Tech Stack Detector: CMS, framework, CDN & analytics

Give it a list of websites. Get back what each one is built with — CMS, e-commerce platform, framework, web server, CDN, hosting, analytics, ad pixels, payment provider, support chat and consent tool — and, for every single match, the exact evidence that proved it.

No API keys. Nothing to configure. Respects robots.txt by default.

Why the evidence matters

Most detectors hand you a label. This one hands you the label and the proof:

"technologies": [
  { "name": "WordPress",      "category": "CMS",         "confidence": "high", "via": "meta",   "evidence": "meta generator: WordPress 6.5.2" },
  { "name": "Cloudflare",     "category": "CDN",         "confidence": "high", "via": "header", "evidence": "header cf-ray: 8f2c1a-NRT" },
  { "name": "Stripe",         "category": "Payments",    "confidence": "high", "via": "script", "evidence": "asset URL: js.stripe.com" },
  { "name": "Laravel",        "category": "Framework",   "confidence": "high", "via": "cookie", "evidence": "cookie name: laravel_session" }
]

If a result looks wrong, you can check it in seconds instead of trusting a black box. confidence is high when the signal is effectively unique to that technology and low when it could plausibly appear for another reason.

Output per site

Group	Fields
Verdict	status (ok / http_error / blocked_by_robots / unreachable), technologyCount, highConfidenceCount
Flat columns	cms, ecommerce, framework, webServer, cdn, hosting, customerSupport, consentManagement
Lists	analytics[], advertising[], payments[], technologyNames[], byCategory{}
Detail	technologies[] with name, category, confidence, via, evidence
Page	httpStatus, finalUrl, pageTitle, metaGenerator, assetUrlCount, htmlBytes

The flat columns exist so the CSV export drops straight into a spreadsheet; technologies[] is there when you want to audit the reasoning.

Typical uses

• Qualify a prospect list — find every site on Shopify, or every site still on a legacy CMS, before you write the first email.
• Competitive teardown — see which analytics, ad pixels and support tools a set of competitors actually run.
• Portfolio audit — check that every site you manage has the consent tool and the analytics you think it has.
• Partner / vendor due diligence — confirm the stack a supplier claims to use.

Input

{
  "domains": ["apify.com", "https://wordpress.org/about/", "shopify.com"],
  "respectRobots": true,
  "includeEvidence": true,
  "maxConcurrency": 8
}

• domains accepts bare domains or full URLs. A single entry may hold many sites separated by spaces, commas or newlines, so pasting a spreadsheet column works.
• respectRobots (default on) reads robots.txt first and skips the site if this crawler is disallowed, reporting blocked_by_robots with the rule that blocked it.
• includeEvidence off returns just name/category/confidence, for smaller datasets.

What it detects

Around 100 technologies across 18 categories:

CMS WordPress · Drupal · Joomla · Ghost · Contentful · Sanity · AEM · Sitecore · HubSpot CMS · Webflow · Wix · Squarespace · TYPO3 E-commerce Shopify · WooCommerce · Magento · BigCommerce · PrestaShop · Salesforce Commerce Cloud · Ecwid · BASE · STORES Framework Next.js · Nuxt · React · Vue · Angular · Svelte · Astro · Gatsby · Remix · Rails · Laravel · Django · ASP.NET · Express Infrastructure Cloudflare · Fastly · Akamai · CloudFront · Vercel · Netlify · GitHub Pages · Nginx · Apache · IIS · LiteSpeed · Caddy Analytics GA4 · GTM · Plausible · Fathom · Matomo · Hotjar · Clarity · Mixpanel · Amplitude · Segment · Adobe · PostHog Advertising Google Ads · Meta Pixel · X Pixel · LinkedIn Insight · TikTok Pixel · Yahoo! JAPAN Ads · Criteo Payments Stripe · PayPal · Square · Adyen Support Intercom · Zendesk · Crisp · Drift · Tawk.to · Freshchat Consent / security OneTrust · Cookiebot · Usercentrics · reCAPTCHA · hCaptcha · Turnstile

How it works, and what it does not do

• One request per site. It fetches robots.txt and the homepage — nothing else. It does not crawl, does not follow internal links, and does not run JavaScript.
• It reads cookie names, never cookie values. No cookie contents are stored or reported.
• It only looks at what the server volunteers: response headers, the HTML it returns, and the URLs of assets that HTML references. Nothing is bypassed.
• Because JavaScript is not executed, a technology injected purely at runtime by another script may be missed. What is reported is what the initial response proves.

Performance

Sites run through a fixed-size worker pool, so memory stays flat regardless of list length, and HTML is capped per site. A typical site resolves in well under a second.

---

Built by Ai-Q Labs. See also Bulk Domain Checker for the DNS, SSL and WHOIS layer of the same picture.