Website Tech Stack & Platform Detector: Shopify, CMS, Analytics

Website Tech Stack & Platform Detector tells you what each website runs on. For every website it reports the e-commerce platform (Shopify, WooCommerce, BigCommerce, Magento / Adobe Commerce, Wix, Squarespace, Webflow, PrestaShop, Shopware, Salesforce Commerce Cloud, Ecwid…), the CMS or site builder (WordPress, Drupal, Joomla, Ghost, HubSpot CMS, Wix, Squarespace, Webflow…), analytics and ad pixels (Google Analytics 4, Google Tag Manager, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Hotjar, Microsoft Clarity…), marketing, CRM and chat tools (HubSpot, Klaviyo, Mailchimp, Marketo, Intercom, Zendesk…), payments (Stripe, PayPal, Klarna, Afterpay, Shop Pay…), CDN and hosting (Cloudflare, Fastly, Akamai, Vercel, Netlify, CloudFront…), JavaScript frameworks (React, Next.js, Vue, Nuxt, Angular…), cookie consent, reviews, search and A/B testing tools: 221 technologies in 23 categories. You get one row per website, and every detection comes with a confidence level and the evidence that triggered it. Paste a list of websites, or point it at any Apify dataset of leads or stores and the technology columns are added next to each item.

Why this Actor

• Evidence, not guesses. Each technology in the output says why it was detected, for example header x-shopid: 56789012, script https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=… or meta generator: WordPress 6.6.2, and whether that marker is a high or medium confidence signal.
• Markup, not mentions. Detection rules match the markers a product leaves in a page's code: its script and CDN hosts, the generator tag it writes, its response headers and cookie names, and its bootstrap code. A blog post that talks about Shopify or links to wordpress.org is not reported as using them.
• Shopify, including headless. Classic Shopify themes and headless Shopify Hydrogen storefronts (hosted on Shopify's Oxygen) are both reported as Shopify, with Hydrogen as a separate framework entry. For Shopify stores you also get the .myshopify.com domain, shop ID, theme name, theme ID and version, currency, country and locale, when the store's own page states them.
• Tracking IDs. The public Google Analytics 4, Universal Analytics, Google Tag Manager, Google Ads, Meta Pixel and TikTok Pixel IDs found in the page. Websites that share a GTM container or pixel ID are often run by the same company or agency.
• Fast and light. One request per website (plus redirects), no browser, 256 MB of memory by default.
• Works through rate limits. Big stores often answer automated requests with HTTP 429 or 403. Those answers' headers sometimes still name the platform (Shopify's x-shopid, powered-by: Shopify, _shopify_* cookies…). When they reveal something about the site itself, you get a partial row based on headers only, with a warning; when they only show the CDN, web server or security layer in front of it (for example just Cloudflare's cf-ray), you get a free error row. An optional Apify Proxy may improve access, but doesn't guarantee a full page or complete detections.
• Polite. At most 2 requests at a time to a website, retries with backoff when a server is busy, and a User-Agent that names the tool (TechStackDetector/1.0; +https://apify.com/charlesmarkette).
• Only pay for results. Websites that give nothing about the site itself (unreachable, or blocked with only CDN/server/security headers) are free, and with Only matching websites on, websites without the technology you're after are left out and not charged.

Use cases

• Lead lists of online stores: find which websites in a list run Shopify, WooCommerce, BigCommerce or Magento, then add their contact details with Website Contact Info Scraper.
• Agency prospecting: find websites where this scan did not detect analytics, a cookie consent tool or a chat widget (then check them by hand: not detected doesn't mean not installed), or websites still loading Universal Analytics, which Google has shut down.
• Migration targeting: list stores on Magento or PrestaShop, sites on older WordPress versions (from the generator tag), and sites still loading Google Optimize (shut down in 2023) or Polyfill.io (a script host that was compromised in 2024).
• Competitor and market research: see which email, review, payment and search tools the leading stores in a niche use.
• App and plugin vendors: find stores that use a competing app (Klaviyo, Judge.me, Yotpo, Recharge…) or where no tool in your category was detected (verify before drawing conclusions).

How to use it

1. Add Websites (home page URLs or bare domains such as example.com), and/or pick a Dataset to enrich and set URL field to the field that holds the website (dotted paths such as company.website work).
2. Optional filters: Only report these categories (for example only E-commerce and Analytics), Technologies to look for plus Only matching websites (for example only output the Shopify and WooCommerce stores).
3. Run it. Export the results as CSV, Excel or JSON, or chain the run into an integration.

