Tech Stack Detector: Website Technology Lookup

This tech stack detector is a website technology lookup for any domain: find out what a site is built with, from 7,600+ technologies in 100+ categories (CMS, ecommerce, analytics, marketing automation, CRM, live chat, payments, ads, hosting, CDN, frameworks, Shopify and WordPress plugins…), with versions, confidence and the evidence for every detection. It reads more than the HTML: the site's Google Tag Manager containers (the tags a plain fetch never sees), DNS (email provider, services that send its email, 50+ SaaS domain verifications) and the TLS certificate. Add history from the Wayback Machine (when each tool arrived and what it replaced), change monitoring (added, removed, upgraded, migrated), lead-list filters and a real browser when a page needs one. Run it once, on a schedule or through the API.

How to look up a website's technology

1. Open Tech Stack Detector on Apify and go to its input form.
2. Enter sites in Domains or URLs, one per line, or pick a dataset in Domains from a dataset and name its Domain column.
3. Set Pages per domain, and turn Read Google Tag Manager containers and Check DNS and certificate on or off (both free). For a lead list, fill Must use and Must not use.
4. Start the run. Open the Overview view to read each site's CMS, Ecommerce, Hosting, Analytics, Marketing, Email and Spend tier, the Technology rows view for each Technology, Version and Found by, and the Email and DNS view for Email provider and Verified services.
5. To catch tech changes, turn on Monitor for changes, give it a Monitor name, save it as a task and schedule it weekly. The Changes (monitoring) view then lists each site whose technologies were added, removed, upgraded or migrated.

What the tech stack detector gives you

• Qualify a lead list: "Which of these 5,000 domains run Shopify and Klaviyo but no live chat?" Give domains (or another actor's dataset), set Must use and Must not use, get only the matches, with your original columns kept.
• Catch buying signals: schedule a monitor and get only the sites that changed: "adopted HubSpot", "dropped Intercom", "migrated from WooCommerce to Shopify", "upgraded WordPress 6.4 → 6.5".
• See a site's past: Years of history (historyYears: 3) dates each technology from yearly Wayback captures and lists what the site used before.
• Profile a company: email provider and senders (Google Workspace, Microsoft 365, SendGrid, Salesforce…), services it verified its domain with (Atlassian, DocuSign, Stripe, OpenAI…), hosting, CDN, a spend tier and a minimum monthly spend on paid tools.
• Audit a site: versions with CPE identifiers for vulnerability scanners, HTTPS, HSTS, CSP, HTTP/3, certificate authority, SPF and DMARC policy.
• Enrich domains from n8n, Make, Clay or an AI agent: call the actor with one domain or a list and read the dataset. AI agents can run and pay for it directly through Apify's MCP server.

Tech stack detection accuracy

• More than the homepage HTML. It matches the full open fingerprint set and adds Tag Manager containers, DNS and the certificate. On hubspot.com the container alone adds 6sense, Demandbase, Hotjar, Reddit Ads, Impact and Floodlight.
• Every detection is explained. What matched and where (script URL, header, cookie, meta tag, DOM element, DNS record, Tag Manager tag), how it was found (detectedVia: website, tagManager, dns, certificate, implied) and a confidence score. Weak signals (a short global name alone) score under the default threshold.
• History on the first run. It looks back up to 5 years in the Wayback Machine, so the first run already says when each tool arrived.
• Monitoring without false alarms. A technology is reported removed only after it is missing from N complete scans in a row (default 2). A blocked or failed scan never removes anything.
• The exact host. blog.example.com is scanned as blog.example.com, not swapped for example.com; redirects are followed and reported. Optional subdomain discovery from certificate logs.
• Fair billing. Domains that could not be read (unreachable, error, or blocked with nothing found) are free. Sites filtered out, unchanged in monitoring, or blocked but still showing DNS or certificate results (status: "partial") cost the checked rate ($0.50 per 1,000), plus any extra pages, script files, browser renders and history snapshots used on them.
• Compatible input. urls, websites, startUrls (as strings or { "url": … }), domain and url from other detectors work as they are.

