Ruby on Rails
Ruby on Rails is a server-side web application framework written in Ruby under the MIT License.
What detecting Ruby on Rails tells you about a site
Ruby on Rails is the canonical convention-over-configuration web framework, and its prints are server-side and distinctive. Look for the X-Runtime header (a Rails signature reporting request time), a _session_id-style cookie, a CSRF <meta name="csrf-token"> pair in the HTML, and the Sprockets/Propshaft asset-fingerprint pattern (application-<hash>.js). Detecting Rails tells you a monolithic, server-rendered application with strong baked-in structure — classically a startup that prized shipping speed and developer happiness over micro-optimised architecture.
The detail that matters for Ruby on Rails
The interactivity layer dates the app: jQuery-driven UJS markup suggests an older Rails build, whereas data-turbo attributes and Stimulus data-controller hooks indicate a modern Hotwire-era Rails 7+ codebase that skips a heavy front-end framework on purpose.
Ruby on Rails in a real-world stack
When you find Ruby on Rails, it rarely travels alone. Puma as the app server, PostgreSQL as the default database, and Hotwire (Turbo + Stimulus) for interactivity.
About
Ruby on Rails is a server-side web application framework written in Ruby under the MIT License.
Categories: Web frameworks
Quick facts
How we detect Ruby on Rails
Sourcemap Explorer carries 8 fingerprint signals for Ruby on Rails, spread across 5 channels — response header, cookie, meta tag, javascript global and script src url. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
Server: mod_(?:rails|rack)
X-Powered-By: mod_(?:rails|rack)
Cookies set by the platform. Visible in DevTools → Application → Cookies.
_session_id
<meta> tag injected into the document. Visible by viewing the page source.
<meta name="csrf-param" content="^authenticity_token$">
Window-level global the technology installs on page. Reproducible by typing the path into the DevTools console.
window.ReactOnRails
window.__REACT_ON_RAILS_EVENT_HANDLERS_RAN_ONCE__
window._rails_loaded
Script URL pattern. Typically a CDN host or chunk path that ships with the technology.
/assets/application-[a-z\d]{32}/\.jsImplies
When Ruby on Railsis detected, Sourcemap Explorer also marks the following technologies as present (Wappalyzer's implies graph).
FAQ
How do I check if a website is using Ruby on Rails?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Ruby on Rails's specific fingerprints here are response header, cookie, meta tag, javascript global and script src url, and the popup flags Ruby on Rails whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Ruby on Rails version can Sourcemap Explorer detect?
Ruby on Rails ships as a hosted web frameworks rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Where can I read more about Ruby on Rails?
Official site: https://rubyonrails.org. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Detected by Sourcemap Explorer
Open the popup on any page running Ruby on Railsand you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.