Website Tech Stack Detector (Wappalyzer-style, CMS, CDN)

Find out what any website is built with — from a single plain HTTP request, no browser, no proxies, no API key. The actor fetches each URL, follows redirects, and matches response headers, cookies, HTML, script/link URLs, inline JavaScript/CSS and meta tags against the open-source webappanalyzer fingerprint database (the MIT-licensed continuation of Wappalyzer: 7,500+ technologies in 100+ categories). You get the full technology list with versions, confidence and categories, plus ready-to-filter columns for CMS, e-commerce platform, frameworks, analytics, CDN, web server, hosting, languages, tag managers, marketing tools, payment providers, live chat and more.

Typical uses: lead lists filtered by platform ("all Shopify / WooCommerce / HubSpot sites in my list"), competitor research, migration and agency prospecting, security/asset inventories, market-share studies.

What you get

One dataset row per URL:

field	meaning
url, final_url, status, redirects, redirect_chain[], title	fetch result
technologies[]	every detected technology: name, version (when a fingerprint exposes it), confidence (0–100), categories[], website, detected_via[] (e.g. header:Server, scriptSrc, meta:generator, cookie:_shopify_s, implied by WordPress)
technology_count, technology_names[]	quick summary
cms, ecommerce, blogs, frameworks, analytics, cdn, web_servers, hosting, languages, tag_managers, marketing, advertising, payment, live_chat, security, page_builders, caching, databases, operating_systems, ui, video, seo, email, static_site_generators, reverse_proxies, wordpress_plugins, wordpress_themes, shopify_apps	technology names (with version) grouped by category — flat columns for CSV/Sheets filtering
server, powered_by, generator	raw Server, X-Powered-By headers and <meta name="generator">
hosting_hints[]	infrastructure inferred from headers (Cloudflare, AWS/CloudFront, Vercel, Netlify, GitHub Pages, Fastly, Akamai, Azure, Google Cloud, Kinsta, WP Engine, Webflow …)
header_hints{}, cookie_names[], script_hosts[]	raw evidence you can build your own rules on
dns_detected_services[], dns_detected[]	SaaS the organisation uses, revealed by MX/TXT DNS records (Google Workspace, Microsoft 365, SendGrid, Atlassian, Stripe, Zendesk, HubSpot …) — kept separate from the website stack
error	only for unreachable/invalid URLs — such rows are not billed

Example (abridged):

{"url":"https://wordpress.org","status":200,"technology_count":9,"cms":["WordPress 7.2"],"languages":["PHP"],"databases":["MySQL"],
 "web_servers":["Nginx"],"tag_managers":["Google Tag Manager"],"generator":"WordPress 7.2-alpha-63368",
 "technologies":[{"name":"WordPress","version":"7.2","confidence":100,"categories":["CMS","Blogs"],"detected_via":["html","meta:generator","scriptSrc"]}, "…"]}
{"url":"https://www.shopify.com","ecommerce":["Shopify"],"frameworks":["Tailwind CSS"],"cdn":["Cloudflare"],"hosting":["Amazon Web Services"],
 "dns_detected_services":["Google Workspace","Microsoft 365","Sendgrid","Stripe","Zendesk"]}

Input

field	default	meaning
urls	—	pages to analyse (bare domains are upgraded to https://); duplicates skipped
checkDns	true	also look up MX/TXT records (DNS-over-HTTPS) for DNS-based fingerprints → dns_detected_services
minConfidence	50	drop technologies below this confidence
userAgent	desktop Chrome	User-Agent header to send
concurrency	5	URLs processed in parallel (1–10)
timeoutSecs	20	per request
maxItems	1000	cost cap

{ "urls": ["https://wordpress.org", "https://www.shopify.com", "https://github.com", "https://mailchimp.com"] }

Pricing

Pay per event: $0.002 per URL ($2 per 1,000). Charged only for rows successfully written to the dataset; unreachable or invalid URLs are stored with an error and are free. Roughly 1–3 seconds per URL; 1,000 URLs ≈ 5–8 minutes at 256 MB.

How it works & limitations (honest list)

• Plain GET, no JavaScript execution. Fingerprints that need the live DOM or JavaScript globals (Wappalyzer's js and dom rules) are not evaluated. Technologies that only reveal themselves after scripts run (some SPA frameworks, A/B tools loaded by tag managers) can be missed; anything visible in the initial HTML, headers, cookies or script URLs is caught. In practice this covers CMS, e-commerce platforms, CDNs, servers, analytics and most marketing tags well.
• Rule types evaluated: headers, cookies, html, scriptSrc (script and link URLs), scripts (inline JS), css (inline CSS), meta, url, dns, plus implies / requires / excludes chains. Confidence is summed per technology and capped at 100.
• The fingerprint database is snapshotted into the image at build time (fast runs). If it is missing it is downloaded at run start.
• Bot-protected sites (Cloudflare challenge, Akamai) may return 403 or a challenge page; you still get the headers-based detections (the row is billed because a result was stored).
• Versions are reported only when a fingerprint exposes one (meta generator, script URL, header); absence of a version is not a signal.
• Not affiliated with Wappalyzer; uses the MIT-licensed webappanalyzer fingerprint data.