Website Tech Stack & Security Header Detector

Analyze public websites in bulk and export evidence-based technology fingerprints plus eight browser-security-header checks. The Actor uses bounded raw HTTP requests, stores no page HTML, requires no external API key, and charges the per-site event only when a public HTML page is successfully analyzed.

What it detects

The built-in catalog currently covers 72 technologies across:

• CMS and commerce: WordPress, WooCommerce, Shopify, Wix, Squarespace, Webflow, Drupal, Joomla, Ghost, Magento, BigCommerce, PrestaShop, Contentful, and Sanity.
• Frameworks: Next.js, Nuxt, React, Vue, Angular, Svelte/SvelteKit, Gatsby, Astro, Remix, Express, Laravel, Django, Rails, ASP.NET, Java Servlet, and PHP.
• CDN and hosting: Cloudflare, Akamai, Fastly, CloudFront, KeyCDN, Bunny CDN, Vercel, Netlify, Fly.io, Render, Heroku, and GitHub Pages.
• JavaScript and CSS: jQuery, Bootstrap, Tailwind CSS, Alpine.js, HTMX, Stimulus, GSAP, and Swiper.
• Analytics, marketing, support, and payments: Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Microsoft Clarity, Segment, Plausible, Matomo, HubSpot, Marketo, Klaviyo, Mailchimp, Intercom, Zendesk, Drift, Crisp, Tawk.to, Stripe, PayPal, Square, and Braintree.

Every detection contains short evidence labels such as header:cf-ray or html:Next.js fingerprint. Header values and page HTML are not copied into the evidence.

Security-header checks

Each successful result explicitly reports whether the response provides:

1. Strict-Transport-Security
2. Content-Security-Policy
3. clickjacking protection through X-Frame-Options or CSP frame-ancestors
4. X-Content-Type-Options nosniff
5. Referrer-Policy
6. Permissions-Policy
7. Cross-Origin-Opener-Policy
8. Cross-Origin-Resource-Policy

Missing headers are returned as missing, never silently treated as present. This is an observation of one public response, not a penetration test or compliance certification.

Input

Choose exactly one source:

{
  "urls": [
    "https://wordpress.org",
    "https://shopify.com",
    "https://apify.com"
  ],
  "maxItems": 1000,
  "concurrency": 10,
  "timeoutMs": 15000,
  "maxResponseBytes": 2000000,
  "maxRedirects": 5,
  "deduplicate": true
}

Or use items / datasetId with urlField, including a nested dot path such as company.website.

Bare domains are interpreted as HTTPS. Identical normalized URLs can be emitted as uncharged duplicate records instead of being fetched twice.

Output

One dataset row is emitted for every accepted source row. A successful row contains the final URL, HTTP status, page title, detected technology names/categories/evidence, security-header assessment, redirect count, and response byte count. Failed and duplicate rows contain explicit uncharged statuses and error codes.

{
  "sourceIndex": 0,
  "inputUrl": "https://example.com",
  "normalizedUrl": "https://example.com/",
  "finalUrl": "https://example.com/",
  "status": "analyzed",
  "httpStatus": 200,
  "pageTitle": "Example Domain",
  "technologyNames": [],
  "securityHeaders": {
    "presentCount": 2,
    "assessedCount": 8,
    "missing": ["content-security-policy"]
  },
  "charged": true
}

Network and privacy boundary

• Only public HTTP and HTTPS targets are allowed.
• Local/private hostnames, credentials in URLs, and private, loopback, link-local, reserved, multicast, test-network, or otherwise non-unicast IP addresses are blocked.
• DNS answers are checked before the connection and the approved public IP is pinned for that request.
• Every redirect is resolved and checked again before it is followed.
• Response size, redirects, concurrency, source rows, and request time are bounded.
• Full HTML, response-header values, cookies, screenshots, and individual request bodies are not stored in the dataset or logs.
• Logs contain aggregate settings and counts only.

Evidence limitations

This Actor examines the raw public HTTP response. Client-rendered technologies that leave no initial HTML or header fingerprint may not be visible. A fingerprint can establish evidence that a technology is present, but absence of a fingerprint does not prove a technology is absent. The Actor does not claim exact versions or a complete private server-side stack.

Pricing behavior

The Actor uses pay-per-event pricing:

• one small run-start event;
• one site-analyzed event for each successfully fetched and analyzed public HTML page;
• invalid, blocked, failed, non-HTML, spending-limited, and duplicate rows are not charged the per-site event.

Apify enforces the caller's maximum total charge. If the remaining spending limit cannot cover another site event, unfetched rows are returned with SPENDING_LIMIT_REACHED rather than silently overspending.

Common uses

• enrich lead or company datasets with website-platform signals;
• identify CMS, commerce, analytics, and payment technologies across a domain list;
• segment migration, integration, or security-assessment opportunities;
• inventory public security-header coverage;
• feed structured website technology evidence into Apify schedules, webhooks, APIs, or MCP workflows.