WP Manifestindependent plugin directory
manifest / security / fuckalyzer

Fuckalyzer

Wordpress plugin to fuck over Wappalyzer with false detections.

by Morrow Shore · github.com/morrowshore/fuckalyzer · website

★ 3stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/morrowshore/fuckalyzer/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/morrowshore/fuckalyzer ↗

NOW REFACTORED AND IMPROVED!

image Fuckalyzer 🖕

The WordPress plugin that fucks over Wappalyzer

image

The Problem

You're security-conscious. You don't want nosy competitors, script kiddies, or that one guy from marketing running Wappalyzer on your site and going "oh interesting, they're running WordPress 6.4 with Elementor and WooCommerce, let me just check the CVE database real quick..."

Or maybe you just think it's none of their fucking business what your tech stack is.

You may have already tried Wordpress plugins before that aim to hide your stack, but they all do weird things like changing and redirecting your links, which bugs out media and functions

But you know... to not be seen by someone, you don't necessarily need to hide yourself... you could also just blind them.

The Solution

Fuckalyzer. It doesn't hide your tech stack, it just makes technology detection tools see literally everything in existence.

"Is this site running React or Vue?"
"Yes."
"...which one?"
"Also Angular. And Nuxt. And Next.js. And Drupal. And Laravel. And also ASP.NET."
"That's not possible."
"And Flutter. At the same time."

Smart Detection?!

Fuckalyzer only begins working if it detects the user running, Wappalyzer, BuiltWith, or other technology profilers.

Only then does it activate. Your regular visitors see nothing unusual. But snoopers? They get flashbanged.

Some of the features:

  • Zero impact on page load for normal visitors
  • Spoofing only activates when profilers are detected
  • All fake elements are hidden from actual users
  • Headers and cookies blend seamlessly

How to install:

  1. Download fuckalyzer.php
  2. Go to /wp-content/plugins/
  3. Make a new folder called fuckalyzer
  4. Drop the files in there
  5. Activate in WordPress admin

Detection Methods:

1. Resource Probing

// Try to load Wappalyzer's internal files
chrome-extension://gppongmhjkpfnbhagpmjfkannfbllamg/js/inject.js

If it loads, gotcha.

2. DOM Snooping Looks for injected `