Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Sichere ProgrammierungRefreshed repository pull requests page generally available(22.09.2026 um 03:25 Uhr)
Sichere ProgrammierungThe Joy of Learning the Basics Again(22.09.2026 um 03:28 Uhr)
Sichere ProgrammierungZero-Code OpenTelemetry Tracing for Dagster(22.09.2026 um 03:39 Uhr)
Linux Tipps & Hardening`prime-all`(22.09.2026 um 02:28 Uhr)
IT Security Toolsopensoho v0.15.2(22.09.2026 um 03:33 Uhr)
IT Security NachrichtenUS Proposes AI Incident Alert System in Talks With China, Bessent Says(22.09.2026 um 04:01 Uhr)
Sichere ProgrammierungRefreshed repository pull requests page generally available(22.09.2026 um 03:25 Uhr)
Sichere ProgrammierungThe Joy of Learning the Basics Again(22.09.2026 um 03:28 Uhr)
Sichere ProgrammierungZero-Code OpenTelemetry Tracing for Dagster(22.09.2026 um 03:39 Uhr)
Linux Tipps & Hardening`prime-all`(22.09.2026 um 02:28 Uhr)
IT Security Toolsopensoho v0.15.2(22.09.2026 um 03:33 Uhr)
IT Security NachrichtenUS Proposes AI Incident Alert System in Talks With China, Bessent Says(22.09.2026 um 04:01 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

How to Detect if a Website Uses Intercom: 5 Methods

Intercom is one of the most popular customer messaging platforms on the web. Companies use it for live chat, in-app messaging, help centers, and product tours—making it a key indicator of how a business handles customer communication. From …

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Intercom is one of the most popular customer messaging platforms on the web. Companies use it for live chat, in-app messaging, help centers, and product tours—making it a key indicator of how a business handles customer communication. From the outside, the familiar chat bubble in the bottom-right corner is a strong hint, but it is not always visible: some sites customize or delay-load the widget, and others use Intercom only for backend messaging without a visible launcher.



Whether you are qualifying sales leads, analyzing a competitor’s support stack, auditing third-party scripts for security, or planning a migration off Intercom, reliably detecting it matters. This guide covers five methods: from quick manual checks to a fully programmatic API approach that works at scale.






Why Detect Intercom on a Website



Intercom is more than a chat widget. Detecting it on a website tells you several things about the business behind it.



Budget signal. Intercom pricing starts around $39/month for very small teams and scales to $139/month or more for growth-stage companies. Businesses running Intercom have allocated budget for customer communication tooling—they are not using a free contact form.



Customer engagement maturity. Intercom implies a proactive approach to customer support and engagement. Sites running Intercom typically have a support team, defined response SLAs, and automated workflows. This is useful context for sales prospecting: these are companies that invest in customer experience.



Third-party script inventory. For security teams, knowing that Intercom’s JavaScript is loaded on a site matters. The Intercom messenger injects iframes, loads external scripts from intercomcdn.com, and sets persistent cookies. Any third-party script with that level of page access is worth tracking in a vendor audit.



Migration planning. If you are evaluating a move from Intercom to Zendesk, Drift, Crisp, or another platform, the first step is understanding exactly which Intercom features are in use: just the messenger widget, or also articles, product tours, and automated messages. The detection methods below help you inventory the integration depth.






Method 1 — Check the Page Source for Intercom Scripts



The simplest way to detect Intercom is to view the page source and search for its script signatures. In any browser, press Ctrl+U (or Cmd+Option+U on macOS) to view source, then search for these strings:





  • widget.intercom.io — the Intercom messenger widget stylesheet


  • intercomcdn.com — Intercom’s CDN for JavaScript assets


  • api.intercom.io — the Intercom API endpoint for messenger initialization


  • intercom in inline script blocks — the window.intercomSettings configuration object






What to Look For in the HTML



The standard Intercom installation embeds a JavaScript snippet that configures and boots the messenger. It typically looks like this:




