Confidence Scores: How Sure Is a Technology Detection?

## Why it matters

One detection signal alone is unreliable. A generator meta tag can be spoofed in seconds. But five independent, unrelated signals pointing to the same technology (a header, a cookie, a script URL, a JS global, and an HTML comment) constitute strong evidence. A confidence score separates weak hunches from near-certainties. It's also where Scalpel Stack admits its limits: rather than hide weak matches, it shows them at low confidence and lets you decide whether to trust them.

## How it works

Each detection vector (header, meta tag, script URL, cookie, JS global, DOM element, HTML pattern) has its own confidence weight. A strong, specific signal like a Server header might contribute 40 points. A spoofable HTML comment might contribute 5. When multiple signals match the same technology, their weights sum, capped at 100.

For example, WordPress might score as follows:

• <meta name="generator" content="WordPress 6.4.2"> (meta tag vector): 35 points
• wordpress_logged_in_* cookie (cookie vector): 30 points
• /wp-content/ script URL (script vector): 20 points
• Total: 85/100

If only the HTML comment matched (<!-- Powered by WordPress -->), that's 15 points: a hint, not a proof. Scalpel Stack shows both, but colours the low-confidence one amber to signal caution.

Implied technologies (WordPress implies PHP, which implies MySQL) inherit a fraction of their implier's confidence. If WordPress is 85, PHP might be 70 (a fraction of the parent), and MySQL might be 55. The inheritance reflects the inference chain.

## What does not matter

Raw detection count doesn't matter. Three weak vectors don't outweigh one strong one. Scalpel Stack uses weighted averaging, not a vote. A technology detected by five low-confidence HTML patterns still scores lower than one caught by a single Server header.

Freshness of the fingerprint database also doesn't change an existing detection's score. The confidence is calculated once when the detection matches, using the vector weights and signal strength. An updated database affects only future scans.

## Code example

Here's WordPress detected on two different sites:

Site A (high confidence):

Generator meta: "WordPress 6.4.2"         +35
WordPress cookie: wordpress_logged_in_*   +30
/wp-content/ in script URL                +20
────────────────────────────────
Total: 85/100 (green, high confidence)
Copy

Site B (low confidence, meta stripped):

HTML comment: "Powered by WordPress"      +15
Cached asset pattern: wp-*.min.js          +8
────────────────────────────────
Total: 23/100 (amber, weak hint)
Copy

Site A is almost certainly WordPress. Site B has removed the obvious signals and could be WordPress or another platform using similar asset patterns. The score reflects that uncertainty honestly.

## How Scalpel shows it

Every detection row carries a confidence meter: a bar plus a number from 0–100. Scores 50 and above render in green; below 50 in amber. Expanded rows show the breakdown: a list of each signal and its contribution. The detection remains visible either way, but the colour helps you prioritise. Sort by confidence to see the strongest detections first.