Tech stack detector input

Field	Key	What it does
Domains or URLs	domains	Domains or URLs to scan (example.com, shop.example.com, a full URL)
Domains from a dataset	datasetId	Read domains from another dataset; its columns come back under source
Domain column	domainField	The dataset column that holds the domain or URL (default domain)
Max domains	maxDomains	Optional. Stop after this many domains
URLs (alias)	urls	Same as Domains or URLs, for inputs from other detectors
Websites (alias)	websites	Same as Domains or URLs
Start URLs (alias)	startUrls	Same as Domains or URLs; objects with a url key work too
Domain (alias)	domain	One domain, for workflows that send one at a time
URL (alias)	url	One URL, for workflows that send one at a time
Pages per domain	maxPagesPerDomain	1 = homepage (default); up to 10 adds key pages it links to (pricing, cart, contact, login, careers, blog, about)
Read Google Tag Manager containers	readTagManager	Read the site's Google Tag Manager containers (default on, free)
Check DNS and certificate	checkDns	DNS records and the certificate issuer (default on, free)
Read script files	scanScriptFiles	Read up to 5 script files for bundled libraries and versions (default off)
Use a real browser	useBrowser	Render in Chrome: never (default), auto (only for blocked and script-only pages) or always
Years of history	historyYears	Scan one Wayback capture a year back, 0–5 (default 0)
Discover subdomains	discoverSubdomains	Find subdomains in certificate logs and scan them (default off)
Max subdomains per domain	maxSubdomains	Subdomains scanned per domain, shortest names first (default 10, up to 50)
Must use	requireTechnologies	Keep only sites using these technologies or categories
Must use: any or all	requireMode	Whether a site needs any (default) or all of the Must use names
Must not use	excludeTechnologies	Leave out sites using any of these
Only list these categories	categories	List only technologies in these categories; summaries still cover everything
Minimum confidence	minConfidence	Leave out weaker detections, 0–100 (default 50)
Monitor for changes	monitorMode	Only sites that changed since the last run under the same monitor name; the first run returns every site as a baseline
Monitor name	monitorName	Runs with the same name share one memory (default default)
Changes to report	changeTypes	added, removed, version-changed, migrated (default all)
Runs before a removal counts	confirmRemovalRuns	Complete scans a technology must be missing before it counts as removed, 1–5 (default 2)
Output format	outputFormat	domains (a record per domain, default), technologies (a row per technology) or columns (a column per tracked name)
Columns	columnTechnologies	Columns for the columns format (defaults to Must use)
Include evidence	includeEvidence	Evidence per detection (default on)
Include descriptions	includeDescriptions	A one-line description of each technology (default off)
Include site info	includeSiteInfo	Title, language, organization, logo, social profiles and contact page (default on)
Only these fields	fields	Return only these fields (dotted paths reach into lists)
Sites at a time	maxConcurrency	Sites scanned in parallel (default 10, up to 50)
Proxy	proxyConfiguration	Optional; the actor picks proxies itself (direct, then datacenter, then residential only for a site that blocks the others)
History store	stateStoreName	The key-value store that keeps each monitor (default: its own store, cleanpull-techstack-monitor); pick one when you run with a scoped API token

Technology and category names match without case; an unknown name ends the run before any scan, with a free row naming it and suggestions ("Klav (did you mean Klaviyo?)"); nothing is charged.

Example inputs

A lookup of one store (the site in the example record below):

{ "domains": ["colourpop.com"] }

A lead list: stores on Shopify with Klaviyo and no live chat, as spreadsheet columns.

{
  "datasetId": "YOUR_DATASET_ID",
  "domainField": "website",
  "requireTechnologies": ["Shopify", "Klaviyo"],
  "requireMode": "all",
  "excludeTechnologies": ["Live chat"],
  "outputFormat": "columns",
  "columnTechnologies": ["Shopify", "Klaviyo", "Gorgias", "Yotpo Reviews", "Ecommerce"]
}

A weekly watch for tech changes at target accounts (schedule it):

{
  "domains": ["acme.com", "globex.com", "initech.com"],
  "monitorMode": true,
  "monitorName": "target-accounts",
  "changeTypes": ["added", "removed", "migrated"]
}

A deep profile with three years of history:

{ "domains": ["allbirds.com"], "maxPagesPerDomain": 4, "historyYears": 3, "useBrowser": "auto" }

Tech stack detector output

Rows are shown in the Overview, Technology rows, Changes (monitoring) and Email and DNS views.