<script>
window.intercomSettings = {
api_base: "https://api-iam.intercom.io",
app_id: "abc123de"
};
</script>
<script>
(function(){var w=window;var ic=w.Intercom;if(typeof ic==="function"){
ic('reattach_activator');ic('update',w.intercomSettings);}else{
var d=document;var i=function(){i.c(arguments);};i.q=[];i.c=function(args){
i.q.push(args);};w.Intercom=i;var l=function(){var s=d.createElement('script');
s.type='text/javascript';s.async=true;
s.src='https://widget.intercom.io/widget/abc123de';
var x=d.getElementsByTagName('script')[0];
x.parentNode.insertBefore(s,x);};l();}})();
</script>






The app_id value (abc123de in this example) identifies the Intercom workspace. Every Intercom account has a unique app ID, which appears in both the intercomSettings object and the widget script URL.

































Script Pattern Component What It Means
widget.intercom.io/widget/{app_id} Messenger widget Live chat and in-app messaging active
static.intercomcdn.com CDN assets Intercom JavaScript bundle loaded
api.intercom.io API endpoint Messenger communicating with Intercom backend
window.intercomSettings Config object Intercom initialized with workspace settings



Limitation: Viewing page source only shows scripts in the initial HTML. If Intercom is loaded after cookie consent or on specific pages only (e.g., the app dashboard but not the marketing site), it will not appear in the source of every page. Method 3 catches these cases by checking what the browser actually rendered.







Method 2 — Inspect Cookies and Local Storage



Intercom sets distinctive cookies and local storage entries that persist even if the messenger widget is not visible on the current page. Open Chrome DevTools (F12), go to Application > Cookies, and look for these patterns:






Intercom Cookies




























Cookie Name Pattern Purpose Lifetime
intercom-session-{app_id} Session tracking for the messenger 1 week
intercom-id-{app_id} Anonymous visitor identity 9 months
intercom-device-id-{app_id} Device fingerprint for cross-session tracking 9 months


The {app_id} in the cookie name matches the workspace ID from the script installation. If you see any cookie starting with intercom-, that site runs Intercom.






Local Storage Entries



Intercom also writes to localStorage. In DevTools, go to Application > Local Storage and look for keys starting with intercom.:





  • intercom.intercom-state-{app_id} — messenger state (open/closed, unread count)


  • intercom.intercom-id — visitor identity token



Local storage entries persist across browser sessions and are a reliable indicator even when the Intercom widget has not fully loaded on the current page.




Note: Cookies and local storage are set by client-side JavaScript, not by the server. A simple curl request will not trigger them. For cookie-based detection, you need to visit the site in a browser or headless browser that executes JavaScript.







Method 3 — Look for the Intercom Messenger Widget in the DOM



Once Intercom loads, it injects specific DOM elements into the page. These are reliable fingerprints because they use fixed IDs and attribute patterns that Intercom has maintained across versions.



Open Chrome DevTools (F12), go to the Console tab, and run these checks:




// Check for the Intercom messenger iframe
document.querySelector('iframe#intercom-frame')
// Returns the iframe element if Intercom is loaded, null otherwise

// Check for the Intercom widget stylesheet
document.querySelector('link[href*="widget.intercom.io"]')
// Returns the link element if present

// Check for the Intercom launcher (the chat bubble)
document.querySelector('.intercom-launcher')
// Returns the launcher button element






If any of these return an element (not null), Intercom is active on the page.

































DOM Selector Element What It Confirms
iframe#intercom-frame Messenger iframe Intercom messenger widget is loaded and rendered
link[href*="widget.intercom.io"] Widget stylesheet Intercom CSS has been injected into the page
.intercom-launcher Chat bubble The visible launcher button is present
#intercom-container Widget container The messenger container div exists in the DOM


DOM inspection catches Intercom even when it is loaded dynamically after page load, behind a cookie consent banner, or via a tag manager like Google Tag Manager. It is more reliable than source inspection for single-page applications where the initial HTML is minimal.






