Where products leave traces
The kinds of code a product leaves on its customers' websites, roughly from
the most reliable to the least. A good signature often joins two or three of
them with |.
The address its script loads from
Most products are installed with a script tag, and the script comes from the product's own host - a CDN or a static subdomain. It is the first thing to look for.
A setting inside the installed snippet
The code customers paste often sets a variable or calls a function named after the product. It is there even when the script itself is loaded from elsewhere - bundled with the site's own scripts or served through a proxy.
An account id
Many snippets carry the customer's account id in a fixed format. Search for the part that never changes, and pull the ids out with snipexp:.
An element id or class of its widget
A widget puts an element on the page for itself - a container with the product's id or class name.
A plugin or module folder
On a CMS, a product installed as a plugin lives in a folder named after it, and the folder shows up in the addresses of its scripts and stylesheets.
A link to the product's own pages
When a product hosts a portal, a help center or a booking page for each customer on its own domain, the customer's site links to it - often on the customer's own subdomain of the product.
Files served from the product's storage
Images and documents a product keeps for its customers are loaded from the product's storage address.
The generator tag
Site builders and CMSs often name themselves, sometimes with a version, in a meta tag.
HTTP headers and cookies
Response headers are indexed together with each page, so a server, a framework or a hosting company that sets a header or a cookie of its own can be searched for as well.
How to tell whether a trace really belongs to the product's customers, and how to combine several, is in Checking a signature.
Next Checking a signature