Is there any ways to identify a website is developed with Umbraco CMS?
I need the list of websites built with Umbraco CMS and also would like to know if there are any ways to identify whether a website is developed using Umbraco CMS or not, programmatically. Thanks.
Also, I've noticed that Umbraco sometimes puts a big ass whitespace before and after input text (that's in Developer Tools). That makes it easy for me to see it's from Umbraco.
Hey Jebastin, Alex is right - best thing is to check for those file paths.
@Harry - just to note that Umbraco doesn't do anything to manipulate the frontend markup. If there are excessive whitespaces, then it'll probably be in the template itself :-)
It's worth noting that the /umbraco folder can (and arguably should) be renamed / secured in a live installation, making it impossible to use this mechanism to detect that a site is built in Umbraco.
Ideally, it shouldn't be possible to tell whether a site is built using Umbraco. That way, should a security vulnerability be found, your site won't be on any list of 'targets' which could be attacked.
Obscurity shouldn't be the only security mechanism in place, but it's another tool in the developers' box!
If you cannot use any of the options from above, use a subdomain for the back office and block access to https://www.yoursite.com/umbraco using IIS rewrite in the web.config.
As for app_plugins and config, that's a bit trickier.
There is a chrome extension for umbraco. So that will help to goto the backend.No need to change URL manually because the backend URL is different for older versions. If it's developed in umbraco then the backend will show, if not then shows 404 page.
Is there any ways to identify a website is developed with Umbraco CMS?
I need the list of websites built with Umbraco CMS and also would like to know if there are any ways to identify whether a website is developed using Umbraco CMS or not, programmatically. Thanks.
Hi Jebastin,
You can make call to /umbraco/ and /umbraco/umbraco.aspx
If this pathes are not closed and this is Umbraco - you will get page with login screen.
Thanks,
Alex
Also, I've noticed that Umbraco sometimes puts a big ass whitespace before and after input text (that's in Developer Tools). That makes it easy for me to see it's from Umbraco.
Hey Jebastin, Alex is right - best thing is to check for those file paths.
@Harry - just to note that Umbraco doesn't do anything to manipulate the frontend markup. If there are excessive whitespaces, then it'll probably be in the template itself :-)
Cheers,
- Lee
It's worth noting that the /umbraco folder can (and arguably should) be renamed / secured in a live installation, making it impossible to use this mechanism to detect that a site is built in Umbraco.
Ideally, it shouldn't be possible to tell whether a site is built using Umbraco. That way, should a security vulnerability be found, your site won't be on any list of 'targets' which could be attacked.
Obscurity shouldn't be the only security mechanism in place, but it's another tool in the developers' box!
Any best practices on how to do this? I've been meaning to try, but don't want to break the site by messing something up.
But most people don't bother
Hi Jebastin
Old post, but there are a number of ways to protect your site, see https://our.umbraco.com/documentation/reference/security/Security-hardening/
If you cannot use any of the options from above, use a subdomain for the back office and block access to https://www.yoursite.com/umbraco using IIS rewrite in the web.config.
As for app_plugins and config, that's a bit trickier.
George
Hey jebastin,
There is a chrome extension for umbraco. So that will help to goto the backend.No need to change URL manually because the backend URL is different for older versions. If it's developed in umbraco then the backend will show, if not then shows 404 page.
is working on a reply...