Website OS Check
Fingerprint the server software and infer the likely operating system behind a website from the headers it returns.
About Website OS Check
When a web server answers a request it often identifies itself in the response headers. The Server header may name the web server software and sometimes the underlying distribution, while X-Powered-By can reveal an application framework or runtime. This tool fetches the URL you provide from our EU servers, reads those headers and combines them into a best-effort guess at the server software and operating system.
The inference is heuristic. A Server value mentioning Ubuntu, Debian, CentOS or Red Hat points to a specific Linux distribution; a value containing win, or an X-Powered-By naming ASP.NET, suggests Windows Server; nginx or Apache without further detail implies a Unix-like host, most often Linux. When a site sits behind Cloudflare or a similar proxy, the origin operating system is hidden and the tool reports that the true backend cannot be seen. If nothing identifiable is exposed, the result is simply reported as unknown.
This kind of banner reading is deliberately limited. Many administrators strip, shorten or spoof the Server and X-Powered-By headers precisely so that outsiders cannot fingerprint their stack, and CDNs and load balancers routinely replace origin headers with their own. A result should therefore be read as a well-informed hint, not a definitive statement about what is running on the machine.
Read the other way round, the tool is a useful self-check. If your own site is leaking a detailed version banner such as a specific web-server and OS build, that is information disclosure an attacker could use to target known vulnerabilities, and it is usually worth trimming those headers to a minimum.
How to use it
- 1Enter the full URL of the site you want to fingerprint, including the scheme.
- 2Run the check so our EU server fetches the page and reads its response headers.
- 3Review the reported Server value and any X-Powered-By value the site exposes.
- 4Read the inferred operating system as a heuristic guess, noting when it says the origin is hidden behind a proxy or is unknown.
- 5For your own sites, decide whether the exposed banners reveal more than you want and trim them at the server or CDN level.
Common use cases
- -Reconnaissance and inventory when documenting the technology stack of your own or a partner's web properties.
- -Checking whether your servers leak detailed version banners that could aid an attacker in targeting known exploits.
- -Quickly distinguishing whether a site runs on Linux, Windows Server or is fronted by a CDN before deeper testing.
- -Technical due diligence on a site or vendor where you want a first read on the hosting environment.
- -Verifying that a hardening change actually removed or generalised the Server and X-Powered-By headers you meant to hide.
Frequently asked questions
- Can you tell what operating system a website runs on?
- You can often make an educated guess from the Server and X-Powered-By response headers, but not always confirm it. This tool infers the likely OS from those headers; when they are stripped, generic or hidden behind a CDN, the origin operating system cannot be determined.
- How do I find what server software a website uses?
- Read the site's HTTP Server header, which typically names the web server such as nginx or Apache and sometimes a version or distribution. This tool fetches the page from EU servers and displays that header along with any framework revealed in X-Powered-By.
- Why does the result say unknown or behind a proxy?
- Many servers remove or spoof identifying headers, and CDNs like Cloudflare replace origin headers with their own. When no distinguishing software or OS string is exposed, or a proxy hides the backend, the tool honestly reports unknown rather than guessing.
- How accurate is OS detection from HTTP headers?
- It is indicative, not authoritative. Header-based fingerprinting reflects what the server chooses to disclose, which administrators can trim or falsify, so treat the inferred operating system as a strong hint to be confirmed by other evidence.
- Should I hide my Server and X-Powered-By headers?
- Reducing them is a reasonable hardening step. Detailed version banners are information disclosure that helps attackers match your stack to known vulnerabilities, so many teams shorten the Server header and remove X-Powered-By entirely at the web server or CDN.