You're security-conscious. You don't want nosy competitors, script kiddies, or that one guy from marketing running Wappalyzer on your site and going "oh interesting, they're running WordPress 6.4 with Elementor and WooCommerce, let me just check the CVE database real quick..."
Or maybe you just think it's none of their fucking business what your tech stack is.
You may have already tried Wordpress plugins before that aim to hide your stack, but they all do weird things like changing and redirecting your links, which bugs out media and functions
But you know... to not be seen by someone, you don't necessarily need to hide yourself... you could also just blind them.
Fuckalyzer. It doesn't hide your tech stack, it just makes technology detection tools see literally everything in existence.
"Is this site running React or Vue?"
"Yes."
"...which one?"
"Also Angular. And Nuxt. And Next.js. And Drupal. And Laravel. And also ASP.NET."
"That's not possible."
"And Flutter. At the same time."
Fuckalyzer only begins working if it detects the user running, Wappalyzer, BuiltWith, or other technology profilers.
Only then does it activate. Your regular visitors see nothing unusual. But snoopers? They get flashbanged.
- Zero impact on page load for normal visitors
- Spoofing only activates when profilers are detected
- All fake elements are hidden from actual users
- Headers and cookies blend seamlessly
- Download
fuckalyzer.php - Drop it in
/wp-content/plugins/ - Activate in WordPress admin
- There is no step 4. You're done. Go grab a coffee.
1. Resource Probing
// Try to load Wappalyzer's internal files
chrome-extension://gppongmhjkpfnbhagpmjfkannfbllamg/js/inject.jsIf it loads, gotcha.
2. DOM Snooping
Looks for injected <script> tags with Wappalyzer signatures.
3. Message Interception
Listens for the postMessage events these extensions use.
- Meta tags: Fake generators for WordPress, Drupal, Elementor, Divi, etc.
- HTTP Headers: Fake Vercel, Cloudflare, ASP.NET, Python server headers
- Cookies: Fake session cookies for Laravel, Symfony, Java, ASP.NET
- JavaScript globals: Fake
window.React,window.Vue,window.angular, etc. - DOM elements: Hidden elements that trigger CSS/DOM-based detection
- CSS variables: shadcn/ui, Tailwind signatures
- Link prefetches: Fake script sources that match regex patterns
Detection fingerprints based on wappalyzer itself at: projectdiscovery/wappalyzergo
Made with 🖕 for privacy enthusiasts and chaos agents everywhere
Hide your stack. Confuse your enemies. Trust no profiler.