Tech Stack Detector: Website Technology Lookup

Find out what any website is built with: 7,600+ technologies in 110 categories (CMS, ecommerce, analytics, marketing automation, CRM, live chat, payments, ads, hosting, CDN, frameworks, Shopify and WordPress plugins…) with versions, confidence and the evidence for every detection. It reads more than the HTML: the site's Google Tag Manager containers (the tags a plain fetch never sees), DNS (email provider, services that send its email, 50+ SaaS domain verifications) and the TLS certificate. Add history from the Wayback Machine (when each tool arrived and what it replaced), change monitoring (added, removed, upgraded, migrated), lead-list filters and a real browser when a page needs one. Fast HTTP, from $3 per 1,000 sites.

What you can do with it

• Qualify a lead list: "Which of these 5,000 domains run Shopify and Klaviyo but no live chat?" Give domains (or another actor's dataset), set Must use and Must not use, get only the matches, with your original columns kept.
• Catch buying signals: schedule a monitor and get only the sites that changed: "adopted HubSpot", "dropped Intercom", "migrated from WooCommerce to Shopify", "upgraded WordPress 6.4 → 6.5".
• See a site's past: historyYears: 3 dates each technology from yearly Wayback captures and lists what the site used before.
• Profile a company: email provider and senders (Google Workspace, Microsoft 365, SendGrid, Salesforce…), services it verified its domain with (Atlassian, DocuSign, Stripe, OpenAI…), hosting, CDN, a spend tier and a minimum monthly spend on paid tools.
• Audit a site: versions with CPE identifiers for vulnerability scanners, HTTPS, HSTS, CSP, HTTP/3, certificate authority, SPF and DMARC policy.
• Enrich domains from n8n, Make, Clay or an AI agent: call the actor with one domain or a list and read the dataset. AI agents can run and pay for it directly through Apify's MCP server.

Why this actor

• Sees what HTTP-only detectors miss. Most detectors fetch one homepage and match 40–250 signatures. This one matches the full open fingerprint set and adds Tag Manager containers, DNS and the certificate. On hubspot.com the container alone adds 6sense, Demandbase, Hotjar, Reddit Ads, Impact and Floodlight.
• Every detection is explained. What matched and where (script URL, header, cookie, meta tag, DOM element, DNS record, Tag Manager tag), how it was found (detectedVia: website, tagManager, dns, certificate, implied) and a confidence score. Weak signals (a short global name alone) score under the default threshold.
• History on the first run. Other monitors start remembering the day you start them; this one looks back up to 5 years.
• Monitoring without false alarms. A technology is reported removed only after it is missing from N complete scans in a row (default 2). A blocked or failed scan never removes anything.
• The exact host. blog.example.com is scanned as blog.example.com, not swapped for example.com; redirects are followed and reported. Optional subdomain discovery from certificate logs.
• Fair billing. Unreachable domains are free. Sites filtered out, unchanged in monitoring, or blocked but still showing DNS results cost the checked rate ($0.50 per 1,000).
• Compatible input. urls, websites, startUrls (as strings or { "url": … }), domain and url from other detectors work as they are.

Input

Field	Type	What it does
domains	array	Domains or URLs to scan (example.com, shop.example.com, a full URL)
datasetId, domainField	string	Read domains from another dataset's column; its columns come back under source
maxDomains	integer	Stop after this many domains
maxPagesPerDomain	integer	1 = homepage; up to 10 adds key pages it links to (pricing, cart, contact, login, careers, blog, about)
readTagManager	boolean	Read the site's Google Tag Manager containers (default on, free)
checkDns	boolean	DNS records and the certificate issuer (default on, free)
scanScriptFiles	boolean	Read up to 5 script files for bundled libraries and versions
useBrowser	never, auto, always	Render in Chrome: always, or only for blocked and script-only pages
historyYears	0–5	Scan one Wayback capture a year back
discoverSubdomains, maxSubdomains	boolean, integer	Find subdomains in certificate logs and scan them
requireTechnologies, requireMode	array, any/all	Keep only sites using these technologies or categories
excludeTechnologies	array	Leave out sites using any of these
categories	array	List only technologies in these categories
minConfidence	0–100	Leave out weaker detections (default 50)
monitorMode, monitorName	boolean, string	Only sites that changed since the last run under that name
changeTypes	array	added, removed, version-changed, migrated
confirmRemovalRuns	1–5	Complete scans a technology must be missing before it counts as removed
outputFormat	domains, technologies, columns	A record per domain, a row per technology, or a row per domain with a column per tracked technology
columnTechnologies	array	Columns for the columns format (defaults to Must use)
includeEvidence, includeDescriptions, includeSiteInfo	boolean	Evidence per detection, a description of each technology, site and company info
fields	array	Return only these fields (dotted paths reach into lists)

Technology and category names match without case; an unknown name fails the run with suggestions ("Klav (did you mean Klaviyo?)").

