Website X-Ray
Inspect public signals from any reachable website: frontend frameworks, CMS, CDN and DNS, TLS certificate details, observable API requests, security headers, and on-page SEO metadata.
Full-Stack Tech Fingerprinting
Looks for public HTML, asset-path, bundle and response-header signatures for common frameworks, CMS platforms and libraries. Every match includes confidence and supporting evidence.
Passive Security & HSTS Audit
Evaluates transport-layer HTTPS enforcement, Strict-Transport-Security, Content-Security-Policy (CSP), Clickjacking defenses (XFO), MIME sniff guards (XCTO), and certificate expiration.
Edge CDN & DNS Infrastructure
Resolves public DNS records and checks response headers for hosting and CDN signatures. Timing reflects this scanner's network location and is not a Core Web Vitals measurement.
How the Website Technology Scanner Works
The scan fetches the requested public page, follows a limited redirect chain, validates every destination against SSRF protections, reads response headers, resolves DNS, inspects the TLS certificate, and checks first-party script bundles within size and count limits.
A short browser observation records fetch and XHR requests made during initial page load. Static analysis can also find API-shaped URLs referenced in public code; these inferred endpoints are labelled separately from requests observed on the network.
Results are evidence-based but not exhaustive. Consent screens, bot protection, authentication, regional routing, client interactions, hidden backend services and removed headers can all limit what a passive public scan can detect.
What the SEO and Security Results Mean
On-page SEO checks
The report checks the returned HTML for a title, meta description, canonical link, one primary H1, robots directives, Open Graph, Twitter Card, JSON-LD, viewport, favicon and document language. These checks improve technical readiness but do not predict rankings or replace content, link and crawl analysis.
Passive security checks
The report evaluates HTTPS, TLS certificate status and public response headers such as HSTS, CSP, X-Content-Type-Options, frame protections, Referrer-Policy and Permissions-Policy. A high score is not a penetration test or vulnerability guarantee.
Frequently Asked Questions
How does Website X-Ray detect frameworks and technologies?
Website X-Ray uses passive HTML, public script-path, bundle-string, and HTTP-header signatures. It reports confidence and evidence for each match because hidden server-side technology and deliberately removed headers cannot be confirmed from a public response.
Does Website X-Ray perform active security penetration testing?
No. Website X-Ray is strictly a passive, non-intrusive inspector. It checks observable public HTTP headers (like HSTS, Content-Security-Policy, X-Frame-Options) and TLS certificate metadata. It never injects payloads, runs exploits, or stresses target infrastructure.
How does the DevCalc X-Ray Score get calculated?
The indicative score combines security headers (30%), detected technology signals (25%), on-page SEO signals (25%), and response timing (20%). It is a comparison aid, not proof of security, search ranking, code quality, or production readiness.
Are private IPs and localhost addresses supported?
No. To protect infrastructure integrity, Website X-Ray enforces strict SSRF defense filters that reject loopback addresses (127.0.0.1, ::1), RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata endpoints (169.254.169.254).
Why are some API headers marked [REDACTED]?
To prevent unintentional credential or authorization token leakages in public scans, known sensitive header values (including Authorization, Cookie, Set-Cookie, and custom token keys) are masked before client serialization.