Detect Craft CMS

PluginView evaluates public page signals in these classes when identifying Craft CMS. Individual fingerprint rule bodies are proprietary and are not published.

• Response headers
• Cookies

Illustrative indicators derived from public catalog metadata for Craft CMS. A live scan may match additional proprietary rules beyond these examples.

• x-powered-by: \bCraft CMS\b
• CRAFT_CSRF_TOKEN
• CraftSessionId

Establishes

One or more public signals on the scanned page matched a known Craft CMS signature (3 rules) at the time of the scan.

Does not establish

A sitewide install of Craft CMS, an active vendor contract, exclusive use, or that Craft CMS is still in place today.

1. 1. Enter the website URL in the scan form — homepage, pricing, checkout, or login pages usually expose the strongest Craft CMS signals.
2. 2. PluginView reads only public responses (response headers, cookies) and scores them against the Craft CMS signature set (3 rules).
3. 3. Review the confidence score and text explanation for Craft CMS on the results page.

A confirmed Craft CMS match also implies these technologies are present.

Yii

Can PluginView detect Craft CMS without logging in?

Yes. PluginView only reads publicly accessible responses when checking for Craft CMS — typically response headers, cookies. It does not bypass authentication or paywalls.

What category is Craft CMS?

Craft CMS is classified under CMS in the PluginView directory.

How many fingerprint rules cover Craft CMS?

This reference currently tracks 3 fingerprint rules across response headers, cookies. Individual rule bodies are proprietary and are not published.

What public signals suggest a site uses Craft CMS?

Illustrative public indicators for Craft CMS include x-powered-by: \bCraft CMS\b; CRAFT_CSRF_TOKEN; CraftSessionId. A live scan may match additional proprietary rules beyond these examples.