Example inputs

A lead list: stores on Shopify with Klaviyo and no live chat, as spreadsheet columns.

{
  "datasetId": "YOUR_DATASET_ID",
  "domainField": "website",
  "requireTechnologies": ["Shopify", "Klaviyo"],
  "requireMode": "all",
  "excludeTechnologies": ["Live chat"],
  "outputFormat": "columns",
  "columnTechnologies": ["Shopify", "Klaviyo", "Gorgias", "Yotpo Reviews", "Ecommerce"]
}

A weekly watch for tech changes at target accounts (schedule it):

{
  "domains": ["acme.com", "globex.com", "initech.com"],
  "monitorMode": true,
  "monitorName": "target-accounts",
  "changeTypes": ["added", "removed", "migrated"]
}

A deep profile with three years of history:

{ "domains": ["allbirds.com"], "maxPagesPerDomain": 4, "historyYears": 3, "useBrowser": "auto" }

Output

A domain record (shortened; a real record from 6 October 2026):

{
  "domain": "colourpop.com",
  "url": "https://colourpop.com/",
  "status": "ok",
  "technologyCount": 30,
  "ecommerce": ["Shopify"],
  "hosting": ["Amazon Web Services"],
  "cdn": ["Cloudflare"],
  "analytics": ["Google Analytics"],
  "marketingAutomation": ["Klaviyo", "Tolstoy"],
  "payments": ["Apple Pay", "Klarna Checkout", "PayPal", "Venmo"],
  "advertising": ["Google Ads"],
  "emailProvider": "Sophos Email",
  "emailSenders": ["Google Workspace"],
  "verifiedServices": ["Amazon SES", "Google Search Console", "Meta Business"],
  "security": {
    "https": true,
    "hsts": true,
    "contentSecurityPolicy": true,
    "http3": true,
    "certificateIssuer": "Let's Encrypt",
    "spf": true,
    "dmarcPolicy": "reject"
  },
  "spend": {
    "paidTechnologies": 11,
    "low": 7,
    "mid": 2,
    "high": 0,
    "minimumMonthlyUsd": 200,
    "tier": "mid"
  },
  "site": {
    "title": "ColourPop® Cosmetics",
    "language": "en",
    "organization": {
      "name": "ColourPop",
      "logo": "https://colourpop.com/cdn/shop/files/colourpop-logo.svg"
    },
    "socialProfiles": {
      "instagram": "https://instagram.com/colourpopcosmetics",
      "tiktok": "https://www.tiktok.com/@colourpopco"
    },
    "contactPage": "https://colourpop.com/pages/contact-us"
  },
  "tagManagerIds": ["GTM-WQKQL2VQ"],
  "technologies": [
    {
      "name": "Okendo",
      "version": "0.104.2",
      "confidence": 100,
      "categories": ["Reviews", "Shopify apps"],
      "saas": true,
      "pricing": ["low", "recurring"],
      "detectedVia": ["website"],
      "evidence": [
        {
          "type": "dom",
          "key": "div.okeReviews [data-oke-reviews-version]",
          "value": "0.104.2",
          "page": "https://colourpop.com/"
        }
      ]
    },
    {
      "name": "Google Analytics",
      "confidence": 100,
      "categories": ["Analytics"],
      "detectedVia": ["tagManager"],
      "evidence": [{ "type": "tagManager", "key": "GTM-WQKQL2VQ", "value": "tag template __gaawe" }]
    }
  ]
}

Each technology also has groups, website, oss, cpe (with the version filled in), impliedBy and pages; categories on the record groups every technology by category. With historyYears, each technology gets firstSeen and switchedFrom, and the record gets history, historyFrom and previousTechnologies. A firstSeen equal to historyFrom means "at least since then". In monitoring, changed records carry changes (type, technology, from, to) and previousScanAt.

