Tech Stack Scanner & Shopify App Detector

Detect what any website runs — ecommerce platform, CMS, framework, analytics, ad pixels, payments, support chat, CDN, hosting — plus, on Shopify stores, which apps are installed, the theme, and Plus status. Re-run the same list and it tells you exactly what changed.

No API key. No proxy. No login. One public request per domain.

Shopify app detector

Point it at a store and get the installed apps: Klaviyo, Attentive, Postscript, Gorgias, Yotpo, Okendo, Judge.me, Loox, Recharge, Rebuy, Smile.io, Triple Whale, Northbeam, Elevar, Swym, Back in Stock, PageFly, Shogun and more — with the theme name, whether it's a custom theme, currency and country.

Find stores using Klaviyo, Yotpo, Recharge or any other app

Pass a list of stores and mustUseAny: ["Yotpo"]. You get back only the stores running it. That is a list of merchants who have already proven they pay for that category of app — they just picked someone else.

Shopify app install and uninstall alerts

Re-run weekly and the Actor reports app changes per store: added: ["Klaviyo"], removed: ["Yotpo"]. A store that just removed a review app is shopping for a review app this week. That is a two-week window, and it is the whole reason to run this on a schedule instead of once.

WordPress plugin detector

Every plugin a WordPress site loads — not a curated list, the actual slugs from /wp-content/plugins/, so custom and private plugins show up too. With version numbers where the site exposes them, the active theme, WordPress core version, and a flag for slugs that look commercial (-pro, -premium).

Find WordPress sites running an outdated plugin version

Plugin slug plus version is exposure data. Scan a list, filter on plugins_with_version, and you have the sites running a given plugin below a given release — which is what security vendors and researchers actually want and what plugin vendors use to prompt upgrades.

Ad monetisation stack from ads.txt

Parse the publisher's own IAB ads.txt: every ad system authorised to sell its inventory, which are DIRECT and which are RESELLER, the managed partner running monetisation (Mediavine, Raptive, Ezoic, AdPushup, Freestar…), and OWNERDOMAIN, which frequently reveals the parent media group. When a publisher switches ad partners, this file changes first.

Security header posture and grade

Every scan returns an A–F grade computed from CSP quality (nonce/hash/strict-dynamic vs unsafe-inline/unsafe-eval/wildcards), HSTS max-age and preload, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP, cookie flags, and version disclosure in Server or X-Powered-By. No extra request — it is read off the response already fetched.

Website technology lookup

130+ technologies across 24 categories, each with a confidence level and a version where the site exposes one.

Tech stack change monitoring

Every re-run diffs against your previous scan and returns added, removed and previous_scan_at. WooCommerce → Shopify. Zendesk → Gorgias. Universal Analytics → GA4. Those migrations are buying events.

---

Why this beats a plain tech-lookup scraper

	This Actor	Typical tech-detection scraper
Change detection between runs	Yes — added/removed + previous scan date	No
Shopify apps installed	35 apps, categorised	No
WordPress plugins	All of them, by slug, with versions	Rarely, and only a fixed list
Shopify theme, custom-theme flag, Plus status	Yes	No
App install/uninstall events	Yes	No
Confidence levels	high / medium / low, each explained	Flat yes/no
Evidence model	Headers + loaded asset URLs weighted above body text	Any string match anywhere
Version detection	Yes (WordPress, Angular, jQuery, nginx, WooCommerce…)	Rare
Filter to only changed domains	Yes — built for scheduled monitoring	No
ads.txt monetisation stack	Parsed and normalised	No
Security header grade	A–F with the reasoning	No
Proxy required	No	Often

On confidence, because it is the difference between a usable list and a noisy one: most detectors match a technology's name anywhere on the page, so a blog post mentioning Shopify marks the site as running Shopify. This Actor separates load-bearing evidence — response headers and the URLs the page actually pulls scripts from — from body text. Something referenced only in prose is reported at low, and a single stray mention is not reported at all.

