Substack
Substack is a wappalyzer technology that ScanMalware.com has fingerprinted across 748 public website scans. Each of those scans is a real headless-browser visit, so the data on this page reflects how Substack is actually deployed on the live web — including on compromised, phishing and malware-hosting sites, not just legitimate ones.
On sites where Substack appears, the technologies most often detected alongside it are Express, HSTS and Node.js. That co-occurrence pattern is a useful fingerprint of the stack Substack typically ships with, and a starting point for spotting deployments that look unusual.
Commonly deployed alongside Substack
Of the 748 public scans where Substack was detected, these are the technologies most often present on the same site. The share is the percentage of Substack sites that also ran each one.
| Technology | Category | Share of Substack sites |
|---|---|---|
| Express | wappalyzer | 100% |
| HSTS | wappalyzer | 100% |
| Node.js | wappalyzer | 100% |
| Cloudflare | wappalyzer | 100% |
| Cloudflare Bot Management | wappalyzer | 100% |
| HTTP/3 | wappalyzer | 99.87% |
| Open-Graph-Protocol | miscellaneous | 93.59% |
| Google Analytics | wappalyzer | 48.73% |
| Amazon S3 | wappalyzer | 19.63% |
| Amazon Web Services | wappalyzer | 19.63% |
| Cloudflare Browser Insights | wappalyzer | 14.29% |
| Script | miscellaneous | 12.68% |
| YouTube | wappalyzer | 12.28% |
| Datadog | wappalyzer | 6.68% |
How ScanMalware detects Substack
Substack is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Substack is present, but how it is being used. Open the full search interface for Substack →
Recent public scans featuring Substack
A rolling sample of recent public scans where Substack was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| Arch City Athletics Podcast Ep. 20 - Vote for the Pickerington Levy! https://www.archcityathletics.com/p/arch-city-athletics-podcast-ep-20 | 2026-11-04 |
| Los Angeles Voting Guide - Miranda July https://mirandajuly.substack.com/p/los-angeles-voting-guide | 2026-11-04 |
| Live on Election Day with Ro Khanna, Elise Hu, & Guy Kawasaki https://guykawasaki.substack.com/p/live-on-election-day-with-ro-khanna | 2026-11-04 |
| Young, Black voters are fired up — but will the enthusiasm last? https://msindy.org/p/young-black-voters-are-fired-up-but | 2026-11-03 |
| Why I Will Be Voting NO on All Five NYC Ballot Proposals https://laylalawgisiko.substack.com/p/why-i-will-be-voting-no-on-all-five | 2026-11-03 |
| Why the Midterms Are Breaking Against Trump https://christopherrufo.com/p/why-the-midterms-are-breaking-against | 2026-11-03 |
| #44 – David Remnick has a magic formula at The New Yorker https://saranwrappedletters.substack.com/p/44-david-remnick-has-a-magic-formula | 2026-11-03 |
| Off the top of my head — “the 30 Greatest Living American Songwriters” https://philipmartin.substack.com/p/off-the-top-of-my-head-the-30-greatest | 2026-11-02 |
Frequently asked questions about Substack
- Does using Substack mean a website is unsafe?
- No. Substack is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Substack can be perfectly safe or actively malicious.
- How many sites using Substack has ScanMalware scanned?
- Substack has been detected in 748 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Substack?
- Across scanned sites, Substack is most often seen alongside Express, HSTS and Node.js. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.