Headline fields (cms, ecommerce, hosting, cdn, analytics, liveChat, advertising, frameworks) use only what the website itself shows; crm, marketingAutomation and payments also count DNS verifications (a domain verified with Salesforce uses Salesforce). The spend tier follows each tool's published price band: low under $100 a month, mid $100–1,000, high over $1,000; minimumMonthlyUsd adds $100 per mid tool and $1,000 per high tool.

Every run writes RUN_SUMMARY to the key-value store: the outcome (COMPLETE, PARTIAL, NO_CHANGES, EMPTY or FAILED), counts by status, charges, warnings and the domains that could not be read.

Pricing

Pay only for results. Unreachable domains are never charged.

Event	Free and Bronze	Silver	Gold
Domain result (full record)	$3.00	$2.70	$2.40
Domain checked (filtered out, unchanged in monitoring, or blocked with DNS results only)	$0.50	$0.45	$0.40
Change (monitoring: one changed domain)	$5.00	$4.50	$4.00
Extra request (each key page or script file beyond the homepage)	$0.30	$0.27	$0.24
Browser render (per domain rendered in Chrome)	$5.00	$4.50	$4.00
History snapshot (per Wayback capture scanned)	$2.00	$1.80	$1.60
Subdomain discovery (per domain searched)	$1.00	$0.90	$0.80

Prices are per 1,000; your tier depends on your Apify plan. Each run also has a $0.00005 start fee. Tag Manager containers, DNS and the certificate are included. Billing is per domain in every output format. The first monitoring run is billed at the domain result price.

How detection works

Each technology has rules for what it leaves on a site: script URLs, HTML, meta tags, response headers, cookies, DOM elements, JavaScript globals, DNS records or certificate issuers, some with a version pattern. The confidences of the rules that match add up to 100, a technology can imply others (WordPress → PHP), and some need another to be present or rule one out. Without a browser, globals that the page's own inline scripts assign are read too (window.Shopify = …); a real browser reads every global with its value and every host the page calls.

Rules come from the open-source webappanalyzer project (GPL-3.0); each record's fingerprintsVersion says which version ran. A few rules that misfire on real sites are corrected (for example, an Apple domain verification is not iCloud Mail).

Limits

• Only what a website shows every visitor, its public DNS and its certificate: no logins, no traffic or revenue figures.
• Tools loaded only after a click, a consent banner or a login are seen only if they leave another trace (a Tag Manager tag, a DNS record). The browser waits for the page to load plus 2.5 seconds.
• Sites that block automated requests are retried through datacenter and then residential proxies; a site that still blocks is reported, with its DNS results if any (billed at the checked rate).
• History needs Wayback captures; small sites may have few or none. The Wayback Machine is slow (about 20 seconds per domain for the index), so history runs take longer.
• Two runs with the same monitorName and domain at the same time share one memory; schedule them apart.
• A domain that redirects to another site (sold, merged, parked) is scanned at its destination, with the original domain's DNS and certificate; redirectedTo names the destination.
• Monitoring compares like with like: changing the scan settings (pages, browser, script files, DNS, Tag Manager, minimum confidence) under the same monitorName starts a new baseline, and the run says so.
• Addresses inside private networks are never fetched.
• Nothing found: a domain that does not resolve or answer is delivered as a free row with status: "unreachable" and its statusReason, and the run succeeds even when no domain could be read that way; only a run whose every domain was blocked (or broke) fails. A run near its time limit stops starting domains, delivers what it scanned and lists the rest in RUN_SUMMARY.

Changelog

• 0.1.x, reliability (2026-10-24): a run whose domains all do not resolve or answer ends SUCCEEDED with their free status rows, instead of FAILED; input naming no domain ends with a free row saying why; a run stops starting domains before its time limit, never TIMED-OUT. Prices and events unchanged.
• 0.1.5 (October 2026): runs only as a normal actor (the Standby endpoint is retired), so AI agents can pay for runs directly.
• 0.1 (October 2026): 7,600+ technologies with versions and evidence; Tag Manager containers, DNS, certificate; key pages and script files; browser mode; Wayback history; subdomain discovery; change monitoring with typed changes; lead-list filters; three output formats; Standby endpoint.