Example rows

A domain record (shortened; a real record from 6 October 2026):

{
  "domain": "colourpop.com",
  "url": "https://colourpop.com/",
  "status": "ok",
  "technologyCount": 30,
  "ecommerce": ["Shopify"],
  "hosting": ["Amazon Web Services"],
  "cdn": ["Cloudflare"],
  "analytics": ["Google Analytics"],
  "marketingAutomation": ["Klaviyo", "Tolstoy"],
  "payments": ["Apple Pay", "Klarna Checkout", "PayPal", "Venmo"],
  "advertising": ["Google Ads"],
  "emailProvider": "Sophos Email",
  "emailSenders": ["Google Workspace"],
  "verifiedServices": ["Amazon SES", "Google Search Console", "Meta Business"],
  "security": {
    "https": true,
    "hsts": true,
    "contentSecurityPolicy": true,
    "http3": true,
    "certificateIssuer": "Let's Encrypt",
    "spf": true,
    "dmarcPolicy": "reject"
  },
  "spend": {
    "paidTechnologies": 11,
    "low": 7,
    "mid": 2,
    "high": 0,
    "minimumMonthlyUsd": 200,
    "tier": "mid"
  },
  "site": {
    "title": "ColourPop® Cosmetics",
    "language": "en",
    "organization": {
      "name": "ColourPop",
      "logo": "https://colourpop.com/cdn/shop/files/colourpop-logo.svg"
    },
    "socialProfiles": {
      "instagram": "https://instagram.com/colourpopcosmetics",
      "tiktok": "https://www.tiktok.com/@colourpopco"
    },
    "contactPage": "https://colourpop.com/pages/contact-us"
  },
  "tagManagerIds": ["GTM-WQKQL2VQ"],
  "technologies": [
    {
      "name": "Okendo",
      "version": "0.104.2",
      "confidence": 100,
      "categories": ["Reviews", "Shopify apps"],
      "saas": true,
      "pricing": ["low", "recurring"],
      "detectedVia": ["website"],
      "evidence": [
        {
          "type": "dom",
          "key": "div.okeReviews [data-oke-reviews-version]",
          "value": "0.104.2",
          "page": "https://colourpop.com/"
        }
      ]
    },
    {
      "name": "Google Analytics",
      "confidence": 100,
      "categories": ["Analytics"],
      "detectedVia": ["tagManager"],
      "evidence": [{ "type": "tagManager", "key": "GTM-WQKQL2VQ", "value": "tag template __gaawe" }]
    }
  ]
}

The same Okendo detection as a row of the technologies Output format (fields from the record above):

{
  "domain": "colourpop.com",
  "url": "https://colourpop.com/",
  "status": "ok",
  "technology": "Okendo",
  "version": "0.104.2",
  "confidence": 100,
  "categories": "Reviews, Shopify apps",
  "saas": true,
  "pricing": "low, recurring",
  "foundBy": "dom div.okeReviews [data-oke-reviews-version]: 0.104.2"
}

A changed record in monitoring (illustrative: the shape of a change, not a real site). Shopify was reported added on an earlier run; once WooCommerce has been missing from 2 complete scans in a row, it is reported removed, paired with Shopify as migrated:

{
  "domain": "example-store.com",
  "url": "https://example-store.com/",
  "status": "ok",
  "technologyCount": 27,
  "ecommerce": ["Shopify"],
  "previousScanAt": "2026-11-03T06:00:00.000Z",
  "changes": [
    {
      "type": "removed",
      "technology": "WooCommerce",
      "categories": ["Ecommerce"],
      "firstSeen": "2025-02-01T06:00:00.000Z",
      "lastSeen": "2026-11-03T06:00:00.000Z"
    },
    {
      "type": "migrated",
      "technology": "Shopify",
      "categories": ["Ecommerce"],
      "from": "WooCommerce",
      "to": "Shopify"
    }
  ]
}

Record fields

Each technology also has groups, website, oss, cpe (with the version filled in), impliedBy and pages; categories on the record groups every technology by category. With historyYears, each technology gets firstSeen and switchedFrom, and the record gets history, historyFrom and previousTechnologies. A firstSeen equal to historyFrom means "at least since then". In monitoring, changed records carry changes (type, technology, from, to) and previousScanAt.

Headline fields and spend tier

Headline fields (cms, ecommerce, hosting, cdn, analytics, liveChat, advertising, frameworks) use only what the website itself shows; crm, marketingAutomation and payments also count DNS verifications (a domain verified with Salesforce uses Salesforce). The spend tier follows each tool's published price band: low under $100 a month, mid $100–1,000, high over $1,000; minimumMonthlyUsd adds $100 per mid tool and $1,000 per high tool.

Run summary

Every run writes RUN_SUMMARY to the key-value store: the outcome (COMPLETE, PARTIAL, NO_CHANGES, EMPTY or FAILED), counts by status, charges, warnings and the domains that could not be read.

