Detect Firebase
Firebase is a Google-backed application development software that enables developers to develop iOS, Android and Web apps.
Detection looks at response headers, script sources, javascript globals, dom selectors, inline scripts across 7 fingerprint rules among the site's public responses.
01
Websites using Firebase
Loading website list…
02
Signal classes
PluginView evaluates public page signals in these classes when identifying Firebase. Individual fingerprint rule bodies are proprietary and are not published.
- Response headers
- Script sources
- JavaScript globals
- DOM selectors
- Inline scripts
03
Example public indicators for Firebase
Illustrative indicators derived from public catalog metadata for Firebase. A live scan may match additional proprietary rules beyond these examples.
- vary: x-fh-requested-host
- ?firebase.min?.js
- firebasejs//firebase
- firebase.SDK_VERSION:
- iframe
- .gstatic.com/firebasejs//
- firebaseConfigio.com
04
What a detection means
- Establishes
- One or more public signals on the scanned page matched a known Firebase signature (7 rules) at the time of the scan.
- Does not establish
- A sitewide install of Firebase, an active vendor contract, exclusive use, or that Firebase is still in place today.
05
How to check a site for Firebase
- 1. Enter the website URL in the scan form — homepage, pricing, checkout, or login pages usually expose the strongest Firebase signals.
- 2. PluginView reads only public responses (response headers, script sources, javascript globals) and scores them against the Firebase signature set (7 rules).
- 3. Review the confidence score and text explanation for Firebase on the results page.
06
FAQ: detecting Firebase
- Can PluginView detect Firebase without logging in?
- Yes. PluginView only reads publicly accessible responses when checking for Firebase — typically response headers, script sources, javascript globals, dom selectors. It does not bypass authentication or paywalls.
- What category is Firebase?
- Firebase is classified under Databases, Development in the PluginView directory.
- How many fingerprint rules cover Firebase?
- This reference currently tracks 7 fingerprint rules across response headers, script sources, javascript globals, dom selectors, inline scripts. Individual rule bodies are proprietary and are not published.
- What public signals suggest a site uses Firebase?
- Illustrative public indicators for Firebase include vary: x-fh-requested-host; ?firebase.min?.js; firebasejs//firebase. A live scan may match additional proprietary rules beyond these examples.
