# Tech Stack Detector: Website Technology Lookup (`cleanpull/tech-stack-detector`) Actor Website technology lookup for any domain: 7,600+ technologies with versions and evidence (CMS, ecommerce, analytics, marketing, payments, hosting) from the page, Tag Manager, DNS and certificates. Tech history, change monitoring and lead-list filters. From $3 per 1,000 sites. - **URL**: https://apify.com/cleanpull/tech-stack-detector.md - **Developed by:** [CleanPull](https://apify.com/cleanpull) (community) - **Categories:** Developer tools, Lead generation, SEO tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $2.40 / 1,000 domain results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## Tech Stack Detector: Website Technology Lookup Find out what any website is built with: **7,600+ technologies** in 110 categories (CMS, ecommerce, analytics, marketing automation, CRM, live chat, payments, ads, hosting, CDN, frameworks, Shopify and WordPress plugins…) with **versions, confidence and the evidence for every detection**. It reads more than the HTML: the site's **Google Tag Manager containers** (the tags a plain fetch never sees), **DNS** (email provider, services that send its email, 50+ SaaS domain verifications) and the **TLS certificate**. Add **history from the Wayback Machine** (when each tool arrived and what it replaced), **change monitoring** (added, removed, upgraded, migrated), **lead-list filters** and a **real browser** when a page needs one. Fast HTTP, from **$3 per 1,000 sites**. ### What you can do with it - **Qualify a lead list**: "Which of these 5,000 domains run Shopify and Klaviyo but no live chat?" Give domains (or another actor's dataset), set Must use and Must not use, get only the matches, with your original columns kept. - **Catch buying signals**: schedule a monitor and get only the sites that changed: "adopted HubSpot", "dropped Intercom", "migrated from WooCommerce to Shopify", "upgraded WordPress 6.4 → 6.5". - **See a site's past**: `historyYears: 3` dates each technology from yearly Wayback captures and lists what the site used before. - **Profile a company**: email provider and senders (Google Workspace, Microsoft 365, SendGrid, Salesforce…), services it verified its domain with (Atlassian, DocuSign, Stripe, OpenAI…), hosting, CDN, a spend tier and a minimum monthly spend on paid tools. - **Audit a site**: versions with CPE identifiers for vulnerability scanners, HTTPS, HSTS, CSP, HTTP/3, certificate authority, SPF and DMARC policy. - **Enrich domains from n8n, Make, Clay or an AI agent**: call the actor with one domain or a list and read the dataset. AI agents can run and pay for it directly through Apify's MCP server. ### Why this actor - **Sees what HTTP-only detectors miss.** Most detectors fetch one homepage and match 40–250 signatures. This one matches the full open fingerprint set and adds Tag Manager containers, DNS and the certificate. On hubspot.com the container alone adds 6sense, Demandbase, Hotjar, Reddit Ads, Impact and Floodlight. - **Every detection is explained.** What matched and where (script URL, header, cookie, meta tag, DOM element, DNS record, Tag Manager tag), how it was found (`detectedVia`: website, tagManager, dns, certificate, implied) and a confidence score. Weak signals (a short global name alone) score under the default threshold. - **History on the first run.** Other monitors start remembering the day you start them; this one looks back up to 5 years. - **Monitoring without false alarms.** A technology is reported removed only after it is missing from N complete scans in a row (default 2). A blocked or failed scan never removes anything. - **The exact host.** `blog.example.com` is scanned as `blog.example.com`, not swapped for `example.com`; redirects are followed and reported. Optional subdomain discovery from certificate logs. - **Fair billing.** Unreachable domains are free. Sites filtered out, unchanged in monitoring, or blocked but still showing DNS results cost the checked rate ($0.50 per 1,000). - **Compatible input.