Firebase
Firebase is a wappalyzer technology that ScanMalware.com has fingerprinted across 2,774 public website scans. Each of those scans is a real headless-browser visit, so the data on this page reflects how Firebase is actually deployed on the live web — including on compromised, phishing and malware-hosting sites, not just legitimate ones.
On sites where Firebase appears, the technologies most often detected alongside it are HTTP/3, HSTS and Meta-Refresh-Redirect. That co-occurrence pattern is a useful fingerprint of the stack Firebase typically ships with, and a starting point for spotting deployments that look unusual.
Commonly deployed alongside Firebase
Of the 2,774 public scans where Firebase was detected, these are the technologies most often present on the same site. The share is the percentage of Firebase sites that also ran each one.
| Technology | Category | Share of Firebase sites |
|---|---|---|
| HTTP/3 | wappalyzer | 99.57% |
| HSTS | wappalyzer | 97.41% |
| Meta-Refresh-Redirect | miscellaneous | 10.23% |
| Cloudflare | wappalyzer | 9.98% |
| X-UA-Compatible | miscellaneous | 8.83% |
| Open-Graph-Protocol | miscellaneous | 6.41% |
| Cloudflare Bot Management | wappalyzer | 5.98% |
| Google Analytics | wappalyzer | 5.69% |
| jQuery | wappalyzer | 4.18% |
| Cloudflare Turnstile | wappalyzer | 3.57% |
| reCAPTCHA | wappalyzer | 3.5% |
| PasswordField | miscellaneous | 3.35% |
| PoweredBy | miscellaneous | 3.21% |
| WordPress | cms | 2.63% |
How ScanMalware detects Firebase
Firebase is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Firebase is present, but how it is being used. Open the full search interface for Firebase →
Recent public scans featuring Firebase
A rolling sample of recent public scans where Firebase was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| SignalAlert | Professional Stock Signals https://signalalert.io | 2026-10-05 |
| Correos https://correosdecr.web.app | 2026-10-05 |
| Hestvik Consulting https://hestvik.se | 2026-10-05 |
| Background https://zimbra-security4989344.firebaseapp.com/ | 2026-10-05 |
| Background https://zimbra-security4989344.web.app/ | 2026-10-05 |
| WalletLink https://mainnethub-protocol.firebaseapp.com/ | 2026-10-05 |
| WalletLink https://mainnethub-protocol.web.app/ | 2026-10-05 |
| Background https://audio-message-listen3004.firebaseapp.com/ | 2026-10-05 |
Frequently asked questions about Firebase
- Does using Firebase mean a website is unsafe?
- No. Firebase is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Firebase can be perfectly safe or actively malicious.
- How many sites using Firebase has ScanMalware scanned?
- Firebase has been detected in 2,774 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Firebase?
- Across scanned sites, Firebase is most often seen alongside HTTP/3, HSTS and Meta-Refresh-Redirect. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.