Stack Detection · Stacksentry Docs

How StackSentry fingerprints PHP, SPA, and nginx stacks, and what changes per stack.

StackSentry automatically detects your application stack from HTTP response headers, cookies, and URL patterns — before any security checks run. This detection changes which checks are applied, which admin paths are probed, and which patch templates are generated.

Detection Signals

Signal	Detection
`.php` in URL path	PHP detected
`X-Powered-By: PHP/8.x` header	PHP + version pinned
`PHPSESSID` cookie	PHP session confirmed
`Server: Apache` header	Apache webserver
`Server: nginx` header	nginx webserver
`csrftoken` or `sessionid` cookie	Django
`laravel_session` cookie	Laravel
PHP + Apache + no VPS signals	Shared hosting
SPA response (same body for all routes)	Single Page Application

Detection without a response. PHP detection from URL patterns runs outside the HTTP request try/except block. This means StackSentry can correctly identify a PHP stack even when the server is unreachable or times out — which is common on shared hosting environments that block automated requests.

What Changes Based on Stack

PHP / Apache / Shared Hosting

When is_php=True and shared_hosting=True:

Admin paths expand to include /phpmyadmin, /pma, /cpanel, /wp-admin, /wp-login.php, /administrator
APP-CSRF-001 probes for Laravel @csrf, vanilla PHP token patterns, and CodeIgniter config
Patch templates output PHP code instead of Flask/Django middleware
Infrastructure WARNs (no SSH, no Docker) are excluded from scoring — shared hosting cannot provide these

Single Page Applications (SPAs)

When a SPA is detected:

APP-ADMIN-001 uses SPA-aware detection — a 200 response with the same body length as the homepage is treated as WARN (likely a login wall) rather than FAIL
This prevents false positives where the SPA router returns 200 for every path

nginx vs Apache

The webserver type affects:

Which config file directives are analysed (when --nginx-conf is provided)
Which patch templates are generated for webserver fixes

Viewing Detected Stack

Run with --verbose to see the stack fingerprint:

Stack detection:
  language=php
  webserver=apache
  is_php=True
  shared_hosting=True
  spa=False

This fingerprint is also included in the PDF report under Server Fingerprint.