** `urls`, `websites`, `startUrls` (as strings or `{ "url": … }`), `domain` and `url` from other detectors work as they are. ### Input | Field | Type | What it does | | ----------------------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------- | | `domains` | array | Domains or URLs to scan (`example.com`, `shop.example.com`, a full URL) | | `datasetId`, `domainField` | string | Read domains from another dataset's column; its columns come back under `source` | | `maxDomains` | integer | Stop after this many domains | | `maxPagesPerDomain` | integer | 1 = homepage; up to 10 adds key pages it links to (pricing, cart, contact, login, careers, blog, about) | | `readTagManager` | boolean | Read the site's Google Tag Manager containers (default on, free) | | `checkDns` | boolean | DNS records and the certificate issuer (default on, free) | | `scanScriptFiles` | boolean | Read up to 5 script files for bundled libraries and versions | | `useBrowser` | `never`, `auto`, `always` | Render in Chrome: always, or only for blocked and script-only pages | | `historyYears` | 0–5 | Scan one Wayback capture a year back | | `discoverSubdomains`, `maxSubdomains` | boolean, integer | Find subdomains in certificate logs and scan them | | `requireTechnologies`, `requireMode` | array, `any`/`all` | Keep only sites using these technologies or categories | | `excludeTechnologies` | array | Leave out sites using any of these | | `categories` | array | List only technologies in these categories | | `minConfidence` | 0–100 | Leave out weaker detections (default 50) | | `monitorMode`, `monitorName` | boolean, string | Only sites that changed since the last run under that name | | `changeTypes` | array | `added`, `removed`, `version-changed`, `migrated` | | `confirmRemovalRuns` | 1–5 | Complete scans a technology must be missing before it counts as removed | | `outputFormat` | `domains`, `technologies`, `columns` | A record per domain, a row per technology, or a row per domain with a column per tracked technology | | `columnTechnologies` | array | Columns for the `columns` format (defaults to Must use) | | `includeEvidence`, `includeDescriptions`, `includeSiteInfo` | boolean | Evidence per detection, a description of each technology, site and company info | | `fields` | array | Return only these fields (dotted paths reach into lists) | Technology and category names match without case; an unknown name fails the run with suggestions ("Klav (did you mean Klaviyo?)"). #### Example inputs A lead list: stores on Shopify with Klaviyo and no live chat, as spreadsheet columns. ```json { "datasetId": "YOUR_DATASET_ID", "domainField": "website", "requireTechnologies": ["Shopify", "Klaviyo"], "requireMode": "all", "excludeTechnologies": ["Live chat"], "outputFormat": "columns", "columnTechnologies": ["Shopify", "Klaviyo", "Gorgias", "Yotpo Reviews", "Ecommerce"] } ``` A weekly watch for tech changes at target accounts (schedule it): ```json { "domains": ["acme.com", "globex.com", "initech.com"], "monitorMode": true, "monitorName": "target-accounts", "changeTypes": ["added", "removed", "migrated"] } ``` A deep profile with three years of history: ```json { "domains": ["allbirds.com"], "maxPagesPerDomain": 4, "historyYears": 3, "useBrowser": "auto" } ``` ### Output A domain record (shortened; a real record from 6 October 2026): ```json { "domain": "colourpop.com", "url": "https://colourpop.com/", "status": "ok", "technologyCount": 30, "ecommerce": ["Shopify"], "hosting": ["Amazon Web Services"], "cdn": ["Cloudflare"], "analytics": ["Google Analytics"], "marketingAutomation": ["Klaviyo", "Tolstoy"], "payments": ["Apple Pay", "Klarna Checkout", "PayPal", "Venmo"], "advertising": ["Google Ads"], "emailProvider": "Sophos Email", "emailSenders": ["Google Workspace"], "verifiedServices": ["Amazon SES", "Google Search Console", "Meta Business"], "security": { "https": true, "hsts": true, "contentSecurityPolicy": true, "http3": true, "certificateIssuer": "Let's Encrypt", "spf": true, "dmarcPolicy": "reject" }, "spend": { "paidTechnologies": 11, "low": 7, "mid": 2, "high": 0, "minimumMonthlyUsd": 200, "tier": "mid" }, "site": { "title": "ColourPop® Cosmetics", "language": "en", "organization": { "name": "ColourPop", "logo": "https://colourpop.com/cdn/shop/files/colourpop-logo.svg" }, "socialProfiles": { "instagram": "https://instagram.com/colourpopcosmetics", "tiktok": "https://www.tiktok.com/@colourpopco" }, "contactPage": "https://colourpop.com/pages/contact-us" }, "tagManagerIds": ["GTM-WQKQL2VQ"], "technologies": [ { "name": "Okendo", "version": "0.104.2", "confidence": 100, "categories": ["Reviews", "Shopify apps"], "saas": true, "pricing": ["low", "recurring"], "detectedVia": ["website"], "evidence": [ { "type": "dom", "key": "div.okeReviews [data-oke-reviews-version]", "value": "0.104.2", "page": "https://colourpop.com/" } ] }, { "name": "Google Analytics", "confidence": 100, "categories": ["Analytics"], "detectedVia": ["tagManager"], "evidence": [{ "type": "tagManager", "key": "GTM-WQKQL2VQ", "value": "tag template __gaawe" }] } ] } ``` Each technology also has `groups`, `website`, `oss`, `cpe` (with the version filled in), `impliedBy` and `pages`; `categories` on the record groups every technology by category. With `historyYears`, each technology gets `firstSeen` and `switchedFrom`, and the record gets `history`, `historyFrom` and `previousTechnologies`. A `firstSeen` equal to `historyFrom` means "at least since then". In monitoring, changed records carry `changes` (type, technology, from, to) and `previousScanAt`. Headline fields (`cms`, `ecommerce`, `hosting`, `cdn`, `analytics`, `liveChat`, `advertising`, `frameworks`) use only what the website itself shows; `crm`, `marketingAutomation` and `payments` also count DNS verifications (a domain verified with Salesforce uses Salesforce). The spend tier follows each tool's published price band: low under $100 a month, mid $100–1,000, high over $1,000; `minimumMonthlyUsd` adds $100 per mid tool and $1,000 per high tool. Every run writes `RUN_SUMMARY` to the key-value store: the outcome (`COMPLETE`, `PARTIAL`, `NO_CHANGES`, `EMPTY` or `FAILED`), counts by status, charges, warnings and the domains that could not be read. ### Pricing Pay only for results. Unreachable domains are never charged. | Event | Free and Bronze | Silver | Gold | | ---------------------------------------------------------------------------------------- | --------------- | ------ | ----- | | Domain result (full record) | $3.00 | $2.70 | $2.40 | | Domain checked (filtered out, unchanged in monitoring, or blocked with DNS results only) | $0.50 | $0.45 | $0.40 | | Change (monitoring: one changed domain) | $5.00 | $4.50 | $4.00 | | Extra request (each key page or script file beyond the homepage) | $0.30 | $0.27 | $0.24 | | Browser render (per domain rendered in Chrome) | $5.00 | $4.50 | $4.00 | | History snapshot (per Wayback capture scanned) | $2.00 | $1.80 | $1.60 | | Subdomain discovery (per domain searched) | $1.00 | $0.90 | $0.80 | Prices are per 1,000; your tier depends on your Apify plan. Each run also has a $0.00005 start fee. Tag Manager containers, DNS and the certificate are included. Billing is per domain in every output format. The first monitoring run is billed at the domain result price. ### How detection works Each technology has rules for what it leaves on a site: script URLs, HTML, meta tags, response headers, cookies, DOM elements, JavaScript globals, DNS records or certificate issuers, some with a version pattern. The confidences of the rules that match add up to 100, a technology can imply others (WordPress → PHP), and some need another to be present or rule one out. Without a browser, globals that the page's own inline scripts assign are read too (`window.Shopify = …`); a real browser reads every global with its value and every host the page calls. Rules come from the open-source [webappanalyzer](https://github.com/enthec/webappanalyzer) project (GPL-3.0); each record's `fingerprintsVersion` says which version ran. A few rules that misfire on real sites are corrected (for example, an Apple domain verification is not iCloud Mail). ### Limits - Only what a website shows every visitor, its public DNS and its certificate: no logins, no traffic or revenue figures. - Tools loaded only after a click, a consent banner or a login are seen only if they leave another trace (a Tag Manager tag, a DNS record). The browser waits for the page to load plus 2.5 seconds. - Sites that block automated requests are retried through datacenter and then residential proxies; a site that still blocks is reported, with its DNS results if any (billed at the checked rate). - History needs Wayback captures; small sites may have few or none. The Wayback Machine is slow (about 20 seconds per domain for the index), so history runs take longer. - Two runs with the same `monitorName` and domain at the same time share one memory; schedule them apart. - A domain that redirects to another site (sold, merged, parked) is scanned at its destination, with the original domain's