Express
Express is the most widely used web framework for Node.js, powering a large share of JavaScript-based backends and APIs. It is commonly identified from the X-Powered-By: Express response header.
That header is informational only and often left at its default; it confirms a Node.js backend but says nothing about the security of the application built on top of it.
Commonly deployed alongside Express
Of the 6,722 public scans where Express was detected, these are the technologies most often present on the same site. The share is the percentage of Express sites that also ran each one.
| Technology | Category | Share of Express sites |
|---|---|---|
| Node.js | wappalyzer | 99.88% |
| HTTP/3 | wappalyzer | 58.42% |
| Google Analytics | wappalyzer | 49.97% |
| Ubuntu | wappalyzer | 32.53% |
| HSTS | wappalyzer | 32.38% |
| Unpkg | wappalyzer | 30.77% |
| Cloudflare | wappalyzer | 28.96% |
| Open-Graph-Protocol | miscellaneous | 27.41% |
| Cloudflare Bot Management | wappalyzer | 27.27% |
| Google Tag Manager | wappalyzer | 11.38% |
| Substack | wappalyzer | 11.13% |
| X-UA-Compatible | miscellaneous | 10.91% |
| Amazon Web Services | wappalyzer | 8.28% |
| React | wappalyzer | 8.25% |
How ScanMalware detects Express
Express is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Express is present, but how it is being used. Open the full search interface for Express →
Recent public scans featuring Express
A rolling sample of recent public scans where Express was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| Smithsonian Institution | Home https://www.si.edu | 2026-11-04 |
| Cherif Millogo - 2025-26 - Varsity Basketball - St. Francis High School Athletics https://gogoldenknights.net/sports/mens-basketball/roster/cherif--millogo/1034 | 2026-11-04 |
| What Is the Dow Jones Index (DJIA)? Tracking US Market Giants since 1896 | StashAway Singapore https://www.stashaway.sg/r/what-is-dow-jones-index-djia | 2026-11-04 |
| Stade Rennais F.C vs Olympiacos F.C. in Rennes | Book Tickets Online at BookItPlease https://www.bookitplease.com/sports/stade-rennais-f-c-vs-olympiacos-f-c-402544 | 2026-11-04 |
| Suspected Phishing | Cloudflare https://worston.net/ | 2026-11-04 |
| cnyservices.com steht zum Verkauf: jetzt kaufen für 1.411,00 $ leasen oder Gebot abgeben | GoDaddy https://cnyservices.com/ | 2026-11-04 |
| CoinBase - Crypto Trading Platform https://www.crypto-app-fe.vercel.app/ | 2026-11-04 |
| https://suiteh.com | 2026-11-04 |
Frequently asked questions about Express
- Does using Express mean a website is unsafe?
- No. Express is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Express can be perfectly safe or actively malicious.
- How many sites using Express has ScanMalware scanned?
- Express has been detected in 6,722 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Express?
- Across scanned sites, Express is most often seen alongside Node.js, HTTP/3 and Google Analytics. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.