Input example

{
  "startUrls": ["https://www.fashionnova.com", "https://wordpress.org", "https://www.python.org"],
  "technologies": ["Shopify", "WooCommerce"],
  "onlyMatches": false,
  "maxConcurrency": 10,
  "proxyConfiguration": {"useApifyProxy": false}
}

Output example (illustrative, shortened)

{
  "url": "birdie-shoes-example.com",
  "finalUrl": "https://www.birdie-shoes-example.com/",
  "domain": "birdie-shoes-example.com",
  "status": 200,
  "title": "Birdie Shoes – Comfortable sneakers",
  "language": "en-US",
  "server": "cloudflare",
  "generator": null,
  "ecommercePlatform": "Shopify",
  "cms": null,
  "analytics": ["Google Analytics 4", "Google Tag Manager", "Meta Pixel"],
  "technologyNames": ["Shopify", "Google Analytics 4", "Google Tag Manager", "Meta Pixel", "Klaviyo", "Shop Pay", "Cloudflare", "Judge.me"],
  "technologies": [
    {"name": "Shopify", "category": "E-commerce", "confidence": "high", "version": null, "evidence": "header x-shopid: 56789012"},
    {"name": "Klaviyo", "category": "Marketing & CRM", "confidence": "high", "version": null, "evidence": "script https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=AbC123"},
    {"name": "Cloudflare", "category": "CDN & hosting", "confidence": "high", "version": null, "evidence": "header cf-ray: 8c1a2b3c4d5e6f70-LHR"}
  ],
  "categories": {
    "E-commerce": ["Shopify"],
    "Analytics": ["Google Analytics 4"],
    "Tag manager": ["Google Tag Manager"],
    "Advertising": ["Meta Pixel"],
    "Marketing & CRM": ["Klaviyo"],
    "Payments": ["Shop Pay"],
    "CDN & hosting": ["Cloudflare"],
    "Reviews": ["Judge.me"]
  },
  "shopifyStore": {
    "myshopifyDomain": "birdie-shoes.myshopify.com",
    "shopId": 56789012,
    "themeName": "Dawn",
    "themeId": 134567890123,
    "themeSchemaName": "Dawn",
    "themeSchemaVersion": "15.0.0",
    "themeStoreId": 887,
    "currency": "USD",
    "country": "US",
    "locale": "en"
  },
  "wordpressVersion": null,
  "trackingIds": {
    "googleAnalytics4": ["G-ABC123XYZ9"],
    "universalAnalytics": [],
    "googleTagManager": ["GTM-W8K2Q9P"],
    "googleAds": [],
    "metaPixel": ["123456789012345"],
    "tiktokPixel": []
  },
  "scannedAt": "2026-10-17T12:00:00Z",
  "error": null,
  "warning": null
}

• status is the HTTP status of the page after redirects (null when the website didn't answer). error is null when the row has results, else a plain-English reason. error: null does not by itself mean the HTML page was read: check warning and status too.
• warning is set when the website didn't return its page (for example HTTP 429 or 403) but its response headers still revealed technologies: "The site answered HTTP 429; only response headers were analysed, so some technologies may be missing." Such rows have error: null, list only what the headers and cookies showed, and are charged, because the headers revealed more than the CDN, web server or security layer. They are partial results, not a full-page analysis.
• Four row states, in short: page read (charged, even if nothing was detected); headers only (warning set, error: null, charged); failed (error set, not charged; left out when Only matching websites is on); filtered out by Only matching websites (not stored, not charged).
• Illustrative examples (not run receipts):
  • Headers-only, charged: {"url": "https://store.example", "status": 429, "ecommercePlatform": "Shopify", "technologyNames": ["Shopify", "Cloudflare"], "error": null, "warning": "The site answered HTTP 429; only response headers were analysed, so some technologies may be missing."}
  • Infrastructure only, free: {"url": "https://news.example", "status": 403, "technologyNames": [], "error": "The website answered HTTP 403, so the page couldn't be read. This usually means bot protection or rate limiting.", "warning": null}
• technologies lists every detection with its category, confidence (high or medium), version (when the page states one, for example a generator tag, ng-version, or a versioned script file name; otherwise null) and evidence (the marker that matched, cut to 160 characters). technologyNames is the same list as plain names, handy in CSV exports; categories groups the names by category.
• ecommercePlatform is the main e-commerce platform found (high confidence first), else null. cms is the main CMS, else the site builder (Wix, Squarespace, Webflow…), else null. analytics lists the analytics, tag manager and advertising pixel tools found.
• shopifyStore is filled for Shopify stores only; each field is null when the store's page doesn't state it. wordpressVersion is filled only when the site states it in its generator meta tag (many sites hide it).
• Only report these categories limits technologies, technologyNames and categories; ecommercePlatform, cms and analytics are always filled.
• A medium-confidence detection with evidence implied by … means another detection implies it (WooCommerce runs on WordPress, Next.js on React, Nuxt on Vue).
• A run summary (websites read and failed, how many use each e-commerce platform, CMS and technology, why the run stopped) is saved as OUTPUT in the key-value store.

