What detecting Drupal tells you about a site
Drupal is a PHP CMS aimed at large, structured, permissions-heavy sites. The cleanest tell is a <meta name="generator" content="Drupal ..."> tag in the HTML, backed by /sites/default/files/ and /core/ asset paths, a X-Generator header, and Drupal's X-Drupal-Cache / X-Drupal-Dynamic-Cache headers when its page cache is on. Spotting Drupal signals an organisation with serious content-governance needs — government, universities, NGOs, big publishers — where its taxonomy, workflow and access-control model justify a heavier CMS than WordPress.
The detail that matters for Drupal
The /core/ directory in asset paths is a Drupal 8+ signature; older sites lack it and instead expose /misc/ and /modules/ at the web root, a quick read on whether the site is on a modern, supported major version or a legacy one.
Drupal in a real-world stack
When you find Drupal, it rarely travels alone. PHP-FPM with MySQL/MariaDB or PostgreSQL, an Nginx/Apache front door, and often Varnish or a CDN in front for caching.
About
Drupal is a free and open-source web content management framework.
Categories: CMS
Quick facts
Detection methodology for CMS
For content management systems we lean on the most stable signals each platform leaves behind: the `<meta name="generator">` tag, asset URL prefixes (`/wp-content/`, `/sites/default/files/`, `/cdn.shopify.com/`), distinctive cookie namespaces (`wordpress_*`, `_shopify_*`, `Drupal.*`) and admin-route signatures (`/wp-admin/`, `/user/login`). When the visible site is a JavaScript framework with a headless CMS underneath, we surface the CMS SDK from the bundle (`@sanity/client`, `contentful`, `@storyblok/react`) — the fingerprint that survives even when the HTML carries no traditional CMS markers.
How we detect Drupal
Sourcemap Explorer carries 10 fingerprint signals for Drupal, spread across 7 channels — response header, cookie, meta tag, javascript global, html source, script src url and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
Expires: 19 Nov 1978
X-Drupal-Cache:
X-Generator: ^Drupal(?:\s([\d.]+))?
Cookies set by the platform. Visible in DevTools → Application → Cookies.
SESS[a-f0-9]{32}<meta> tag injected into the document. Visible by viewing the page source.
<meta name="generator" content="^Drupal(?:\s([\d.]+))?">
Window-level global the technology installs on page. Reproducible by typing the path into the DevTools console.
window.Drupal
Substring or regex match against the page HTML — typically a unique class, comment marker, or asset path.
<(?:link|style)[^>]+"/sites/(?:default|all)/(?:themes|modules)/
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
drupal\.js
drupal_internal__nid
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
link[href*='/sites/default/themes/'], link[href*='/sites/all/themes/'], link[href*='/sites/default/modules/'], link[href*='/sites/all/modules/'], style[href*='/sites/default/themes/'], style[href*='/sites/all/themes/'], style[href*='/sites/default/modules/'], style[href*='/sites/all/modules/']
Implies
When Drupalis detected, Sourcemap Explorer also marks the following technologies as present (Wappalyzer's implies graph).
FAQ
How do I check if a website is using Drupal?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Drupal's specific fingerprints here are response header, cookie, meta tag, javascript global, html source, script src url and dom selector, and the popup flags Drupal whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Drupal version can Sourcemap Explorer detect?
Drupal ships as a hosted cms rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Is Drupal open source?
Yes, Drupal is open source. The license details are listed on the official site (https://www.drupal.org/), and the codebase typically lives on a public source-control host.
Where can I read more about Drupal?
Official site: https://www.drupal.org/. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Keep reading on Sourcemap Explorer
Practical guides
Detection deep dives
Alternative tools
Detected by Sourcemap Explorer
Open the popup on any page running Drupaland you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.