Can it detect WordPress, Drupal, or Joomla?

Yes. Dedicated plugins fingerprint those platforms and many others, often reading version signals from meta tags, cookies, and asset paths. Narrow a run with -p when you care about one stack.

What does aggression level (-a) change?

It sets how many requests go to each target. Stealthy (-a 1) sends one request; aggressive (-a 3) follows up on partial matches; heavy (-a 4) runs aggressive checks broadly. Raise it to confirm versions; lower it to stay quiet.

Can it scan IP ranges or host lists?

Yes. targets accepts CIDR and hyphenated ranges, and --input-file reads hosts from a file. Raise -t to add threads on large scopes.

whatweb vs httpx or webanalyze?

whatweb goes deeper per host with aggression levels and a large plugin set. webanalyze is tuned for fast bulk Wappalyzer-style detection; httpx probes liveness and runs lighter tech detection inline. Pair httpx to find what is up, then whatweb to profile it.

Updated Jul 14, 2026

Recon

Name the stack behind a site before you scan it

Plugin-based fingerprinting for CMS, servers, libraries, and devices.

Profile what a target runs Scan ranges and host lists Trade stealth against depth

overview

What whatweb does

whatweb reads HTTP responses and matches them against a large plugin set to name the software behind a site: CMS, web server, JavaScript libraries, analytics, and embedded devices. Detections carry confidence; plugins can also pull version strings and other identifiers from the same responses.

Aggression (-a) trades stealth for depth: stealthy sends one request; aggressive follows up on partial matches; heavy runs aggressive checks broadly. Narrow plugins with -p, raise -t for threads, and feed hosts via targets or --input-file (including CIDR ranges).

Trickest runs whatweb as a managed recon step that writes a folder and a file. Use it after host discovery when you need stack names before routing hosts into scanners tuned for that platform.

source github.com/urbanadventurer/WhatWeb

use cases

Where whatweb fits

Profile what a target runs

Fingerprint a host to learn its CMS, web server, libraries, and analytics before choosing how to test it.

Scan ranges and host lists

Feed IP ranges in CIDR form or an input file so WhatWeb profiles a whole scope, not one URL at a time.

Trade stealth against depth

Pick a stealthy single-request pass to stay quiet, or a heavy pass to confirm versions and enrich detections when noise is acceptable.

Route hosts by technology

Use the results to send every host running a given platform into a scanner tuned for that stack.

reference

whatweb inputs and flags

22 inputs

Name	Type	Flag	Description
targets	STRING	·	URLs, hostnames, IPs, or IP ranges in CIDR, x.x.x-x, or x.x.x.x-x.x.x.x format.
input-file	FILE	--input-file	Read targets from a file for bulk scanning.
aggression-level	STRING	-a	Trade stealth against depth: Stealthy, Aggressive, or Heavy.
Select-plugins	STRING	-p	Run only the named plugins from a comma-delimited list. Default is all.
number-of-threads	STRING	-t	Number of concurrent threads. Default 25.
user-agent	STRING	-U	Send a custom User-Agent instead of the default WhatWeb string.
Http-header	STRING	-H	Add or remove an HTTP request header.
Proxy	STRING	--proxy	Route requests through a proxy. Format: hostname[:port].

Showing key inputs. whatweb exposes 22 inputs in total.

Full flag reference (22 inputs)