Pricing

Pay only for results. Domains that could not be read are never charged.

Event	Free	Bronze	Silver	Gold
Domain result (full record)	$3.00	$2.00	$1.80	$1.60
Domain checked (filtered out, unchanged in monitoring, or blocked with DNS results only)	$0.50	$0.50	$0.45	$0.40
Change (monitoring: one changed domain)	$5.00	$5.00	$4.50	$4.00
Extra request (each key page or script file beyond the homepage)	$0.30	$0.30	$0.27	$0.24
Browser render (per domain rendered in Chrome)	$5.00	$5.00	$4.50	$4.00
History snapshot (per Wayback capture scanned)	$2.00	$2.00	$1.80	$1.60
Subdomain discovery (per domain searched)	$1.00	$1.00	$0.90	$0.80

Prices are per 1,000; your tier depends on your Apify plan. Each run also has a $0.00005 start fee. Tag Manager containers, DNS and the certificate are included. Billing is per domain in every output format. The first monitoring run is billed at the domain result price; a domain that is only partial on its first run (blocked, with DNS or certificate results) is billed at the checked rate and not kept as a baseline, so its next run is a first run again and pays the domain result price once it reads in full. A changed domain is billed as a change instead of a domain result. Extra requests, browser renders and history snapshots are billed for every domain scanned with them, also when it is filtered out or unchanged.

Technology detection rules

Each technology has rules for what it leaves on a site: script URLs, HTML, meta tags, response headers, cookies, DOM elements, JavaScript globals, DNS records or certificate issuers, some with a version pattern. The confidences of the rules that match add up to 100, a technology can imply others (WordPress → PHP), and some need another to be present or rule one out. Without a browser, globals that the page's own inline scripts assign are read too (window.Shopify = …); a real browser reads every global with its value and every host the page calls.

Rules come from the open-source webappanalyzer project (GPL-3.0); each record's fingerprintsVersion says which version ran. A few rules that misfire on real sites are corrected (for example, an Apple domain verification is not iCloud Mail).

Limits

• Only what a website shows every visitor, its public DNS and its certificate: no logins, no traffic or revenue figures.
• Tools loaded only after a click, a consent banner or a login are seen only if they leave another trace (a Tag Manager tag, a DNS record). The browser waits for the page to load plus 2.5 seconds.
• Sites that block automated requests are retried through datacenter and then residential proxies; a site that still blocks is reported, with its DNS results if any (billed at the checked rate).
• History needs Wayback captures; small sites may have few or none. The Wayback Machine is slow (about 20 seconds per domain for the index), so history runs take longer.
• Two runs with the same monitorName and domain at the same time share one memory; schedule them apart.
• A domain that redirects to another site (sold, merged, parked) is scanned at its destination, with the original domain's DNS and certificate; redirectedTo names the destination.
• Monitoring compares like with like: changing the scan settings (pages, browser, script files, DNS, Tag Manager, minimum confidence) under the same monitorName starts a new baseline, and the run says so.
• Addresses inside private networks are never fetched.
• Nothing found: a domain that could not be read is delivered as a free row with its status (unreachable for one that does not resolve or answer, blocked with nothing found, or error) and its statusReason. A blocked domain that still shows DNS or certificate results is not free: it is a billed row with status: "partial", at the checked rate. The run fails only when every domain gave nothing (no ok or partial row) and at least one of them was blocked with nothing found or broke with an error; when every domain gave nothing because none resolved or answered, it succeeds with their free rows. A run near its time limit stops starting domains, delivers what it scanned and lists the rest in RUN_SUMMARY.

FAQ

How much does a website technology lookup cost per domain?

A domain's full record costs $0.002 on the Bronze plan and $0.003 on the Free plan, with Tag Manager, DNS and the certificate included: 1,000 homepages are $2 on Bronze, $3 on Free. Each key page or script file beyond the homepage adds $0.0003, a browser render $0.005, each history snapshot $0.002 (Years of history 3 is up to 3 snapshots, $0.006) and Discover subdomains $0.001 per domain searched, each subdomain then scanned as a domain. A site that does not match your filters costs $0.0005 instead of the full record. With Monitor for changes, the first run bills each domain as a full record; after that an unchanged domain costs $0.0005 and a changed one $0.005 (Free and Bronze), plus any add-ons used. A domain that could not be read is never charged, and higher Apify plans pay less (see Pricing above).

How often should I monitor a site's technology?

