Tech Stack Detector — Wappalyzer Alternative, Bulk Lookup

Wappalyzer alternative for bulk lists: detect the CMS, ecommerce platform, frameworks, analytics, ads, CDN, hosting and 7,600+ other technologies (with versions) behind any website from one fast HTTP fetch. $1.50 per 1,000 sites; failed and bot-blocked sites are free.

Find out what any website is built with, for a whole list at once. Paste domains or URLs and get one row per site with every detected technology: CMS (WordPress, Shopify, Webflow, Wix…), ecommerce platform and plugins, JavaScript frameworks (React, Next.js, Vue, Nuxt, Angular, Svelte), analytics and tag managers, advertising pixels, CDN, hosting and PaaS (Cloudflare, Vercel, AWS), web server and language (Nginx, PHP), payment processors, live chat, marketing automation and more. Each detection includes the version where the page reveals it, a confidence score, its categories, the vendor website, an icon URL and the CPE identifier for vulnerability matching. A per-site category summary ({"CMS": ["WordPress"], "CDN": ["Cloudflare"]}) makes filtering in a spreadsheet easy. Detection uses the open webappanalyzer fingerprints (the community continuation of Wappalyzer's, 7,600+ technologies) matched against the response headers, cookies, HTML, meta tags, script URLs, inline scripts and the static DOM from one HTTP request per site, with no browser, so it is fast and cheap. Use it for lead generation and sales prospecting (find Shopify stores, sites on a competitor's platform, companies running HubSpot), market research, competitor analysis, CRM enrichment, agency audits and security inventory (CPE + version). $1.50 per 1,000 sites with only the negligible platform start fee: cheaper than other paid tech-stack lookups. Sites that can't be fetched, aren't HTML or show a bot-protection challenge are returned with a reason and not charged.

What data does it return?

Every run outputs clean, schema-validated rows like these:

url	status	technologyCount	technologies	categories.CMS	server
https://wordpress.org/news/	ok	12	WordPress 7.2, WordPress Block Editor, PHP, MySQL, Nginx, Google Tag Manager, Google Font API, Open Graph, RSS, HSTS…	WordPress	nginx
https://www.allbirds.com/	ok	10	Shopify, Cloudflare, Google Tag Manager, PayPal, Apple Pay, Swiper, Open Graph, HTTP/3, HSTS…		cloudflare
https://nextjs.org/	ok	9	Next.js, Next.js App Router, React, Vercel, Webpack, Radix UI, Open Graph, HSTS…		Vercel
https://techcrunch.com/	ok	16	WordPress 6.9.10, WordPress VIP, Yoast SEO 25.1, PHP, MySQL, Cloudflare, reCAPTCHA, Sailthru, Google Tag Manager…	WordPress	cloudflare
https://www.glassdoor.com/	blocked	3	Cloudflare, Cloudflare Bot Management, HTTP/3 (challenge page only, not charged)		cloudflare

How much does it cost?

Transparent pay-per-event pricing — you only pay for what you get, and the actor always respects your run budget: set a maximum total charge and it stops cleanly at the cap instead of overrunning.

Event	Price	Charged	Worked example
site-analyzed	$0.0015	per website fetched, analysed and delivered (all technologies, versions and categories included; DNS signals included when enabled)	1,000 sites = $1.50; 10,000 sites = $15
apify-actor-start	$0.00005	per run per GB of memory (platform start fee)	One run at up to 1 GB = $0.00005 (charged as one event)

Input options

Field	Type	Required	Default	Description
urls	array	yes	—	Websites to analyse — bare domains (example.com becomes https://example.com/) or full URLs (a specific page is analysed as given). Redirects are followed and the final URL is reported. Duplicates are removed. Up to 100,000 per run.
maxSites	integer	no	1000	Stop after this many unique sites (a safety cap for big lists).
includeCategories	array	no	[]	Optional: keep only technologies in these categories, by name (case-insensitive), e.g. CMS, Ecommerce, JavaScript frameworks, Analytics, Advertising, CDN, PaaS, Web servers, Payment processors, Marketing automation, Live chat, Tag managers. Leave empty for everything. Sites are charged the same either way.
minConfidence	integer	no	50	Drop detections below this confidence (0–100). Most fingerprints are 100; weaker hints (e.g. a generic cookie name) are 25–50.
includeVersions	boolean	no	true	Report version numbers where the page reveals them (generator tags, script file names, headers).
includeDns	boolean	no	false	Also look up the domain's MX, TXT, NS, SOA and CNAME records. Adds email providers (Google Workspace, Microsoft 365), DNS hosts and SaaS tools that publish domain-verification TXT records (Stripe, HubSpot, Atlassian, OpenAI…). Those describe the company's tooling rather than the website itself. Same price.

Limits & honest notes

• HTTP only, no browser: one request to each site's page (redirects followed). Technologies that only reveal themselves after JavaScript runs (Wappalyzer's js global-variable and dom property checks, XHR calls, CSS) are found only when the server-rendered page shows them. Inline code that creates a known global (e.g. window.__remixContext =, <script id="__NEXT_DATA__">) is recognised; scripts loaded later are not fetched. Single-page apps that render everything client-side show fewer technologies than a browser-based scan.
• Bot protection: sites behind a Cloudflare, DataDome, PerimeterX, Imperva, Akamai, AWS WAF or Vercel challenge (and plain 401/403/429 refusals) are returned as status: blocked with blockedBy and the CDN/WAF technologies visible on the challenge page. They are not charged. No proxies or CAPTCHA solving are used.
• Only the given page is analysed (bare domains → the homepage). Detections on other pages of the site (checkout, blog) are not included unless you pass those URLs.
• Fingerprints are the open-source webappanalyzer set (GPL-3.0, github.com/enthec/webappanalyzer, pinned commit, 7,600+ technologies), plus a few HTTP-visible additions for Next.js. Detection quality matches theirs; occasional false positives from generic patterns are possible. Confidence below 50 is hidden by default (minConfidence).
• With includeDns, MX/TXT/NS/SOA/CNAME records add email providers, DNS hosts and SaaS domain-verification records (e.g. a stripe-verification TXT record ⇒ Stripe). These describe the company's tooling, not necessarily the website.
• Pages larger than 3 MB are analysed from their first 3 MB. Each site has a 20-second time limit; at most 10 sites are fetched at once and at most 2 per host. Internal and private network addresses are refused.
• Respects your run budget: set a maximum total charge and the run stops cleanly at the cap, with every delivered site charged exactly once.

Related ActorForge actors

• Domain WHOIS & DNS Lookup
• SEO Audit Crawler
• Website Screenshot API

Changelog

• 2026-10-19 — Initial release: webappanalyzer fingerprints (7,631 technologies) matched on headers, cookies, HTML, meta, script URLs, inline scripts and static DOM; versions, confidence, categories, CPE; implies/excludes/requires resolution; bot-challenge detection (free); optional DNS signals; category filter.

---

Built and maintained by ActorForge. Reliability first: every actor in the portfolio is monitored by an automated nightly self-test, and breakages are typically fixed the same day.