What is a CMS, and how to tell which one a website uses

A CMS, or content management system, is software that lets people create, edit and publish the pages of a website through an editor in the browser, without writing HTML or uploading files. It stores the content, applies a design template to it and serves the finished pages to visitors. WordPress, Shopify, Wix, Squarespace, Drupal and Joomla are all CMSs or CMS-like platforms. This guide explains what a CMS does and the main kinds, then shows how to tell which one any website uses, by hand in two minutes or with a free detector, and what that knowledge is good for.

Quick answer

• A CMS separates content from design. Editors write in an admin screen; the system stores the text and images in a database and pours them into templates to build each page.
• The main kinds: self-hosted open-source systems (WordPress, Drupal, Joomla, TYPO3), hosted website builders (Wix, Squarespace, Webflow), e-commerce platforms (Shopify, WooCommerce, Magento), and headless CMSs that only store content for a separate front end.
• WordPress runs 40.2% of all websites and 58.7% of sites whose CMS is known, according to W3Techs on 26 September 2026.
• To see what a site is built with, view its source and look for a generator meta tag and telltale paths such as /wp-content/ or cdn.shopify.com, then check its response headers and cookies.
• Or use the free CMS detector. It loads the page in a real browser, names the CMS, frameworks, libraries, analytics, CDN and server with the evidence, and checks library versions against public security advisories.
• No result is not a failure. Custom-built, headless and carefully stripped sites reveal little, and a good detector says "unknown" rather than guessing.

What is a CMS?

A content management system is the layer between the people who write a website and the pages visitors see. Almost every CMS has the same five parts:

1. An editor. A browser-based admin where you write pages, upload images and click Publish. WordPress calls it the block editor, Shopify the admin, Drupal the content form.
2. A content store. Usually a database (MySQL or MariaDB for WordPress, Joomla and Drupal) that holds every page, post, product and setting, plus a folder for uploaded media.
3. Templates. A theme or layout that decides how content looks. Change the theme and every page changes, while the content stays put.
4. Extensions. Plugins, modules or apps that add features: forms, shops, SEO settings, caching, translations.
5. Users and roles. Accounts with different rights, so an author can draft while only an editor can publish.

Before CMSs, changing a website meant editing HTML files and uploading them. A CMS lets marketers, shop owners and writers update the site themselves, and lets developers change the design once for all pages.

How does a CMS build a page?

When a visitor requests a URL, a traditional CMS such as WordPress runs code on the server (PHP, in WordPress's case) that looks up the content for that URL in the database, runs it through the theme's templates and any plugins, and sends back HTML. Because this happens on every request, most CMS sites add a cache that stores the finished HTML, which is why caching plugins and server response time matter so much for their speed.

Hosted platforms like Shopify, Wix and Squarespace do the same on their own servers; you never see the database. Headless systems split the job: the CMS stores content and serves it through an API, and a separate front end, often built with a framework like Next.js, Nuxt or Astro, builds the pages, sometimes ahead of time as static files.

What are the main types of CMS?

Two pairs are easy to confuse. WordPress.org is the free software you install on your own hosting; WordPress.com is a hosted service running the same software, with plan-dependent limits on plugins and themes. And WooCommerce is not a separate CMS but a plugin that turns WordPress into a shop.

Which CMS is the most popular?

WordPress, by a wide margin. W3Techs, which surveys the top 10 million websites, reported on 26 September 2026:

Source: W3Techs, "Usage statistics of content management systems", 26 September 2026. The same survey found 31.5% of websites use none of the content management systems it monitors: custom-built sites, frameworks without a CMS, or systems it cannot recognise.

Popularity matters for two practical reasons. Popular systems have more themes, plugins, developers and answers online. They are also the systems attackers scan for, which is why keeping them updated is not optional.

How to tell what a website is built with

Every platform leaves fingerprints in the pages it produces. You can read most of them yourself in a couple of minutes, in any desktop browser.

1. Read the page source

Open the page, press Ctrl+U (Cmd+Option+U on a Mac) and search the source with Ctrl+F for these:

• The generator meta tag. Many systems announce themselves: <meta name="generator" content="WordPress 6.x">, or Drupal 10, Joomla!, TYPO3 CMS, Ghost, Wix.com Website Builder, Squarespace, Webflow. Sites often remove it, so its absence proves nothing.
• Asset paths. File URLs give most platforms away, even when the generator tag is gone.
• Footer credits. "Powered by Shopify" or a theme credit in the footer is a strong hint, though it can be edited out.