Supported technologies

• E-commerce: Shopify, WooCommerce, BigCommerce, Magento (Adobe Commerce), Wix eCommerce, Squarespace Commerce, Webflow Ecommerce, PrestaShop, Shopware, Salesforce Commerce Cloud, Ecwid, OpenCart, Lightspeed eCom, VTEX
• CMS: WordPress, Drupal, Joomla, Ghost, HubSpot CMS, TYPO3, Craft CMS, Adobe Experience Manager, Sitecore, Blogger, Substack, and headless CMS hints from their asset hosts: Contentful, Sanity, Prismic, Storyblok, DatoCMS
• Site builder: Wix, Squarespace, Webflow, Duda, GoDaddy Website Builder, Weebly / Square Online, Jimdo, Framer, Tilda
• Analytics: Google Analytics 4, Universal Analytics, Hotjar, Microsoft Clarity, Segment, Mixpanel, Heap, Plausible, Matomo, Adobe Analytics, Amplitude, FullStory, Mouseflow, Crazy Egg, Yandex Metrica, Baidu Tongji, Cloudflare Web Analytics, Vercel Analytics, PostHog, Pendo, Contentsquare, Fathom, Chartbeat
• Tag manager: Google Tag Manager, Adobe Experience Platform Tags, Tealium iQ
• Advertising: Google Ads, Google AdSense, Google Ad Manager, Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, Snap Pixel, X (Twitter) Pixel, Reddit Pixel, Microsoft Advertising UET, Criteo, Taboola, Outbrain, AdRoll
• Marketing & CRM: HubSpot, Marketo, Pardot, Mailchimp, Klaviyo, Omnisend, ActiveCampaign, Brevo, Attentive, Postscript, Kit (ConvertKit), Constant Contact, Privy, OptinMonster, Justuno
• Live chat & support: Intercom, Drift, Zendesk, Crisp, Tidio, LiveChat, tawk.to, Freshworks, Gorgias, Zoho SalesIQ, Help Scout, Olark
• Payments: Stripe, PayPal, Klarna, Afterpay, Shop Pay, Affirm, Sezzle, Amazon Pay, Braintree, Adyen, Square
• CDN & hosting: Cloudflare, Fastly, Akamai, Vercel, Netlify, Amazon CloudFront, Amazon S3, Google Cloud, Microsoft Azure, Bunny CDN, Sucuri, Imperva, WP Engine, Kinsta, Pantheon, Heroku, GitHub Pages, Fly.io, Render
• JavaScript framework: React, Next.js, Shopify Hydrogen, Gatsby, Remix, Vue.js, Nuxt, Angular, AngularJS, SvelteKit, Astro
• JavaScript library: jQuery, jQuery UI, Bootstrap, Alpine.js, htmx, GSAP, Swiper, Polyfill.io
• Consent management: OneTrust, Cookiebot, Usercentrics, TrustArc, Didomi, Quantcast Choice, Termly, Osano, CookieYes, iubenda, Complianz
• Reviews: Trustpilot, Yotpo, Judge.me, Okendo, Stamped, Loox, REVIEWS.io, Feefo, Bazaarvoice, PowerReviews
• Search: Algolia, Klevu, Searchspring, Constructor, Doofinder, Coveo, Searchanise, Google Programmable Search
• A/B testing: Optimizely, VWO, AB Tasty, Google Optimize, Convert, Kameleoon, Dynamic Yield, Adobe Target
• Web server: Nginx, Apache HTTP Server, Microsoft IIS, LiteSpeed, OpenResty, Caddy
• Backend: PHP, ASP.NET, Express, Laravel, Django, Ruby on Rails, Java
• Security: reCAPTCHA, hCaptcha, Cloudflare Turnstile
• Accessibility: accessiBe, UserWay, AudioEye
• Fonts: Google Fonts, Adobe Fonts, Font Awesome
• Video: YouTube, Vimeo, Wistia
• Loyalty & subscriptions: Recharge, Smile.io, LoyaltyLion

In Technologies to look for, use these names (case doesn't matter). Common aliases work too: GA4, Google Analytics (GA4 and Universal Analytics), GTM, Adobe Commerce, Demandware, Facebook Pixel, Clearpay, CloudFront, Sendinblue, ConvertKit and others.

How much does it cost?

Pay per event: $0.002 per website analyzed, which is $2.00 per 1,000 websites, Apify platform usage included, plus $0.005 per run start. A website is charged when its page was read: it answered with an HTML page (after redirects), whatever technologies were or weren't found. It is also charged when it answered with an error such as 429 or 403 but that answer's headers still revealed something about the site itself, such as its platform (the row then has a warning). Headers that only show the CDN, web server or security layer in front of the site (for example just Cloudflare) don't count: that row is a free error row. These are free: DNS errors, connection failures, error or bot-protection answers (403, 429, 503…) whose headers reveal nothing beyond the CDN or web server, redirect loops, files that aren't web pages, empty pages, private or internal addresses, and input that isn't a website. With Only matching websites on, websites that are left out are free too.

