Skip to content
Deepak Gupta markRecon Atlas

Technology fingerprinting

WhatWeb

Ruby web fingerprinter with 1800+ plugins that identifies CMSs, frameworks, servers, analytics, JavaScript libraries and versions.

ActiveScope a pentestAudit your own exposure

7.0k stars · last push April 2, 2026 · v0.6.4 · GPL-2.0

GitHub repositoryOfficial docs

What it finds

WhatWeb requests a website and matches the response against over 1800 plugins to name the CMS, web server, JavaScript libraries, analytics packages and embedded devices behind it. Plugins use text, regex, MD5 hashes, URL and HTML-tag patterns. An aggression level trades a single request against many extra requests for exact version detection.

  • CMS and blogging platforms
  • web servers
  • JavaScript libraries
  • analytics packages
  • framework modules
  • version numbers
  • email addresses
  • account IDs
  • SQL errors
  • embedded devices

Does it touch the target?

Sends traffic to the target's systems. Use only with the owner's permission.

The default aggression level (level 1) "is the fastest and requires only one HTTP request of a website." Level 3 "can make a handful of HTTP requests per target" and level 4 "Makes a lot of HTTP requests per target."

API keys: The README describes no API keys; fingerprinting is done from HTTP responses with local plugins.

Install

Install with source
git clone https://github.com/urbanadventurer/WhatWeb.git
cd WhatWeb/

From the project's documentation

Install with source
make install

From the project's documentation

Install with source
gem install bundler
bundle update
bundle install

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Default scan (one request per target)
./whatweb example.com

From the project's documentation

Aggressive scan to pin down exact versions
./whatweb -a 3 www.example.com

From the project's documentation

Scan a local network range and suppress errors
whatweb --no-errors 192.0.2.0/24

From the project's documentation

Write JSON results with immediate file writes
./whatweb --output-buffer-size=0 -t 10 --log-json=results.json targets.txt

From the project's documentation

Output formats: brief, verbose, xml, json, json-verbose, magictree, ruby-object, sql, mongodb, elasticsearch

Limits the project documents

  • "Level 3 aggressive plugins will guess more URLs and perform actions that are potentially unsuitable without permission."
  • "WhatWeb has no caching so if you use aggressive plugins on redirecting URLs you may fetch the same files multiple times."
  • With more than 100 threads, cookie handling "may impact performance"; use `--no-cookies`.
  • Default User-Agent identifies the tool (`--user-agent` replaces "WhatWeb/0.6.3").
  • MongoDB logging and charset conversion need optional gems; rchardet "slows performance" (wiki).
  • "WhatWeb currently does not support any intrusion/exploit level tests in plugins."

Deepak's take

Analysis, not documentation

Use it when
Use it to identify the stack behind a specific site, especially when a version number matters. Raise aggression only on sites you are authorised to test.
Skip it when
For quick status and tech labels across thousands of hosts in a pipeline, httpx with `-tech-detect` is lighter. WhatWeb shines on depth per site.
What it will miss
It fingerprints only what the requested pages reveal, so it cannot find other hosts, subdomains or software hidden behind a proxy.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: GPL-2.0. WhatWeb is a trademark or project name of its owners; this library is not affiliated with it.