DNS and certificate; `redirectedTo` names the destination. - Monitoring compares like with like: changing the scan settings (pages, browser, script files, DNS, Tag Manager, minimum confidence) under the same `monitorName` starts a new baseline, and the run says so. - Addresses inside private networks are never fetched. - **Nothing found**: a domain that does not resolve or answer is delivered as a free row with `status: "unreachable"` and its `statusReason`, and the run succeeds even when no domain could be read that way; only a run whose every domain was blocked (or broke) fails. A run near its time limit stops starting domains, delivers what it scanned and lists the rest in RUN_SUMMARY. ### Changelog - **0.1.x, reliability** (2026-10-24): a run whose domains all do not resolve or answer ends SUCCEEDED with their free status rows, instead of FAILED; input naming no domain ends with a free row saying why; a run stops starting domains before its time limit, never TIMED-OUT. Prices and events unchanged. - **0.1.5** (October 2026): runs only as a normal actor (the Standby endpoint is retired), so AI agents can pay for runs directly. - **0.1** (October 2026): 7,600+ technologies with versions and evidence; Tag Manager containers, DNS, certificate; key pages and script files; browser mode; Wayback history; subdomain discovery; change monitoring with typed changes; lead-list filters; three output formats; Standby endpoint. # Actor input Schema ## `domains` (type: `array`): Websites to scan, one per line: example.com, shop.example.com or a full URL. The exact host is scanned (a subdomain is not swapped for its main domain); redirects are followed and reported. ## `datasetId` (type: `string`): Optional. The ID of an Apify dataset (from another actor, a CSV you uploaded…) whose rows hold the domains. Every row's columns are kept in the output under "source". ## `domainField` (type: `string`): The dataset column that holds the domain or URL. ## `maxDomains` (type: `integer`): Optional. Stop after this many domains. ## `urls` (type: `array`): Optional. Same as Domains; accepted so inputs from other detectors work unchanged. ## `websites` (type: `array`): Optional. Same as Domains. ## `startUrls` (type: `array`): Optional. Same as Domains; objects with a "url" key work too. ## `domain` (type: `string`): Optional. One domain, for workflows that send one at a time. ## `url` (type: `string`): Optional. One URL, for workflows that send one at a time. ## `maxPagesPerDomain` (type: `integer`): 1 reads the homepage. More adds key pages the homepage links to (pricing, cart, contact, login, careers, blog, about), where checkout, chat and sign-up tools often load. Each extra page is billed as an extra request. ## `readTagManager` (type: `boolean`): Read the site's public Tag Manager containers: the analytics, ad and heat-map tags they fire are invisible to a plain page fetch. Free. ## `checkDns` (type: `boolean`): Read MX, TXT, NS, SOA, CNAME and DMARC records and the TLS certificate issuer: email provider, services that send its email, services it verified its domain with (Microsoft 365, Atlassian, Stripe…), DNS host and certificate authority. Free. ## `scanScriptFiles` (type: `boolean`): Also download up to 5 of the page's script files (its own bundles first) to find libraries and versions bundled inside them. Each file is billed as an extra request. ## `useBrowser` (type: `string`): A real Chrome sees JavaScript globals with their values, every host the page calls and tags added after load. "When needed" renders only pages that block plain requests or are empty without JavaScript. Billed per domain rendered. ## `historyYears` (type: `integer`): Scan one Wayback Machine capture of the homepage per year, up to 5 years back: when each technology was first seen, what the site used before (WooCommerce before Shopify), and every past snapshot. Billed per snapshot scanned. ## `discoverSubdomains` (type: `boolean`): Find the domain's subdomains in public certificate logs (shop., blog., app., help.) and scan them too. Billed per domain searched, plus each subdomain scanned. ## `maxSubdomains` (type: `integer`): Subdomains to scan per domain, shortest names first. ## `requireTechnologies` (type: `array`): Optional. Keep only sites using these technologies or categories, for example "Shopify", "Klaviyo" or "Live chat". Names match