What Laravel is
Laravel is the most widely used PHP application framework. It renders server-side, exposes no framework header by default and is normally identified from the name of the session cookie it sets.
How DNSTrace.dev detects it
Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.
laravel_session cookie— The default session cookie name, set on responses that start a session.XSRF-TOKEN cookie— Laravel's cross-site request forgery token, supporting evidence alongside the session cookie.PHPSESSID absence— Laravel manages its own session cookie rather than using the PHP default, which is why the framework and the language are reported separately.
What a detection proves
The application is built on Laravel.
What it does not prove
The framework version or the hosting arrangement. A site that renames its session cookie, a common hardening step, becomes undetectable by this signal.
Common questions
Why does a Laravel site sometimes show nothing?
The session cookie is only set when a session starts, and the cookie name can be changed in configuration. Either removes the signal.
Is Statamic detected as Laravel?
Statamic is built on Laravel and is identified separately from its own x-powered-by value. Both can appear.
Compare with
PHPOpen source, the PHP Group
Content management system
Craft CMSPixel & Tonic, Inc.
Application framework
DjangoOpen source, Django Software Foundation
Application framework
ExpressOpen source, OpenJS Foundation
Check a domain
Run a full lookup to see the delivery layer, the detected application stack, live TLS and the announcing network side by side.