# Tech Stack Detector — Wappalyzer Alternative, Bulk Lookup (`actor-forge/tech-stack-detector`) Actor

Wappalyzer alternative for bulk lists: detect the CMS, ecommerce platform, frameworks, analytics, ads, CDN, hosting and 7,600+ other technologies (with versions) behind any website from one fast HTTP fetch. $1.50 per 1,000 sites; failed and bot-blocked sites are free.

- **URL**: https://apify.com/actor-forge/tech-stack-detector.md
- **Developed by:** [ActorForge](https://apify.com/actor-forge) (community)
- **Categories:** Developer tools, Lead generation, SEO tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 site analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Tech Stack Detector — Wappalyzer Alternative, Bulk Lookup

Wappalyzer alternative for bulk lists: detect the CMS, ecommerce platform, frameworks, analytics, ads, CDN, hosting and 7,600+ other technologies (with versions) behind any website from one fast HTTP fetch. $1.50 per 1,000 sites; failed and bot-blocked sites are free.

**Find out what any website is built with, for a whole list at once.** Paste domains or URLs and get one row per site with every detected technology: **CMS** (WordPress, Shopify, Webflow, Wix…), **ecommerce platform and plugins**, **JavaScript frameworks** (React, Next.js, Vue, Nuxt, Angular, Svelte), **analytics and tag managers**, **advertising pixels**, **CDN, hosting and PaaS** (Cloudflare, Vercel, AWS), **web server and language** (Nginx, PHP), **payment processors**, live chat, marketing automation and more. Each detection includes the **version** where the page reveals it, a **confidence score**, its **categories**, the vendor website, an icon URL and the **CPE** identifier for vulnerability matching. A per-site **category summary** (`{"CMS": ["WordPress"], "CDN": ["Cloudflare"]}`) makes filtering in a spreadsheet easy. Detection uses the open **webappanalyzer fingerprints** (the community continuation of Wappalyzer's, 7,600+ technologies) matched against the response headers, cookies, HTML, meta tags, script URLs, inline scripts and the static DOM from **one HTTP request per site**, with no browser, so it is fast and cheap. Use it for **lead generation and sales prospecting** (find Shopify stores, sites on a competitor's platform, companies running HubSpot), market research, competitor analysis, CRM enrichment, agency audits and security inventory (CPE + version). **$1.50 per 1,000 sites** with only the negligible platform start fee: cheaper than other paid tech-stack lookups. Sites that can't be fetched, aren't HTML or show a bot-protection challenge are returned with a reason and **not charged**.

### What data does it return?

Every run outputs clean, schema-validated rows like these:

| url | status | technologyCount | technologies | categories.CMS | server |
| --- | --- | --- | --- | --- | --- |
| https://wordpress.org/news/ | ok | 12 | WordPress 7.2, WordPress Block Editor, PHP, MySQL, Nginx, Google Tag Manager, Google Font API, Open Graph, RSS, HSTS… | WordPress | nginx |
| https://www.allbirds.com/ | ok | 10 | Shopify, Cloudflare, Google Tag Manager, PayPal, Apple Pay, Swiper, Open Graph, HTTP/3, HSTS… |  | cloudflare |
| https://nextjs.org/ | ok | 9 | Next.js, Next.js App Router, React, Vercel, Webpack, Radix UI, Open Graph, HSTS… |  | Vercel |
| https://techcrunch.com/ | ok | 16 | WordPress 6.9.10, WordPress VIP, Yoast SEO 25.1, PHP, MySQL, Cloudflare, reCAPTCHA, Sailthru, Google Tag Manager… | WordPress | cloudflare |
| https://www.glassdoor.com/ | blocked | 3 | Cloudflare, Cloudflare Bot Management, HTTP/3 (challenge page only, not charged) |  | cloudflare |

### How much does it cost?

Transparent pay-per-event pricing — you only pay for what you get, and the
actor **always respects your run budget**: set a maximum total charge and it
stops cleanly at the cap instead of overrunning.

| Event | Price | Charged | Worked example |
| --- | --- | --- | --- |
| `site-analyzed` | $0.0015 | per website fetched, analysed and delivered (all technologies, versions and categories included; DNS signals included when enabled) | 1,000 sites = $1.50; 10,000 sites = $15 |
| `apify-actor-start` | $0.00005 | per run per GB of memory (platform start fee) | One run at up to 1 GB = $0.00005 (charged as one event) |

### Input options

| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `urls` | array | yes | — | Websites to analyse — bare domains (example.com becomes https://example.com/) or full URLs (a specific page is analysed as given). Redirects are followed and the final URL is reported. Duplicates are removed. Up to 100,000 per run. |
| `maxSites` | integer | no | `1000` | Stop after this many unique sites (a safety cap for big lists). |
| `includeCategories` | array | no | `[]` | Optional: keep only technologies in these categories, by name (case-insensitive), e.g. CMS, Ecommerce, JavaScript frameworks, Analytics, Advertising, CDN, PaaS, Web servers, Payment processors, Marketing automation, Live chat, Tag managers. Leave empty for everything. Sites are charged the same either way. |
| `minConfidence` | integer | no | `50` | Drop detections below this confidence (0–100). Most fingerprints are 100; weaker hints (e.g. a generic cookie name) are 25–50. |
| `includeVersions` | boolean | no | `true` | Report version numbers where the page reveals them (generator tags, script file names, headers). |
| `includeDns` | boolean | no | `false` | Also look up the domain's MX, TXT, NS, SOA and CNAME records. Adds email providers (Google Workspace, Microsoft 365), DNS hosts and SaaS tools that publish domain-verification TXT records (Stripe, HubSpot, Atlassian, OpenAI…). Those describe the company's tooling rather than the website itself. Same price. |