---

Output

{
  "domain": "graza.co",
  "status": 200,
  "ok": true,
  "server": "cloudflare",
  "technology_count": 9,
  "technology_names": ["Shopify", "Shop Pay", "Cloudflare", "Google Tag Manager"],
  "categories": ["cdn", "ecommerce", "payments", "tag-manager"],
  "technologies": [
    { "name": "Shopify", "category": "ecommerce", "version": null, "confidence": "high", "signals": 2 }
  ],
  "shopify": {
    "is_shopify": true,
    "is_shopify_plus": false,
    "theme_name": "baggy – production",
    "theme_store_id": null,
    "is_custom_theme": true,
    "currency": "USD",
    "country": "US",
    "app_count": 5,
    "app_names": ["Klaviyo", "Postscript", "Okendo", "Elevar", "Triple Whale"],
    "app_categories": ["attribution", "email-sms", "reviews"],
    "apps": [
      { "name": "Klaviyo", "category": "email-sms", "confidence": "high", "evidence": "asset" },
      { "name": "Elevar", "category": "attribution", "confidence": "medium", "evidence": "inline" }
    ]
  },
  "wordpress": null,
  "ads_txt": null,
  "security": {
    "grade": "B",
    "score": 81,
    "https": true,
    "headers_missing": ["Permissions-Policy", "Cross-Origin-Resource-Policy"],
    "hsts": { "max_age_days": 730, "include_subdomains": true, "preload": true },
    "csp": { "present": true, "weaknesses": ["unsafe-inline"], "strengths": ["hash", "frame-ancestors"] },
    "information_disclosure": [],
    "cookie_issues": ["1 cookie(s) without HttpOnly"]
  },
  "changes": {
    "added": ["shopify-app:Klaviyo"],
    "removed": ["shopify-app:Yotpo"],
    "previous_scan_at": "2026-08-02T09:14:00+00:00"
  },
  "first_scan": false,
  "scanned_at": "2026-08-09T15:42:00+00:00"
}

On a WordPress site the wordpress block appears instead:

{
  "wordpress": {
    "is_wordpress": true,
    "core_version": "7.0.3",
    "rest_api_exposed": true,
    "themes": [{ "slug": "hello-elementor", "version": "3.4.6" }],
    "plugin_count": 5,
    "plugin_slugs": ["elementor", "elementor-pro", "pojo-accessibility", "weglot"],
    "known_plugin_names": ["Elementor", "Elementor Pro", "Weglot"],
    "commercial_plugin_slugs": ["elementor-pro"],
    "plugins_with_version": { "elementor": "4.2.0", "elementor-pro": "4.2.0" },
    "latest_upload_month": "2026-05"
  }
}

changes is null on a domain's first scan and whenever trackChanges is off. Changes are prefixed so you can tell them apart: shopify-app:Klaviyo, wp-plugin:wordfence, ad-system:mediavine.com, server:cloudflare, sec-header:Content-Security-Policy, or a bare name for a platform-level technology.

That means a hosting migration, an ad-partner switch, or a dropped security header all arrive as change events on the same feed.

Input

{
  "domains": ["graza.co", "allbirds.com", "https://www.deathwishcoffee.com"],
  "shopifyOnly": true,
  "wordpressOnly": false,
  "mustUseAny": ["Yotpo"],
  "trackChanges": true,
  "onlyChanged": false,
  "categories": ["ecommerce", "reviews"],
  "includeAdsTxt": true,
  "securityGradeAtMost": "C"
}

Only domains is required. shopifyOnly keeps Shopify stores; mustUseAny keeps stores running a named technology or app; onlyChanged turns the run into a pure change feed.

Pricing

Event	Price
domain — one domain scanned	$0.05
change — a technology, app, plugin, ad system, host or security header added/removed vs your last scan	$0.05

You are charged for a change only when something actually changed. A quiet week over 1,000 monitored stores costs you the scans and nothing more.

Use cases

WordPress plugin developers — find the sites running your competitor, and see which are on an old version of yours.

Security vendors and researchers — plugin slug plus version across a monitored universe is exposure data, refreshed weekly.

Shopify app developers — build a list of every store running your competitor, and get alerted the week a store uninstalls them. That is the highest-intent list in your market.

SaaS competitive teams — who runs Mailchimp instead of Klaviyo, Zendesk instead of Gorgias, and who just switched.

Agencies — audit a prospect's stack before the pitch; audit a client's for redundant or abandoned tooling.

Cyber-insurance underwriters and third-party-risk teams — a header grade per vendor, refreshed weekly. Posture drifts silently: a header gets dropped in a deploy and nobody notices until the diff shows it.

Adtech sales — who a publisher's current ad partner is, and the week they switch.

Investors and analysts — measure real adoption of a SaaS product across a defined universe of sites, month over month.

Anyone currently paying for a technology-lookup subscription who only needs the lookup and the diff.

