Meta Tag Detection: The generator Tag and Other Giveaways
Meta tag detection reads a page's meta elements, most usefully the generator tag, which many content management systems stamp with their name and version. It is the single most reliable CMS giveaway when present.
Why it matters
The generator meta tag is almost a signed confession: WordPress, Drupal, Joomla, Ghost and many static-site generators write it by default, often with the version attached. A single line of <meta name="generator"> will announce that a site runs WordPress 6.4.2. For CMS detection, it is the highest-confidence signal there is.
But it is also one line of HTML, easy to remove. A security-conscious site strips it. Its absence proves nothing, and its presence can be spoofed. That asymmetry is the whole story of meta detection: presence is strong evidence, absence is neutral.
How it works
Scalpel Stack scans the page's <head> for all <meta> elements and extracts both name= and property= attributes. The content is matched against the fingerprint database: a name="generator" with content WordPress 6.4.2 is a direct hit for WordPress with version 6.4.2.
The database tracks which platforms emit which meta tags and what patterns indicate which versions. Because the content is plain text in the HTML source, the match is fast and reliable.
What does not matter
Stripping the generator tag is the most common anti-detection measure and it works completely. A site that runs WordPress but removes the tag is indistinguishable from a WordPress site with the tag by this vector alone.
The tag can also be forged: a site could emit <meta name="generator" content="WordPress 6.0.0"> even if it doesn't run WordPress. Some sites deliberately emit a false generator to mislead fingerprinters.
Code example
WordPress's default generator tag looks like this:
<meta name="generator" content="WordPress 6.4.2">
Drupal often emits:
<meta name="generator" content="Drupal 10.1">
Static-site generators like Hugo emit:
<meta name="generator" content="Hugo 0.121.1">
Scalpel Stack matches these against the database and captures both the CMS name and version in a single match.
How Scalpel Stack shows it
Meta evidence uses the meta vector badge with the meta name (e.g. generator) as the key and its content as the matched text. The matched text renders as inert text only, so a hostile content value can never execute.
If multiple meta tags are present, each one is evaluated separately. A site could emit both a generator tag and a x-ua-compatible tag, and both would be checked.