Method 4 — Check the JavaScript Global Object



Intercom exposes a global window.Intercom function that serves as its public API. This is one of the most reliable detection methods because Intercom requires this global to function—it cannot operate without it.



In the browser console:




// Check if the Intercom global exists
typeof window.Intercom
// Returns "function" if Intercom is loaded, "undefined" otherwise

// Get the Intercom app ID from the booted instance
window.Intercom.booted
// Returns true if the messenger has been initialized






The window.Intercom function is used by the site’s own code to control the messenger: showing/hiding it, passing user data, triggering messages. Because it is part of Intercom’s public API contract, it is stable across versions and not likely to change.



You can also extract configuration details:




// If intercomSettings is available, read the app ID
window.intercomSettings && window.intercomSettings.app_id
// Returns the workspace app ID (e.g., "abc123de")







Tip: Methods 3 and 4 (DOM and JavaScript global) require visiting the page in a browser. For automated detection across many domains, Method 5 (the API approach) handles this by performing full HTTP analysis server-side, including JavaScript fingerprinting.







Method 5 — Use the DetectZeStack API for Programmatic Detection



When you need to detect Intercom across hundreds or thousands of domains—for lead qualification, market research, or vendor auditing—manual methods do not scale. The DetectZeStack API detects Intercom via HTTP fingerprinting in a single request, alongside 7,300+ other technologies.






Single URL Analysis with curl



Try it without signing up. The /demo endpoint is rate-limited to 20 requests per hour per IP, but requires no authentication:




$ curl -s "https://detectzestack.com/demo?url=intercom.com" | jq '.'
{
"url": "https://intercom.com",
"domain": "intercom.com",
"technologies": [
{
"name": "Intercom",
"categories": ["Live chat", "Customer engagement"],
"confidence": 100,
"source": "http"
},
{
"name": "React",
"categories": ["JavaScript frameworks"],
"confidence": 100,
"source": "http"
},
...
],
"categories": {
"Live chat": ["Intercom"],
"Customer engagement": ["Intercom"],
"JavaScript frameworks": ["React"],
...
},
"meta": {
"status_code": 200,
"tech_count": 18,
"scan_depth": "full"
},
"cached": false,
"response_ms": 920
}






Notice the source: "http" field on Intercom—the API detected it through HTTP fingerprinting, matching script patterns like widget.intercom.io and DOM elements like iframe#intercom-frame. This is the automated equivalent of Methods 1 through 4 combined.






Batch Detection Across Multiple Sites



For production use, the /analyze endpoint supports higher rate limits and is available through RapidAPI. To scan multiple domains, use the /analyze/batch endpoint:




$ curl -s -X POST "https://detectzestack.p.rapidapi.com/analyze/batch" \
-H "X-RapidAPI-Key: YOUR_KEY" \
-H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
-H "Content-Type: application/json" \
-d '{"urls": ["intercom.com", "drift.com", "zendesk.com"]}' | jq '.'






The batch endpoint accepts up to 10 URLs per request and returns results for each domain. This is ideal for building a spreadsheet of which prospects use Intercom versus competing live chat platforms like Drift, Zendesk, Crisp, or LiveChat.






Reading the API Response



The response structure makes it straightforward to filter for Intercom and related customer engagement technologies:




# Check if Intercom is present on a site
$ curl -s "https://detectzestack.com/demo?url=example.com" | \
jq '.technologies[] | select(.name == "Intercom")'

# Find all live chat tools on a site
$ curl -s "https://detectzestack.com/demo?url=example.com" | \
jq '.categories["Live chat"]'






The categories object groups technologies by function. Intercom appears under “Live chat” and “Customer engagement”. You can use this to find all customer communication tools on a site at once—Intercom alongside tools like Zendesk, Drift, Freshdesk, or HubSpot.