2. Check the response headers

Open the browser's developer tools (F12), go to the Network tab, reload, click the first request and read the response headers. Some platforms and servers name themselves: x-shopid and x-shopify-stage for Shopify, x-wix-request-id for Wix, X-Generator: Drupal and X-Drupal-Cache for Drupal. The Server header names the web server or CDN (nginx, Apache, cloudflare), and X-Powered-By sometimes names the language, such as PHP/8.2.

3. Look at cookies and scripts

In the developer tools' Application (or Storage) tab, cookie names can give a platform away. In the Console, typing an object name tests for it: Shopify.theme returns the theme on a Shopify store, jQuery.fn.jquery returns the jQuery version when the page loads jQuery.

4. Stop there

Detection should be passive: read what the page sends to every visitor. Probing login pages, guessing plugin folders or hammering well-known paths on someone else's site is noisy, can trip their security tools, and is not needed to answer the question.

Use a CMS detector

The free CMS detector does all of the above in one step. It loads the page in a real Chromium browser, so technology added by scripts counts too, and reads the HTML, headers, cookies, script URLs and the JavaScript objects the page exposes. More than 80 signatures cover:

• CMSs and shop platforms: WordPress, Shopify, Drupal, Joomla, TYPO3, Ghost, Wix, Squarespace, Webflow and HubSpot CMS, plus WooCommerce;
• page builders and common WordPress plugins: Elementor, Divi, Yoast SEO, Rank Math, WP Rocket and LiteSpeed Cache;
• frameworks and libraries: Next.js, Nuxt, Gatsby, Astro, Angular, React, Vue, jQuery, Bootstrap, Lodash and others;
• analytics, tag managers and consent platforms, CDNs such as Cloudflare, Fastly and CloudFront, and web servers.

Each finding shows the evidence it matched, such as the generator tag or an asset path, so you can check it yourself. Every library with a readable version is looked up in OSV.dev, the open vulnerability database that includes the GitHub advisories. Detection is passive: it never probes paths or guesses. In every full getReport report, the same detection appears as the technology stack line:

For a WordPress site, the separate WordPress theme and plugin detector goes further: every plugin the page loads, what each costs in kilobytes, and which ones are closed or abandoned in the wordpress.org directory.

Why a detector sometimes finds no CMS

An empty result usually means one of these, not a broken tool:

• Custom-built. The site runs on a framework such as Laravel, Django, Rails or ASP.NET with no off-the-shelf CMS; you may still see the framework or language.
• Headless. The CMS sits behind an API and never touches the HTML visitors receive; you see the front-end framework, not the content system.
• Static export. The site was generated to plain files, so only the hosting and any scripts are visible.
• Fingerprints removed. Security or white-label plugins strip generator tags, rename folders and hide headers.
• Behind a CDN or login. A CDN replaces the Server header with its own name, and anything behind a login is out of reach for any outside tool.

Treat a detector as evidence, not certainty, and read the evidence column before relying on a result.

Is it WordPress?

WordPress is the answer so often that it deserves its own check. The fastest signs: /wp-content/ or /wp-includes/ in the page source, a generator tag naming WordPress, a link to the /wp-json/ REST API with the api.w.org relation, and markup such as wp-block- classes. If a site shows two or three of them, it is WordPress; if it shows none, it may still be WordPress behind a plugin that removed the traces, or a headless site with a separate front end.

The guide is it WordPress? Five signs a website runs WordPress goes through each sign with examples, explains why probing admin paths on someone else's site is neither needed nor wise, and shows how to tell WordPress.com from self-hosted WordPress.

Which theme is that site using?

On a WordPress site, the theme's folder name is in the asset paths (/wp-content/themes/astra/), and the theme's style.css header names the theme, its author and version. Two theme folders usually mean a child theme and its parent, and the parent is the product to look up. Renamed folders, combined cache files and page builders are why theme detectors sometimes come back empty. The guide on how to tell what WordPress theme a site is using covers child themes, block themes and page builders in detail.

On Shopify, typing Shopify.theme in the browser console returns the theme's display name, which merchants rename freely, its schema_name, which is the original theme's own name, and its theme_store_id, the same number on every store using that Theme Store theme. The guide what Shopify theme is this explains each field, how to confirm a site is on Shopify at all, and why headless stores have no theme to find.

Who hosts the website?

The platform and the host are different questions: a WordPress site can be hosted anywhere. The host shows up in three public places: the IP address the domain points to and the network that owns it, response headers that name managed hosts and CDNs (x-kinsta-cache, x-vercel-id, cf-ray), and, as a weaker hint, the name servers. When a CDN such as Cloudflare sits in front, you see the CDN's network, not the server behind it.

