What Is a CMS? Content Management Systems Explained

## Why it matters

Knowing the CMS tells you how a site is built, what its plugins and themes might be, and often its version and therefore its patch status. WordPress alone powers over 40% of the web, so "which CMS" is the most common stack question there is. The generator meta tag, characteristic paths like /wp-content/ and platform cookies usually answer it together, and that consistency is exactly what makes CMSes so detectable.

A CMS also tells you the risk profile. WordPress with an old version is a target; a static-site generator has a different threat model entirely. The CMS is your first clue to everything downstream.

## How it works

A CMS separates the content you write from the HTML it becomes. You log in, click "New post," type your text, hit Publish. And the CMS converts that into a web page, stores it in a database, and serves it when someone visits. Non-developers can run the whole workflow.

Different CMSes use different paths, cookies, and HTML comments to do this. WordPress stores posts in a MySQL database and serves them through PHP. Drupal does the same with a slightly different architecture. Joomla, Ghost, and static generators like Hugo all follow the same pattern: content in storage, software in the middle, published HTML out the other end.

The traces CMSes leave are the same because the job is the same. They need session cookies so you stay logged in. They need a folder like /wp-content/ or /sites/default/ to hold uploads, themes, and plugins. They add a generator meta tag to claim authorship. None of these traces are secrets; they're baked into the platform's design.

## What does not matter

A headless CMS (one that only provides an API and no front-end rendering) is harder to detect because it doesn't publish the usual HTML traces. The API lives on a subdomain, and the front-end is often a separate JavaScript framework. But headless CMSes are still CMSes; you detect them differently.

Removing the generator tag doesn't hide the CMS. It removes one signal, leaving the /wp-content/ folder, the characteristic cookies, the plugin-generated HTML comments, and the version string embedded in style and script URLs. Security through obscurity here means removing every trace, which most sites don't bother to do.

## Code example

The generator meta tag is the shortest signal:

<!-- WordPress -->
<meta name="generator" content="WordPress 6.4.2">

<!-- Drupal -->
<meta name="generator" content="Drupal 10 (https://www.drupal.org)">

<!-- Joomla -->
<meta name="generator" content="Joomla! - Open Source Content Management">
Copy

A site running WordPress also exposes the /wp-includes/ and /wp-content/ folders when scripts and images load from those paths. That's not a secret either. It's part of WordPress's published URL structure.

## How Scalpel Stack shows it

CMS detections group under a "CMS" category header in the popup. Click the row to expand and see the evidence trail: the generator tag that named it, the script paths that confirmed it, the WordPress cookies and HTTP headers that strengthened the match. Each piece of evidence carries a vector badge (meta, script, cookies, headers) so you can trace exactly what the detector saw.

The confidence score accounts for how many signals fired. A WordPress site with just a generator tag might score 65–75; one with the generator, characteristic paths, cookies, and an X-Powered-By header will score 95+. A headless site running a separate front-end might score lower because the CMS itself never touches the HTML.