Name	Type	Flag	Description
Proxy	STRING	--proxy	Set proxy hostname and port. Format: hostname[:port].
Cookies	STRING	-c	Provide cookies, e.g. 'name=value; name2=value2'.
targets	STRING	·	URLs, hostnames, IP addresses, or IP ranges in CIDR, x.x.x-x, or x.x.x.x-x.x.x.x format.
http-auth	STRING	-u	HTTP basic authentication. Format: user:password.
input-file	FILE	--input-file	Read targets from a file.
proxy-user	STRING	--proxy-user	Set proxy user and password. Format: username:password.
user-agent	STRING	-U	Identify as a chosen agent string instead of the default WhatWeb user agent.
Http-header	STRING	-H	Add an HTTP header. An empty value, e.g. 'User-Agent:', removes the header.
Cookies-file	FILE	--cookiejar	Read cookies from a file.
color-output	STRING	--color	Control whether colour is used. Options: never, always, auto.
google-dorks	STRING	-dorks	List Google dorks for the selected plugin.
open-timeout	STRING	--open-timeout	Timeout for opening the connection in seconds. Default 15.
plugins-list	BOOLEAN	-l	List all plugins.
read-timeout	STRING	--read-timeout	Timeout for reading the answer in seconds. Default 30.
custom-plugin	STRING	--custom-plugin	Define a custom plugin inline, e.g. a text match like 'powered by abc'.
Select-plugins	STRING	-p	Select plugins from a comma-delimited list. Default is all.
follow-redirect	STRING	--follow-redirect	Control when to follow redirects. Options: never, http-only, meta-only, same-site, always. Default always.
aggression-level	STRING	-a	Trade-off between speed/stealth and reliability. Stealthy sends one request per target; Aggressive follows up on level-1 matches; Heavy runs many requests per target.
No-error-messages	BOOLEAN	--no-errors	Suppress error messages.
number-of-threads	STRING	-t	Number of threads. Default 25.
Search-string-regexp	STRING	-g	Search for a string or regular expression and show only matching results.
maximum-number-of-redirects	STRING	--max-redirects	Maximum number of contiguous redirects. Default 10.

example

Run whatweb

whatweb · command

# aggressive fingerprint of a host list, 50 threads, errors mutedwhatweb -a 3 -t 50 --no-errors --input-file hosts.txt

sample output

http://example.com [200 OK] Country[RESERVED][ZZ], HTTPServer[nginx/1.24.0], IP[203.0.113.10], Title[Example Domain], UncommonHeaders[x-request-id]http://blog.example.com [301 Moved Permanently] HTTPServer[nginx/1.24.0], IP[203.0.113.11], RedirectLocation[https://blog.example.com/], Title[301 Moved Permanently]https://blog.example.com [200 OK] Bootstrap, Cookies[wordpress_test_cookie], HTML5, HTTPServer[nginx/1.24.0], JQuery[3.7.1], MetaGenerator[WordPress 6.4.3], Script[text/javascript], Title[Company Blog], WordPress[6.4.3], X-Powered-By[PHP/8.2.15]https://shop.example.com [200 OK] Apache[2.4.58], Cookies[PHPSESSID], HTTPServer[Apache/2.4.58 (Debian)], IP[198.51.100.24], Magento, Open-Graph-Protocol, Script, Title[Store], X-Frame-Options[SAMEORIGIN]https://api.example.com [401 Unauthorized] HTTPServer[Werkzeug/3.0.1 Python/3.11], IP[198.51.100.25], WWW-Authenticate[Basic realm], nginxhttps://dev.example.com [200 OK] Drupal, HTTPServer[Apache/2.4.58], HttpOnly[SESS], IP[203.0.113.12], MetaGenerator[Drupal 10], PHP, Script, Title[Dev Portal]https://cam.example.com [200 OK] Country[RESERVED][ZZ], HTTPServer[Boa/0.94.14rc21], IP[198.51.100.30], Title[Network Camera], WWW-Authenticate[Basic realm]

guidance

Choosing whatweb

Use whatweb to fingerprint web technologies across single hosts, ranges, or lists with tunable aggression. For a Wappalyzer-style engine built for raw bulk throughput, use webanalyze. For liveness plus tech in one probe, use httpx.

wappalyzer

Deep single-site fingerprinter. whatweb adds aggression levels and range/CIDR targets.

webanalyze

Go port of Wappalyzer tuned for fast bulk scanning of host lists.

httpx

Probes liveness and runs tech detection inline, so one node both filters and fingerprints.

faq

whatweb questions

Point whatweb at a URL or hostname. It prints the stack on one line with confidence per plugin. On Trickest, set targets or pass --input-file of hosts.

Run whatweb yourself

A target list feeds WhatWeb, which fingerprints each host and writes the technology profile as a queryable output.

Open whatweb in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Name the stack behind a site before you scan it

What whatweb does

Where whatweb fits

Profile what a target runs

Scan ranges and host lists

Trade stealth against depth

Route hosts by technology

whatweb inputs and flags

Run whatweb

Choosing whatweb

wappalyzer

webanalyze

httpx

whatweb questions

More Recon tools

amass

amass-intel

assetfinder

bbot

bevigil

cloud-enum

Run whatweb yourself