# Where products leave traces

The kinds of code a product leaves on its customers' websites, roughly from the most reliable to the least. A good signature often joins two or three of them with `|`.

### The address its script loads from

Most products are installed with a script tag, and the script comes from the product's own host - a CDN or a static subdomain. It is the first thing to look for.

`"static.hotjar.com"` (https://publicwww.com/websites/%22static.hotjar.com%22/)

### A setting inside the installed snippet

The code customers paste often sets a variable or calls a function named after the product. It is there even when the script itself is loaded from elsewhere - bundled with the site's own scripts or served through a proxy.

`"_hjSettings"` (https://publicwww.com/websites/%22_hjSettings%22/)

### An account id

Many snippets carry the customer's account id in a fixed format. Search for the part that never changes, and pull the ids out with [snipexp:](https://publicwww.com/docs/query-syntax/regex/).

`"googletagmanager.com/gtm.js" snipexp:|(GTM-[A-Z0-9]+)|` (https://publicwww.com/websites/%22googletagmanager.com%2Fgtm.js%22+snipexp%3A%7C%28GTM-%5BA-Z0-9%5D%2B%29%7C/)

### An element id or class of its widget

A widget puts an element on the page for itself - a container with the product's id or class name.

`"class=\"g-recaptcha\""` (https://publicwww.com/websites/%22class%3D%5C%22g-recaptcha%5C%22%22/)

### A plugin or module folder

On a CMS, a product installed as a plugin lives in a folder named after it, and the folder shows up in the addresses of its scripts and stylesheets.

`"/wp-content/plugins/contact-form-7/"` (https://publicwww.com/websites/%22%2Fwp-content%2Fplugins%2Fcontact-form-7%2F%22/)

### A link to the product's own pages

When a product hosts a portal, a help center or a booking page for each customer on its own domain, the customer's site links to it - often on the customer's own subdomain of the product.

`".zendesk.com/hc/"` (https://publicwww.com/websites/%22.zendesk.com%2Fhc%2F%22/)

### Files served from the product's storage

Images and documents a product keeps for its customers are loaded from the product's storage address.

`"images.ctfassets.net"` (https://publicwww.com/websites/%22images.ctfassets.net%22/)

### The generator tag

Site builders and CMSs often name themselves, sometimes with a version, in a meta tag.

`"content=\"Joomla!"` (https://publicwww.com/websites/%22content%3D%5C%22Joomla%21%22/)

### HTTP headers and cookies

Response headers are indexed together with each page, so a server, a framework or a hosting company that sets a header or a cookie of its own can be searched for as well.

`"x-powered-by: express"` (https://publicwww.com/websites/%22x-powered-by%3A+express%22/) `"set-cookie: PHPSESSID"` (https://publicwww.com/websites/%22set-cookie%3A+PHPSESSID%22/)

How to tell whether a trace really belongs to the product's customers, and how to combine several, is in [Checking a signature](https://publicwww.com/docs/signatures/checking/).

Source: https://publicwww.com/docs/signatures/traces/