Website X-Ray
Inspect the complete anatomy of any website. Instantly detect frontend frameworks, CMS, CDN routing, TLS certificate health, observable API endpoints, and passive security headers.
Full-Stack Tech Fingerprinting
Identifies Next.js, React, Vue, Svelte, Angular, Astro, Tailwind CSS, Bootstrap, WordPress, Shopify, Express, and runtime libraries with explicit confidence ratings and DOM evidence trails.
Passive Security & HSTS Audit
Evaluates transport-layer HTTPS enforcement, Strict-Transport-Security, Content-Security-Policy (CSP), Clickjacking defenses (XFO), MIME sniff guards (XCTO), and certificate expiration.
Edge CDN & DNS Infrastructure
Traces authoritative nameservers, IPv4/IPv6 addresses, cloud hosts (Vercel, AWS, GCP, Netlify), and edge CDNs (Cloudflare, CloudFront, Fastly) with TTFB latency measurements.
Understanding Web Architecture Detection
Modern web applications are distributed across multiple layers—from DNS edge routing and Content Delivery Networks (CDNs) to frontend Single Page Application (SPA) client hydrators and backend microservices.
Website X-Ray combines multi-factor heuristic fingerprinting with HTTP header telemetry to deliver clean, transparent, and non-destructive technical insights into any public domain.
Frequently Asked Questions
How does Website X-Ray detect frameworks and technologies?
Website X-Ray performs non-invasive, passive DOM inspection, script AST signature analysis, and HTTP header auditing. It inspects HTML root attributes (e.g. data-reactroot, __NEXT_DATA__, __NUXT__, ng-version), script bundle patterns, atomic CSS class styles (e.g. Tailwind), and response headers to identify technologies with deterministic confidence scores.
Does Website X-Ray perform active security penetration testing?
No. Website X-Ray is strictly a passive, non-intrusive inspector. It checks observable public HTTP headers (like HSTS, Content-Security-Policy, X-Frame-Options) and TLS certificate metadata. It never injects payloads, runs exploits, or stresses target infrastructure.
How does the DevCalc X-Ray Score get calculated?
The score (0-100 and grade A+ to F) is a deterministic weighted composite of four key pillars: Security Posture (30%), Modern Tech Architecture (25%), SEO & Meta Readiness (25%), and Response Latency/TTFB (20%).
Are private IPs and localhost addresses supported?
No. To protect infrastructure integrity, Website X-Ray enforces strict SSRF defense filters that reject loopback addresses (127.0.0.1, ::1), RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and cloud metadata endpoints (169.254.169.254).
Why are some API headers marked [REDACTED]?
To prevent unintentional credential or authorization token leakages in public scans, known sensitive header values (including Authorization, Cookie, Set-Cookie, and custom token keys) are masked before client serialization.