WAF Detector

Identifies the WAF or CDN protecting the current website by inspecting its HTTP response headers.

WAF Detector shows which web application firewall (WAF), CDN or edge service is in front of the website you're viewing — with one click. HOW IT WORKS Open the popup on any website. WAF Detector sends a single request to that site and compares its HTTP response headers against a built-in list of known signatures. It shows every service it recognizes, plus the exact header that identified it. WHAT IT RECOGNIZES Around two dozen widely used WAF, anti-DDoS, CDN and hosting/edge platforms. Each result is labelled by type, so you can tell a security service from a delivery network. The full, up-to-date list of supported services is published in the project's GitHub repository. PRIVACY FIRST • Asks for access one site at a time — no blanket access to your browsing. • Never sends your cookies with the check request. • Collects nothing. No analytics, no tracking, no external servers. GOOD TO KNOW Detection is based on response headers. Some WAFs hide or strip their headers, so "no known signature found" does not mean a site is unprotected. CDN results show the delivery network; they don't confirm that a WAF is enabled. Useful for security researchers, penetration testers, developers and anyone curious about how a website is protected. Open source (MIT): https://github.com/zildjiean/WhatWAF