The guide who hosts this website? walks through each lookup, separates the host from the CDN, the registrar and the DNS provider, and explains what to do when a CDN hides the origin, such as sending an abuse report. The CDN basics guide explains what that layer does.

What the technology stack reveals about security

Knowing what a site is built with is also how attackers choose targets. Automated scanners read the same generator tags, library versions and headers, then try the known holes for each version. Three findings in a getReport report come from exactly these fingerprints.

An outdated CMS version

When the generator tag reveals a version, the report compares it with the latest release. An old version has published vulnerabilities, and the tag advertises it.

The guide to outdated CMS versions and reading the generator tag covers how to check your WordPress, Joomla or Drupal version and a safe update routine for core, themes, plugins and PHP; the CMS updates fix page has the short version.

Old JavaScript libraries

Many sites, WordPress sites especially, load old copies of jQuery, jQuery UI, Bootstrap or Lodash through themes and plugins. Old versions carry known cross-site scripting advisories.

The guide to outdated JavaScript libraries and old jQuery explains which versions are affected, how to find what loads the old copy and how to update it safely; see also the vulnerable JavaScript libraries fix page.

Version numbers in server headers

Server: Apache/2.4.29 or X-Powered-By: PHP/7.2.24 hands every scanner your exact software versions.

The guide to Server and X-Powered-By headers shows the one-line fix for Apache, nginx, PHP, IIS and common hosts, and is honest about what hiding them does not achieve: it is a finishing touch, not a substitute for updating.

Platform guides

Once you know the platform, the fixes for a report's findings live in different places. These guides map them:

• Joomla and Drupal: where the settings are
• Shopify: what you can fix, what you cannot, and what to ignore
• Wix speed and SEO limits
• Squarespace: the checklist
• Webflow performance and SEO settings
• Page builders vs Gutenberg: the performance reality for WordPress sites built with Elementor, Divi and similar

Common mistakes

• Trusting one signal. A /wp-content/ path can come from an image hotlinked from another site. Look for two or three signs that agree.
• Reading "no CMS found" as "no CMS". It means none was revealed. Headless and hardened sites hide it on purpose.
• Confusing the platform with the host. Cloudflare in the headers says nothing about the CMS; WordPress says nothing about the host.
• Hiding the generator tag instead of updating. Scanners try exploits regardless of the tag. Update first, hide second.
• Probing another site's admin paths. Unnecessary for detection, and it can look like an attack in their logs.
• Choosing a CMS by market share alone. The most popular system is a safe default, not automatically the right one; a five-page site may be better served by a hosted builder, and a large content operation by a headless setup.

Questions people ask

What is a CMS in simple terms?

A CMS is a program that lets you build and update a website by typing into an editor, instead of writing code. It stores your text and images, applies your chosen design to them and publishes the pages. WordPress, Shopify, Wix and Squarespace are well-known examples. Most businesses use one so non-developers can change the site themselves.

How can I tell what platform a website is built on?

View the page source (Ctrl+U) and search for a generator meta tag or telltale paths such as /wp-content/ for WordPress or cdn.shopify.com for Shopify, then check the response headers in your browser's developer tools. A free CMS detector does all of this at once and shows the evidence it matched, so you can confirm the result yourself.

What is the most popular CMS?

WordPress is the most popular CMS by far. W3Techs measured it on 40.2% of all websites and 58.7% of sites with a known CMS on 26 September 2026, followed by Shopify at 5.4% and Wix at 4.2% of all websites. Around a third of websites use no CMS that the survey recognises.

What are some examples of a CMS?

Common examples are WordPress, Drupal, Joomla and TYPO3, which you install on your own hosting; Wix, Squarespace and Webflow, which are hosted website builders; Shopify and Magento for online shops; and headless systems such as Contentful, Strapi and Sanity that serve content to a separate front end through an API.

Is Shopify a CMS?

Yes, in the broad sense: Shopify is a hosted e-commerce platform with a built-in CMS for pages, blog posts and products, themes for design and apps for extra features. Unlike WordPress, you cannot install it on your own server or edit its server configuration. Its themes and apps are where most speed and SEO fixes happen.

What is a headless CMS?

A headless CMS stores and manages content but has no built-in front end: it delivers the content through an API, and developers build the website, app or other channel that displays it. Contentful, Strapi and Sanity are examples, and WordPress and Drupal can run headless too. It adds flexibility but needs developers for every change to the design.

Why can't a detector tell which CMS a site uses?

Because the site does not reveal it. Custom-built sites have no off-the-shelf CMS to find, headless sites hide the CMS behind an API, static exports are plain files, and some sites strip generator tags and rename folders. A good detector then reports no CMS rather than guessing, and still lists the frameworks, libraries and CDN it can see.