Apify Store discounts: the price above is for Apify's Free plan. Paid plans pay less per 1,000 websites: $1.80 on Starter, $1.60 on Scale, $1.40 on Business. The "from" price at the top of the Store page is the Business price. Apify Proxy traffic, if you turn it on, is billed separately by Apify.

Worked examples (website-event subtotals at the Free-plan rate; add the run-start charge, $0.005 at the default memory and more at higher memory, plus any optional Apify Proxy charges):

• 1,000 websites, all reachable: 1,000 × $0.002 = $2.00.
• 5,000 leads from a Google Maps run, 400 of them with a dead website: 4,600 × $0.002 = $9.20.
• 10,000 websites with Technologies to look for = Shopify and Only matching websites on, 1,200 of which run Shopify: 1,200 × $0.002 = $2.40.

If you set a maximum cost per run, the Actor stops cleanly at that limit, and a run that is resumed continues after the websites already done.

FAQ and limits

How does it detect technologies?

It requests the page at each URL you give (bare domains = the home page), follows redirects, and reads the HTML, the response headers and the names of the cookies the response sets. It then checks those against its own rules: script, stylesheet, image and iframe URLs; <meta name="generator"> and similar tags; header names and values (x-shopid, cf-ray, x-powered-by…); cookie names; product-specific markup and the bootstrap code products put in inline scripts. It makes no other requests to the website.

What can it miss?

• Anything loaded by JavaScript. There is no browser and no JavaScript execution. A tool that a tag manager (such as Google Tag Manager) loads after the page opens is not in the page's HTML, so it is usually not detected; only GTM itself is. The same goes for apps that build the whole page in the browser.
• Anything only on other pages. Only the page you give is read. A checkout provider, chat widget or review app that appears only on product, cart or contact pages may be missed.
• Hidden or customised setups. Headless storefronts, proxied analytics, server-side tagging and sites that strip generator tags and headers show fewer markers.
• Bot protection and rate limits. Some websites answer automated requests with a challenge, a 403 or a 429. If the answer's headers reveal something about the site beyond its CDN, web server or security layer, you get a charged partial row with a warning and only those detections; otherwise a free row with an error. See Proxy below.

Proxy: big stores answer 429 or 403

Large stores and media sites often rate-limit or block requests from datacenter IP addresses, which is where Apify runs. For those, turn on Proxy → Apify Proxy in the input (try the default datacenter group first, then residential if the sites still block). Proxy traffic is billed by Apify to your account, separately from this Actor's price; a proxy may improve access but doesn't guarantee it. This Actor's maximum-cost setting doesn't include proxy charges, so check your proxy usage separately. Without a proxy (the default), requests go out directly. Custom http:// proxy URLs work too.

Are the results guaranteed?

No. They are indicators based on public markers. high means a marker specific to that product was found (its own CDN host, header, cookie or generator tag); medium means a weaker or less specific marker, or a technology implied by another one. Always check the evidence before relying on a single detection. Versions are reported only where the page states them.

Does it give traffic, revenue or company data?

No. It doesn't estimate visitors, sales, ad spend or company size, and it doesn't look anything up in third-party databases. The tracking IDs it reports are the public tag IDs that every visitor's browser receives.

Is this based on Wappalyzer?

No. The fingerprint rules were written for this Actor from each product's own public markers. They are not copied from Wappalyzer or any other fingerprint database.

Why is a website's row "failed"?

The error column says why, in plain English: for example the domain doesn't resolve, the site answered 403 (usually bot protection), or the URL points to a PDF. Failed websites don't incur the site-analyzed charge. Starting another run still incurs a start fee, and enabled proxy traffic may incur separate Apify charges, even if no website produces a billable result.

Other tools by the same author

Actor	Use it to
Website Contact Info Scraper	Add emails, phones and social profiles to the stores and websites you found.
Domain WHOIS & DNS Lookup	Add domain age, registrar and email provider (Google Workspace, Microsoft 365…) to the same list.
PageSpeed & Lighthouse Audit	Score the same websites on speed, SEO and accessibility.
Bulk URL Status Checker	Check which websites load, where they redirect and whether their SSL certificate is valid.
Dataset Filter & Transform	Keep only the rows you need (for example ecommercePlatform = Shopify), rename and flatten fields.
Merge & Deduplicate Datasets	Keep only new websites between runs before analyzing them.
Google Sheets Sync	Send the rows to a Google Sheet.

Domain parsing: tldextract with the Public Suffix List. HTML parsing: lxml.