the 7,600+ technologies and 110 categories, in any case; an unknown name is reported with suggestions. Sites that do not match are billed at the checked rate and not returned. ## `requireMode` (type: `string`): Whether a site needs one of the Must use names or all of them. ## `excludeTechnologies` (type: `array`): Optional. Leave out sites using any of these technologies or categories. ## `categories` (type: `array`): Optional. List only technologies in these categories (for example "Ecommerce", "Analytics"); summaries still cover everything. ## `minConfidence` (type: `integer`): Leave out detections below this confidence (0–100). Most detections are 100; a few weak signals (a single generic cookie) score lower. ## `monitorMode` (type: `boolean`): Return only sites whose technologies changed since the last run under the same monitor name: added, removed, new version, or migrated (one product replaced by another in the same category). The first run returns every site as a baseline. Schedule it daily or weekly. ## `monitorName` (type: `string`): Runs with the same name share one memory; use different names for different lists. ## `changeTypes` (type: `array`): Which changes count. A site with only other changes is billed at the checked rate and not returned. ## `confirmRemovalRuns` (type: `integer`): A technology is reported removed only after it is missing from this many complete scans in a row, so a tag that loads only sometimes does not raise false alarms. A blocked or failed scan never removes anything. ## `outputFormat` (type: `string`): How results are shaped. Billing is per domain in every format. ## `columnTechnologies` (type: `array`): For the columns format: technologies (true/false) and categories (names found) to make columns for. Defaults to the Must use list. ## `includeEvidence` (type: `boolean`): For each technology, what matched and where (script URL, header, cookie, DNS record, Tag Manager tag). ## `includeDescriptions` (type: `boolean`): A one-line description of each technology, useful for AI agents. ## `includeSiteInfo` (type: `boolean`): Title, description, language, organization name, logo and country from structured data, social profiles and the contact page link. No emails or phone numbers. ## `fields` (type: `array`): Optional. Keep only these fields, for example \["domain", "cms", "technologies.name"]. Dotted paths reach into lists. ## `maxConcurrency` (type: `integer`): How many sites are scanned in parallel. ## `proxyConfiguration` (type: `object`): Optional. The actor picks proxies itself (direct, then datacenter, then residential only for a site that blocks the others). ## Actor input object example ```json { "domains": [ "stripe.com", "colourpop.com", "techcrunch.com" ], "domainField": "domain", "maxPagesPerDomain": 1, "readTagManager": true, "checkDns": true, "scanScriptFiles": false, "useBrowser": "never", "historyYears": 0, "discoverSubdomains": false, "maxSubdomains": 10, "requireMode": "any", "minConfidence": 50, "monitorMode": false, "monitorName": "default", "changeTypes": [ "added", "removed", "version-changed", "migrated" ], "confirmRemovalRuns": 2, "outputFormat": "domains", "includeEvidence": true, "includeDescriptions": false, "includeSiteInfo": true, "maxConcurrency": 10 } ``` # Actor output Schema ## `results` (type: `string`): One record per domain (or rows, in the other formats). ## `overview` (type: `string`): No description ## `changes` (type: `string`): No description ## `summary` (type: `string`): Outcome (COMPLETE, PARTIAL, NO_CHANGES, EMPTY, FAILED), counts, charges and domains that could not be read. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "domains": [ "stripe.com", "colourpop.com", "techcrunch.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("cleanpull/tech-stack-detector").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "domains": [ "stripe.com", "colourpop.com", "techcrunch.com", ] } # Run the Actor and wait for it to finish run = client.actor("cleanpull/tech-stack-detector").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "domains": [ "stripe.com", "colourpop.com", "techcrunch.com" ] }' | apify call cleanpull/tech-stack-detector --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,cleanpull/tech-stack-detector" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/hvD6qrRDMgZCebHnH/builds/PQzzuD0YqLoQYrXLn/openapi.json