### Limits & honest notes

- HTTP only, no browser: one request to each site's page (redirects followed). Technologies that only reveal themselves after JavaScript runs (Wappalyzer's `js` global-variable and `dom` property checks, XHR calls, CSS) are found only when the server-rendered page shows them. Inline code that creates a known global (e.g. `window.__remixContext =`, `<script id="__NEXT_DATA__">`) is recognised; scripts loaded later are not fetched. Single-page apps that render everything client-side show fewer technologies than a browser-based scan.
- Bot protection: sites behind a Cloudflare, DataDome, PerimeterX, Imperva, Akamai, AWS WAF or Vercel challenge (and plain 401/403/429 refusals) are returned as `status: blocked` with `blockedBy` and the CDN/WAF technologies visible on the challenge page. They are not charged. No proxies or CAPTCHA solving are used.
- Only the given page is analysed (bare domains → the homepage). Detections on other pages of the site (checkout, blog) are not included unless you pass those URLs.
- Fingerprints are the open-source webappanalyzer set (GPL-3.0, github.com/enthec/webappanalyzer, pinned commit, 7,600+ technologies), plus a few HTTP-visible additions for Next.js. Detection quality matches theirs; occasional false positives from generic patterns are possible. Confidence below 50 is hidden by default (`minConfidence`).
- With `includeDns`, MX/TXT/NS/SOA/CNAME records add email providers, DNS hosts and SaaS domain-verification records (e.g. a `stripe-verification` TXT record ⇒ Stripe). These describe the company's tooling, not necessarily the website.
- Pages larger than 3 MB are analysed from their first 3 MB. Each site has a 20-second time limit; at most 10 sites are fetched at once and at most 2 per host. Internal and private network addresses are refused.
- Respects your run budget: set a maximum total charge and the run stops cleanly at the cap, with every delivered site charged exactly once.

### Related ActorForge actors

- [Domain WHOIS & DNS Lookup](https://apify.com/actor-forge/domain-lookup)
- [SEO Audit Crawler](https://apify.com/actor-forge/seo-audit)
- [Website Screenshot API](https://apify.com/actor-forge/website-screenshot)

### Changelog

- **2026-10-19** — Initial release: webappanalyzer fingerprints (7,631 technologies) matched on headers, cookies, HTML, meta, script URLs, inline scripts and static DOM; versions, confidence, categories, CPE; implies/excludes/requires resolution; bot-challenge detection (free); optional DNS signals; category filter.

***

*Built and maintained by **ActorForge**. Reliability first: every actor in the
portfolio is monitored by an automated nightly self-test, and breakages are
typically fixed the same day.*

# Actor input Schema

## `urls` (type: `array`):

Websites to analyse — bare domains (example.com becomes https://example.com/) or full URLs (a specific page is analysed as given). Redirects are followed and the final URL is reported. Duplicates are removed. Up to 100,000 per run.

## `maxSites` (type: `integer`):

Stop after this many unique sites (a safety cap for big lists).

## `includeCategories` (type: `array`):

Optional: keep only technologies in these categories, by name (case-insensitive), e.g. CMS, Ecommerce, JavaScript frameworks, Analytics, Advertising, CDN, PaaS, Web servers, Payment processors, Marketing automation, Live chat, Tag managers. Leave empty for everything. Sites are charged the same either way.

## `minConfidence` (type: `integer`):

Drop detections below this confidence (0–100). Most fingerprints are 100; weaker hints (e.g. a generic cookie name) are 25–50.

## `includeVersions` (type: `boolean`):

Report version numbers where the page reveals them (generator tags, script file names, headers).

## `includeDns` (type: `boolean`):

Also look up the domain's MX, TXT, NS, SOA and CNAME records. Adds email providers (Google Workspace, Microsoft 365), DNS hosts and SaaS tools that publish domain-verification TXT records (Stripe, HubSpot, Atlassian, OpenAI…). Those describe the company's tooling rather than the website itself. Same price.

## Actor input object example

```json
{
  "urls": [
    "wordpress.org",
    "https://www.allbirds.com",
    "nextjs.org",
    "techcrunch.com"
  ],
  "maxSites": 1000,
  "includeCategories": [],
  "minConfidence": 50,
  "includeVersions": true,
  "includeDns": false
}
```

# Actor output Schema

## `results` (type: `string`):

One row per website with detected technologies, a category summary and server headers.

## `technologies` (type: `string`):

One row per site × technology (name, version, confidence, categories).

## `summary` (type: `string`):

Sites analysed, blocked by bot protection and failed (the last two are not charged), plus the fingerprint version used.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "wordpress.org",
        "https://www.allbirds.com",
        "nextjs.org",
        "techcrunch.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("actor-forge/tech-stack-detector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "wordpress.org",
        "https://www.allbirds.com",
        "nextjs.org",
        "techcrunch.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("actor-forge/tech-stack-detector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "wordpress.org",
    "https://www.allbirds.com",
    "nextjs.org",
    "techcrunch.com"
  ]
}' |
apify call actor-forge/tech-stack-detector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,actor-forge/tech-stack-detector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/n4bmKGoWqr3cp6ch0/builds/wWb4II87Xk0Dhbm1l/openapi.json