Common Use Cases for Intercom Detection






Competitive Intelligence for Sales Teams



If you sell customer support software, CRM tools, or competing messaging platforms, knowing which companies use Intercom is directly actionable. Intercom customers have already committed to a customer messaging strategy and have budget allocated for it. They are qualified prospects for any product that integrates with or replaces Intercom.



Combine Intercom detection with other tech stack signals to build richer prospect profiles. A company running Intercom alongside HubSpot likely has a mature marketing and support stack. A company using Intercom with Stripe has an online payment flow and is likely a SaaS or e-commerce business. These combinations tell you more than any single technology detection. For a deeper look at using technographic data in sales, see Sales Teams: Competitive Intelligence with Tech Stack Data.






Security Auditing Third-Party Scripts



Intercom’s messenger loads external JavaScript, injects iframes, sets persistent cookies, and writes to local storage. For security-conscious organizations, tracking which third-party scripts have this level of access is essential for vendor auditing and compliance.



Use the DetectZeStack API to inventory all third-party scripts on your domains. Intercom is one of many live chat and analytics tools that inject client-side code—knowing exactly which ones are present helps you assess your attack surface and maintain an accurate vendor register.






Migration Planning



If you are considering a switch from Intercom to another platform (or the reverse), the detection methods above tell you exactly which Intercom components are in use. A site that only loads the messenger widget is a simpler migration than one using Intercom Articles (help center), Product Tours, and automated messaging workflows.



The API response categorizes Intercom under “Live chat” and “Customer engagement.” If the API also detects “Intercom Articles” (a separate technology entry), you know the help center is in use too—that is a larger migration scope.






Intercom Detection at Scale



Here is a practical Python script to scan a list of domains and flag which ones use Intercom:




import requests
import csv
import time

API_URL = "https://detectzestack.p.rapidapi.com/analyze"
HEADERS = {
"X-RapidAPI-Key": "YOUR_KEY",
"X-RapidAPI-Host": "detectzestack.p.rapidapi.com"
}

domains = ["intercom.com", "drift.com", "zendesk.com", "crisp.chat"]

with open("intercom_audit.csv", "w", newline="") as f:
writer = csv.writer(f)
writer.writerow(["domain", "has_intercom", "categories", "other_live_chat"])

for domain in domains:
resp = requests.get(API_URL, headers=HEADERS, params={"url": domain})
data = resp.json()

intercom = [
t for t in data.get("technologies", [])
if t["name"] == "Intercom"
]

live_chat = data.get("categories", {}).get("Live chat", [])
other_chat = [t for t in live_chat if t != "Intercom"]

if intercom:
tech = intercom[0]
writer.writerow([
domain, True,
", ".join(tech.get("categories", [])),
", ".join(other_chat) if other_chat else ""
])
print(f"{domain}: Intercom detected")
else:
writer.writerow([domain, False, "", ", ".join(live_chat)])
print(f"{domain}: no Intercom")

time.sleep(0.5) # respect rate limits






This produces a CSV with each domain, whether Intercom was found, its categories, and any competing live chat tools detected on the same site. For a more complete tutorial covering batch endpoints and error handling, see Detect Any Website’s Tech Stack with Python.






Conclusion and Next Steps



Detecting Intercom manually works for one-off checks: view the source for widget.intercom.io, check cookies for intercom-session- prefixes, look for iframe#intercom-frame in the DOM, or test window.Intercom in the console. Each method catches a different aspect of the integration.



For anything beyond a handful of sites—building prospect lists, monitoring competitor stacks, or auditing vendor dependencies—the DetectZeStack API automates all detection methods in a single request. One call returns Intercom, HubSpot, Google Analytics, and every other technology on the site, with structured JSON output that feeds directly into your pipeline.






Related Reading



Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten How to Detect if a Website Uses Intercom: 5 Methods

Thematisch verwandte Begriffe: Detect, Website, Uses, Intercom · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-49449 | Joplin is an open source note-taking and to-do application that organise…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick