We Scanned 20 Popular Websites With Our Own Detector — Here’s What We Found

Instead of writing another guide, we picked 20 well-known sites — a mix of developer tools, design software, e-commerce, and media — and ran every one of them through our own live detector, exactly the way any visitor would. No cherry-picking after the fact: what follows is what came back.

We found three of our own bugs before publishing any of this

The first pass came back with figma.com scoring 100% and identified as "Wix ADI," and shopify.com scoring 80% as "Shopify Magic." Neither is remotely plausible for either company, so we checked the actual evidence before writing a word of this post. Figma's page uses the free, open-source "Wix Madefor" Google Font — our class-name pattern for Wix ADI was broad enough to match that font's CSS class, not the builder. Shopify's own homepage naturally references its own asset CDN, which our rule read as evidence of Shopify's AI feature specifically, when it's actually true of every ordinary Shopify store. We fixed both — full details on the accuracy log — and re-ran the whole batch before writing this. The table below reflects the corrected results.

The results

What stands out

Framer's own marketing site is, unsurprisingly, built on Framer — the clearest possible result, and a useful sanity check that the strongest signal category works as intended. Discord's corporate site matched Webflow's specific embed-block class, which is genuinely plausible: plenty of companies whose core product is custom-engineered still hand their marketing site to a design tool, and that's exactly the kind of split our builder comparison post talks about. Stripe, Figma, Linear, and WordPress.org all came back clean — all four are known for heavily custom-built sites, which is exactly what we'd expect a working detector to report.

Half the list couldn't be checked at all

Ten of the twenty sites — github.com, airbnb.com, spotify.com, netflix.com, dropbox.com, webflow.com, wix.com, squarespace.com, medium.com, slack.com — returned a bot-protection response instead of a page to analyze. Large, high-traffic sites commonly run aggressive bot mitigation that blocks any automated request, ours included. This isn't a failure we're hiding: it's a real, documented limitation of checking a live page over the network rather than a reason to inflate what we can actually confirm. See the methodology page for the full list of things this approach can and can't see.

Want to check a site yourself? Run the detector on any URL, or get an embeddable result with the badge generator.