaudeBot`, `Claude-Web`, `PerplexityBot`, `Google-Extended`, `CCBot`, `Bytespider`, `anthropic-ai`, and a dozen others — we resolve whether the most specific matching rule allows or disallows the agent. The result is the same allow/disallow decision the crawler itself would compute, surfaced as a per-agent table rather than a single yes/no.

### What if the site blocks my scan?

Some sites return a 403 or a Cloudflare challenge to non-browser requests. When that happens we fall back to a header-only probe and flag the limitation in the report — you'll see "blocked by WAF" rather than partial data masquerading as a clean result. If you need to scan a site that aggressively blocks bots, run the audit from inside its admin panel where you control the headers.