Weekly suits most lead lists, daily for accounts you sell to now. The first run is the baseline. A technology counts as added or upgraded on the run it appears, and as removed only after it is missing from Runs before a removal counts complete scans in a row (2 by default); a blocked or failed scan never removes anything. Keep the scan settings the same under one Monitor name: changing pages, browser, script files, DNS, Tag Manager or minimum confidence starts a new baseline.

What is the difference between the headline fields and the technologies list?

technologies lists every detection above Minimum confidence, with its version, confidence and evidence. The headline fields (cms, ecommerce, hosting, cdn, analytics, liveChat, advertising, frameworks) are short lists for filtering and spreadsheets, from what the website itself shows; crm, marketingAutomation and payments also count DNS verifications. emailProvider is who receives the domain's email (its MX records); emailSenders are the services allowed to send it.

Why is a technology missing, or a site empty?

• Loaded after a click, consent banner or login: seen only if it leaves another trace (a Tag Manager tag, a DNS record). Use a real browser sees tags added after load.
• Blocked or unreachable: the row has status blocked or unreachable and a statusReason, and is free. A blocked site with DNS or certificate results has status: "partial" instead: those results only, billed at the checked rate.
• Weak signal: detections below Minimum confidence (50 by default) are left out.
• Filtered list: Only list these categories lists only those categories (the summaries still cover everything).
• Moved site: a domain that redirects is scanned at its destination; redirectedTo names it.
• No history: small sites may have few or no Wayback captures.

Which technologies and categories does it detect?

7,600+ technologies in 100+ categories, from the open-source webappanalyzer rules (see Technology detection rules above), plus rules of its own for DNS domain verifications and email senders: CMS, ecommerce platforms, Shopify and WordPress plugins, analytics, marketing automation, CRM, live chat, reviews, payments, ads, hosting, CDN, frameworks and more. Must use, Must not use and Only list these categories take any of their names, in any case.

Can I use the tech stack detector through the API?

Yes. Start runs through the Apify API or an API client, with one domain in domain or a list in domains, and read the dataset through its Overview, Technology rows, Changes (monitoring) and Email and DNS views, or the RUN_SUMMARY record with the outcome, counts by status, charges and the domains that could not be read. Output format shapes the rows, and Only these fields (fields) trims them to the keys you need.

Does it work with Google Sheets, Make, Zapier or Claude?

Yes. Apify's integrations send each run's results to Google Sheets, Make, Zapier, n8n, webhooks and other tools, and the columns Output format gives one flat row per domain for spreadsheets and Clay. From Claude, the MarketMage plugin profiles a competitor's store, its apps and marketing tools included, in a chat.

Is it allowed to look up a website's technology?

The actor reads what a website shows every visitor, its public DNS records and its certificate: no login, no account and no customer data. Site info keeps the organization name, logo, social profiles and contact page link, never emails or phone numbers. How you use the data, and following the laws and terms that apply to you, is your responsibility. This is not legal advice.

Related actors

Other CleanPull actors for market research:

• Shopify Scraper: every product and variant from any Shopify store, with stock and sales estimates.
• Ad Library Monitor: competitors' new and stopped ads on Facebook, Google and TikTok.
• Google Sheets Sync: send any dataset to Google Sheets, or read a sheet into one.

Use it from Claude

The MarketMage plugin runs these actors from a Claude chat.

Found it useful? A rating on the Store helps others find it.

Changelog

• Price lowered on 5 Nov 2026: a domain result now costs $2.00 / $1.80 / $1.60 per 1,000 (Bronze / Silver / Gold), down from $3.00 / $2.70 / $2.40. Free plan and other events unchanged.
• 0.1.x, reliability (2026-11-01): a domain that does not resolve is looked up once more after a short wait before it is reported unreachable, so a passing DNS fault no longer marks a live site unreachable. Prices and events unchanged.
• 0.1.x, reliability (2026-10-24): a run whose domains all do not resolve or answer ends SUCCEEDED with their free status rows, instead of FAILED; input naming no domain ends with a free row saying why; a run stops starting domains before its time limit, never TIMED-OUT. Prices and events unchanged.
• 0.1.5 (October 2026): runs only as a normal actor (the Standby endpoint is retired), so AI agents can pay for runs directly.
• 0.1 (October 2026): 7,600+ technologies with versions and evidence; Tag Manager containers, DNS, certificate; key pages and script files; browser mode; Wayback history; subdomain discovery; change monitoring with typed changes; lead-list filters; three output formats; Standby endpoint.