How to Tell If a Website Uses Square

Square (from Block, Inc.) is a payments platform best known for unifying in-person and online sales for small and omnichannel businesses. To tell whether a website uses it, the quickest answer is to open a checkout page and look for the Web Payments SDK from web.squarecdn.com and the global Square object. This guide covers every reliable signal, the architecture behind them, and what a Square integration tells you about the business.

What is Square?

Square began as a mobile card reader for small merchants and grew into a full commerce ecosystem spanning point-of-sale hardware, payments, a website and online-store builder (Square Online), invoicing, appointments and more. Its defining characteristic is omnichannel unification: a café, salon, boutique or market stall can take payments in person with Square hardware and online through the same account, with inventory, customers and reporting joined up. That makes Square especially common among small, local and service businesses — retail, food and beverage, beauty, fitness and professional services.

For detection, the key context is that online Square payments almost always imply a business already embedded in Square's ecosystem, frequently using its POS hardware too. So finding Square online is a strong signal of a small-to-mid-sized, often local, omnichannel merchant. Square sites come in two flavours: custom sites that integrate Square's Web Payments SDK for checkout, and hosted Square Online stores served on square.site domains — each with its own recognisable footprint.

How Square loads and processes payments

A custom Square checkout loads the Web Payments SDK from https://web.squarecdn.com/v1/square.js (sandbox uses sandbox.web.squarecdn.com; older integrations used the Square Payment Form from js.squareup.com/v2/paymentform). The SDK exposes a global Square object, and the integration calls Square.payments(applicationId, locationId) to initialise payments, then renders card fields with payments.card(). The application ID identifies the Square developer app (production IDs are prefixed sq0idp-), and the location ID identifies the specific business location.

As with other modern processors, Square renders card inputs inside iframes served from squarecdn.com/squareup.com for PCI isolation, and payment tokenisation and processing talk to Square's endpoints on squareup.com (and connect.squareup.com server-side). Hosted Square Online stores are a separate signal: they are served on square.site or square.online domains (sometimes mapped to a custom domain) and load Square assets throughout. Knowing these two patterns — the Web Payments SDK with app and location IDs, and the square.site hosted stores — makes Square straightforward to recognise.

How to tell if a website uses Square

Confirm at least two of the following, ideally on a checkout page.

1. Check the Network tab. Reload the checkout and filter for square. You will see web.squarecdn.com/v1/square.js (or the legacy js.squareup.com/v2/paymentform) load, plus calls to squareup.com. This is the most reliable method.

2. Use the console. Type Square and press Enter. A returned object exposing payments confirms the Web Payments SDK is loaded.

3. Inspect the card fields. Card inputs rendered inside squarecdn.com/squareup.com iframes are a strong, characteristic Square signal.

4. Check the domain. If the store is served on a square.site or square.online domain (or you see those in canonical/asset URLs), it is a hosted Square Online store.

5. Read the application and location IDs. A sq0idp- application ID and a location ID in the source confirm Square and identify the merchant and location.

What the Square signals look like

<script src="https://web.squarecdn.com/v1/square.js"></script>
const payments = Square.payments("sq0idp-AbC123…", "L7XYZ…");   // applicationId, locationId
<iframe src="https://web.squarecdn.com/…/single-card.html" …></iframe>
// Hosted store served on: https://example.square.site/

The combination of the web.squarecdn.com SDK, the global Square object, and card iframes from squarecdn.com (or a square.site domain) is conclusive.

Square versus other processors — avoiding false positives

Match the host to keep processors distinct. Square uses web.squarecdn.com/squareup.com; Stripe uses js.stripe.com; PayPal uses paypal.com/sdk/js; Braintree uses js.braintreegateway.com. Square's squarecdn.com host and the sq0idp- application-ID prefix are unique to it. A useful distinction is between a custom site integrating the Web Payments SDK and a hosted Square Online store on square.site — both are Square, but they tell you different things about how the business built its presence. Note also that Square powers other surfaces (invoices on squareup.com, appointment booking), so a Square checkout can appear in contexts beyond a traditional product store.

How reliable is each Square signal?

