HTML Pattern Detection

## Why it matters

Plenty of technologies have no dedicated cookie or global but leave an unmistakable comment or a signature class prefix. HTML matching catches those. It is broad, so it is also where weak, spoofable matches live. That is exactly why each detection is weighed by confidence rather than trusted outright.

A Yoast SEO comment in the page source, or a .gjs- class prefix left by Grapesjs, is a real signal even if it is easy to remove. The confidence weighting keeps these matches from drowning out stronger evidence, and the evidence trail lets you see what was matched.

## How it works

HTML pattern detection runs regular expressions against the rendered page source (the HTML captured during the scan). Patterns can match:

1. HTML comments (e.g. <!-- This site uses Yoast SEO -->). Easy to spot and often informative, but trivial to remove.
2. Class names (e.g. class="elementor-section", class="wp-block-*"). Left behind by themes and page builders.
3. Data attributes (e.g. data-react-root, data-next-hydration). Modern frameworks often mark their root nodes.
4. Markup structure (e.g. the presence of specific nested elements or attribute combinations). Harder to spoof than a single string.
5. Text content within elements (e.g. a specific substring in a script comment or a data block).

The fingerprint database holds regex patterns for each of these traces. During a scan, Scalpel Stack runs each pattern against a capped portion of the page source (to avoid scanning millions of characters). If a pattern matches, the matched substring is recorded as evidence.

The scanned HTML is capped in size for both performance and safety. Scanning an entire page source can be slow, and extremely large pages can cause memory pressure. The cap is generous enough to catch most traces whilst keeping the scan responsive.

## What does not matter

An HTML pattern match does not tell you the technology is in active use right now. A stale comment or a leftover class from a migration will fire the same as if the technology were running live. The detection proves presence, not activity.

HTML patterns also tend to have lower confidence than other vectors because they are easy to spoof or remove. A page builder comment is strong, but a generic class name like main-container is weak. That is why Scalpel Stack shows confidence scores for each evidence item.

A pattern can also be too broad and match unrelated content. The open database mitigates this by choosing patterns carefully and testing them, but false positives are most likely to come from HTML pattern matches.

## Code example

Here are real examples of HTML patterns that Scalpel Stack matches:

<!-- Yoast SEO HTML comment -->
<!-- This website is optimized with the Yoast SEO plugin v21.0 -->
<!-- Matched by: /This website is optimized with the Yoast SEO/i -->

<!-- Elementor page builder class names -->
<div class="elementor elementor-12345">
  <section class="elementor-section elementor-top-section">
    <div class="elementor-container">...</div>
  </section>
</div>
<!-- Matched by: /class="[^"]*elementor/i -->

<!-- React root data attribute -->
<div id="app" data-react-root="true"></div>
<!-- Matched by: /data-react-root/i -->

<!-- Next.js hydration marker -->
<div id="__next" data-next-hydration-start="..."></div>
<!-- Matched by: /data-next-hydration/i -->

<!-- WordPress block editor comment -->
<!-- wp:core/paragraph -->
<p>Hello World</p>
<!-- /wp:core/paragraph -->
<!-- Matched by: /<!-- wp:/i -->
Copy

When one of these patterns matches, the evidence line records the vector (html), the matched substring (truncated if needed), and the confidence weight of that particular pattern.

## How Scalpel Stack shows it

HTML evidence uses the html vector badge with the matched substring as the key. If the full matched text is long, it is truncated in the popup display to keep the interface readable, but hovering over the evidence line can reveal the full match.

Because HTML patterns are the broadest vector and often the weakest, they typically appear lower in the confidence ranking. A strong script match or a meta tag will rank higher. But when they do match, they are valid evidence and are shown with their confidence score so you can judge their weight yourself.