Where every technology fingerprint came from

A fingerprint is one observable thing in an HTTP response, plus the technology that thing implies, plus how much a match of it alone is worth. Nothing more. There is no JavaScript execution, no port scan and no crawl behind a technology result: one page is fetched, and the response is compared against the corpus below.

Cookie names are read; cookie values never are. A detection is always a read of what the site chose to disclose, never an inventory of what it runs, and a result that finds nothing is not a clean bill of health — a CDN that rewrites headers hides real technologies.

dotvitals does not use a third-party fingerprint dataset, and never has. Not as a source, not as a starting point, not as a reference to check a name against.

The GPL ones are the reason the rule is written as "do not consult" rather than "do not copy". Rewriting or reformatting a GPL dataset still produces a derivative work of it: changing the form does not change the origin. A corpus assembled by paraphrasing someone else's regular expressions is that dataset wearing different punctuation, whatever the commit history says.

Writing our own is slower and the corpus is smaller than a mature dataset's. What it buys is that every detection can say which signal it came from and why that signal is trusted at the level it is — which is the whole content of this page, and is not something an imported list could support.

Provenance is a required field of the fingerprint itself, not a document kept alongside it. A parallel document drifts; a required field cannot be omitted. Each record names a primary source — one of three things, and nothing else.

Every record carries the source URL, the day it was read, and what that source states. A direct observation additionally carries the exact bytes we saw, so a reviewer can reproduce the finding instead of taking our word for it. All86of our 86 observations do.

A detection is an inference from bytes a server chose to send, and some inferences are far weaker than others. The confidence attached to a fingerprint records what a match ofthat signal alone is worth, and it is never promoted: two low signals stay low.

Two limits on confirmed follow from that, and both are counted off the corpus rather than promised:

• An observation alone is never confirmed. A signal we saw on one live site is an inference by definition, however convincing it looked. Fingerprints that are confirmed on an observation alone:0.
• A page-body match is never confirmed. A string in an HTML document is copyable, cacheable and frequently pasted into unrelated templates — a changelog can quote a vendor's script host without the site using the product. Confirmed body matches:0.

Both numbers are zero because the build refuses to let them be anything else. They are printed rather than asserted so you can check them against the table below, where every fingerprint's confidence, signal kind and source type are shown side by side.

One row per fingerprint: what we look at, what a match is worth, and the source that entitles us to say so. Open a category to read it. This is the part of the page that makes the rest checkable — if a claim above is wrong, it is wrong here first.

Technology detection is reported, never scored: identifying a product is not a fault, and the check deducts nothing. How the rest of a report is scored is published the same way, on the scoring methodology page, and the check itself lives atTechnology Lookup.