The web.squarecdn.com SDK and the global Square object are definitive. Card iframes from squarecdn.com/squareup.com are equally strong. A square.site/square.online domain conclusively identifies a hosted Square Online store. The sq0idp- application ID and the location ID are unambiguous and identify the merchant. The legacy js.squareup.com/v2/paymentform is reliable for older integrations. The weakest case is a landing page that loads Square only at checkout, so test the payment page. As a rule, the SDK host or a square.site domain settles it.

What a Square integration reveals about a business

Finding Square is a strong indicator of a small, local or omnichannel business embedded in the Square ecosystem — very often one that also takes in-person payments with Square hardware. The profile skews toward retail shops, restaurants and cafés, salons and spas, fitness studios, and independent service providers. A hosted Square Online store specifically signals a business that wanted an all-in-one, easy-to-run online presence tied to its POS, rather than a developer-built site. If you sell to SMBs — local marketing, loyalty, scheduling, accounting, or hospitality and retail tooling — a Square integration marks an ideal-fit, transacting small business. The application and location IDs can even help you recognise multi-location operators running several sites from one Square account.

Square in a small-business stack

Square tends to anchor a compact, SMB-oriented stack. A hosted Square Online store bundles the site, cart, payments and often inventory in one place, so you may find few other commerce tools. A custom site using the Web Payments SDK pairs Square with whatever framework the developer chose, plus perhaps a booking or CRM tool. Because Square unifies channels, the online site is usually just one expression of a business that also sells in person, so the absence of a large martech stack is itself informative — these are operators focused on running a business, not optimising a funnel. For an auditor, the valuable details are whether the site is hosted Square Online or a custom SDK integration, the application and location IDs, and any booking or loyalty tools; together these characterise the size and type of the business behind it.

A quick Square confirmation walkthrough

Open the site's checkout, booking or store page with developer tools on the Network panel and filter for square. Look for web.squarecdn.com/v1/square.js (or the legacy js.squareup.com/v2/paymentform). Switch to the Console and type Square to confirm the SDK and its payments method. Inspect the card fields for squarecdn.com iframes. Check the address bar and canonical URL for a square.site/square.online domain, which marks a hosted store. Search the source for a sq0idp- application ID and location ID. Two signals confirm Square and tell you whether it is a hosted or custom build.

A quick Square detection checklist

• On the checkout, filter the Network tab for square; the web.squarecdn.com SDK is conclusive.
• Type Square in the console to confirm the payments method.
• Inspect card fields for squarecdn.com/squareup.com iframes.
• Check for a square.site/square.online domain (hosted Square Online).
• Read the sq0idp- application ID and location ID.
• Distinguish hosted Square Online from a custom Web Payments SDK build.

Online plus in-person: the omnichannel signal

The most valuable thing a Square detection tells you is rarely just "this site takes payments" — it is that the business almost certainly operates in person too. Square's whole proposition is unifying a physical and online operation in one account, so an online Square checkout usually implies a café, shop, salon, studio or market trader that also rings up sales on Square hardware. That single inference is worth more than the payment method itself: it tells you the business has a physical footprint, local customers, and operational needs (scheduling, inventory, staff, loyalty) that a purely online merchant would not.

The flavour of the Square presence sharpens the picture further. A hosted Square Online store (on a square.site domain) signals a business that wanted an all-in-one online presence tied to its POS with minimal effort — a strong indicator of a small operator without dedicated web resources. A custom site using the Web Payments SDK indicates a business that invested in a bespoke site but still chose Square to keep payments unified with its in-person sales. Multi-location operators can sometimes be spotted by shared application IDs across several sites. For anyone selling to local and SMB merchants — scheduling, loyalty, local marketing, hospitality or retail software — a Square detection is a precise, high-intent signal of exactly the kind of omnichannel small business you want to reach, which is why reading it carefully pays off.

Detecting Square at scale

Checking one site is quick, but finding every Square merchant across a region or sector — to prospect local and omnichannel SMBs — calls for automation. StackOptic detects Square (custom SDK and hosted Square Online) and thousands of other technologies from a real browser. For related reading, see our guide to finding out what payment processor a website uses and the full Square technology profile.