Scheduling

Point an Apify schedule at your domain list, set onlyChanged: true, and you get a feed containing only the sites whose stack moved. History is kept per domain in a named key-value store, so it survives across runs and schedules.

Call it as an HTTP API

The Actor runs in Standby, so you can query it directly instead of launching a run:

GET https://adored-maze--tech-stack-scanner.apify.actor/?domains=graza.co,wpbeginner.com
Authorization: Bearer <your Apify token>

[
  { "domain": "graza.co", "security": { "grade": "D" },
    "shopify": { "app_names": ["Klaviyo", "Postscript", "Okendo"] } },
  { "domain": "wpbeginner.com", "security": { "grade": "E" },
    "wordpress": { "known_plugin_names": ["OptinMonster", "WPForms", "Perfmatters"] } }
]

Query parameters: domains (comma-separated, up to 50 per request), adsTxt=true, trackChanges=true. Response is the same record shape as the dataset. Call it from a script, a workflow, or an agent — one domain at a time, in a loop, as often as you like.

Use with AI agents

Small, deterministic, one job. Callable over the Apify API and through MCP, and enabled for agentic payments — a good tool for an agent answering "what is this company running?" mid-conversation.

Technologies detected

ecommerce Shopify · Shopify Plus · WooCommerce · Magento · BigCommerce · Salesforce Commerce Cloud · PrestaShop · Wix Stores · Cafe24 cms WordPress · Drupal · Ghost · Contentful · Sanity · Webflow · Squarespace · Wix · Framer · HubSpot CMS framework Next.js · Nuxt · Remix · Gatsby · SvelteKit · Astro · Rails · Django · Laravel · ASP.NET analytics GA4 · Adobe · Amplitude · Mixpanel · PostHog · Heap · Hotjar · Clarity · FullStory · Plausible · Naver Analytics advertising Meta Pixel · TikTok · LinkedIn · Pinterest · Reddit · Criteo · Taboola · Outbrain · Kakao Pixel marketing HubSpot · Marketo · Pardot · Klaviyo · Braze · ActiveCampaign · Customer.io payments Stripe · PayPal · Adyen · Braintree · Klarna · Afterpay · Shop Pay · Toss Payments · PortOne support Intercom · Zendesk · Drift · Crisp · Freshworks · Channel Talk infra Cloudflare · Fastly · Akamai · CloudFront · Vercel · Netlify · nginx · Apache …plus A/B testing, error tracking, search, reviews, consent, video and maps.

Troubleshooting

A domain returns ok: false — the site refused the connection, timed out, or does not resolve. Both https and http are attempted.

A domain returns blocked: true — the site answered with a bot wall instead of its homepage, and block_reason names which one (cloudflare-challenge, datadome, http-403-forbidden, perimeterx, …). This is reported as a block on purpose. A wall returns a small page with no technologies on it, and calling that a successful scan would put a confident wrong answer in your spreadsheet — and, worse, would make the next successful scan look like the site adopted its entire stack overnight. Blocked domains never touch change history.

Fewer technologies than another tool reports — deliberate. Tools that scan body text over-report. Everything at high confidence here is backed by a header or a loaded asset.

A Shopify app you know is installed doesn't appear — apps that render only inside checkout, the customer account area, or the admin are not visible from the storefront homepage. Apps injected purely at runtime by a tag manager may appear at medium with evidence: "inline" rather than high.

Client-rendered sites show less on the fast path — the first attempt reads the server response rather than a rendered page, which is what keeps a normal run cheap. Domains that come back walled are then re-opened in a real browser, and those rows carry rescued_with_browser: true.

FAQ

Is this legal? It fetches one public homepage per domain, unauthenticated — the same request any browser makes. No login, no paywall. When a site is walled it is opened once in an ordinary browser, which is what a visitor does; nothing solves a CAPTCHA and a wall that holds is reported as a wall.

Any personal data? None. The subject is a website's software. No people are identified, contacted, or profiled.

How many domains per run? No hard cap. 20 are fetched concurrently; parsing runs in separate worker processes so a heavy page cannot stall the requests still in flight.

What share of domains actually come back with data? On a list of 82 live commercial sites, 77 scanned, 4 stayed behind a wall a browser could not pass, and 1 never answered. On the tail of a public top-domain list the walled share is higher, because the largest sites run the strictest bot protection. The number you should not accept from any scanner is a silent zero.

Legal

Not affiliated with, endorsed by, or sponsored by Shopify or any technology vendor detected. All trademarks belong to their respective owners.