Website Intelligence Scanner — Tech Stack, Security & Contacts

Scan any list of websites and get back a complete intelligence profile for each one in a single structured JSON item: technology stack, marketing pixels, hosting/CDN, a security grade, and contact details — no login, no API key, no proxy required.

Built for lead-qualification, CRM enrichment, competitor research and security audits. Point it at a list of URLs, get back a decision-ready dataset.

Why this Actor

• One pass, everything — a single scan returns CMS, JS frameworks, analytics, e-commerce platforms, CDN/hosting, security grade and emails/social links. No stitching together three separate tools.
• No JavaScript rendering needed — fingerprints are read from raw HTML and HTTP headers, which is where the vast majority of stack signals live. That keeps scans fast, cheap and reliable.
• Bulk by design — scan 5 sites or 5,000. Websites are processed concurrently (5 at a time) and each produces exactly one dataset item.
• Security grading included — an A+ to F grade from 6 key HTTP security headers, so you can triage a whole portfolio in one run.
• Pay per website — a small fee per scanned site, no subscription, no minimums.

Who is this for?

• Agencies & freelancers — qualify prospects by stack ("show me WordPress sites with no analytics that would benefit from a redesign pitch").
• Sales teams — enrich CRM records with technology and contact data before the first call.
• Competitive intelligence — see exactly what your competitors run and how they track visitors.
• Security & SEO audits — bulk-grade security headers across a portfolio of client or partner sites.

Input

{
  "websites": ["https://example.com", "shopify.com", "https://www.wikipedia.org"],
  "extractContacts": true,
  "checkSecurity": true,
  "timeoutSecs": 30
}

Field	Type	Default	Description
websites	array of string	—	URLs or bare domains to scan. https:// is added automatically. Required.
extractContacts	boolean	true	Extract emails and social profile links from the homepage.
checkSecurity	boolean	true	Grade HTTP security headers (A+ to F) and list missing ones.
timeoutSecs	integer	30	Per-website fetch timeout in seconds.

Output (one item per website)

{
  "url": "https://example-store.com",
  "finalUrl": "https://www.example-store.com/",
  "statusCode": 200,
  "responseTimeMs": 412,
  "title": "Example Store — Handmade Goods",
  "cms": "Shopify",
  "frameworks": ["jQuery", "Tailwind CSS"],
  "analytics": ["Google Analytics 4", "Facebook Pixel", "Hotjar"],
  "ecommerce": ["Shopify", "Stripe"],
  "cdn": "Cloudflare",
  "securityGrade": "B",
  "securityScore": 4,
  "missingSecurityHeaders": ["content-security-policy", "permissions-policy"],
  "emails": ["hello@example-store.com"],
  "socialProfiles": ["https://instagram.com/examplestore", "https://www.linkedin.com/company/example-store"]
}

Field glossary

Field	Meaning
cms / frameworks	Site builder (WordPress, Shopify, Wix, Webflow…) and JS frameworks (Next.js, React, Vue, Angular…). Unknown stacks return null rather than a guess.
analytics	Marketing stack: GA4, GTM, Facebook Pixel, Hotjar, Plausible, Intercom and more.
ecommerce	Storefront + payment platforms detected (Shopify, WooCommerce, Stripe…).
cdn	CDN/hosting fingerprint (Cloudflare, Vercel, Netlify, CloudFront…) from headers and HTML.
securityGrade	A+ to F based on 6 key security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. securityScore is the raw count (0–6), missingSecurityHeaders names the gaps.
emails / socialProfiles	Contact signals found on the homepage (email addresses, LinkedIn/X/Facebook/Instagram/GitHub links…).

Run it from the API

Trigger the Actor and get results in one call:

curl -X POST "https://api.apify.com/v2/acts/darknezz~website-intelligence-scanner/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"websites":["example.com","shopify.com","stripe.com"]}'

From Python:

import requests

resp = requests.post(
    "https://api.apify.com/v2/acts/darknezz~website-intelligence-scanner/run-sync-get-dataset-items",
    params={"token": "YOUR_TOKEN"},
    json={"websites": ["https://vercel.com", "https://www.wordpress.org"]},
    timeout=300,
)
scans = resp.json()  # one dict per website
for s in scans:
    print(s["url"], s["cms"], s["frameworks"], s["securityGrade"])

Scheduling: attach an Apify Schedule to re-scan a fixed prospect list weekly — technology and security posture change, and a fresh dataset keeps your outreach accurate.

Worked example (real output)

Scanning https://vercel.com and https://www.wordpress.org returns:

[
  {
    "url": "https://vercel.com",
    "title": "Agentic Infrastructure - Vercel",
    "cms": null,
    "frameworks": ["Next.js"],
    "cdn": "Vercel",
    "server": "Vercel",
    "poweredBy": "Next.js, Payload",
    "securityGrade": "A",
    "securityScore": 5,
    "missingSecurityHeaders": ["permissions-policy"],
    "socialProfiles": ["https://github.com/vercel", "https://linkedin.com/company/vercel", "..."]
  },
  {
    "url": "https://www.wordpress.org",
    "title": "Blog Tool, Publishing Platform, and CMS – WordPress.org",
    "cms": "WordPress",
    "analytics": ["Google Tag Manager"],
    "server": "nginx",
    "securityGrade": "D",
    "securityScore": 2,
    "missingSecurityHeaders": ["content-security-policy", "x-content-type-options", "referrer-policy", "permissions-policy"],
    "socialProfiles": ["https://twitter.com/WordPress", "https://www.linkedin.com/company/wordpress", "..."]
  }
]

The contrast is the point: in one pass you know Vercel runs Next.js with a strong security posture, while WordPress.org is a WordPress site missing 4 of 6 key security headers — a ready-made qualification signal before outreach.

Use cases

• 🎯 Lead qualification — filter a scraped prospect list by stack ("has no analytics", "runs WooCommerce", "no security headers") before you send the first email.
• 🗂️ CRM enrichment — append tech stack, security grade and contacts to every company record.
• 🕵️ Competitor teardown — map what the market leader runs: CMS, analytics, CDN, checkout stack.
• 🛡️ Security triage — grade every site in your portfolio for the six headers security teams and buyers check first.
• 🔁 Prospecting refreshes — scheduled re-scans keep your lead data from going stale.

Pricing

Pay per event: you are charged a small fee per website scanned, plus Apify's standard platform events (actor start + dataset item). No subscriptions, no minimums — scan 5 sites or 5,000.

FAQ

Does it render JavaScript? No — it analyzes the raw HTML and HTTP headers, which is where the vast majority of fingerprints live. That's what keeps it fast and cheap. For JS-rendered stacks, combine with an Apify browser crawler.

How accurate is the CMS detection? Fingerprints cover the 12 most popular CMS/site builders plus the generator meta tag as a fallback. Unknown stacks return null rather than a guess.

Can I scan thousands of sites? Yes — websites are scanned concurrently (5 at a time) and each one produces exactly one dataset item. Rate yourself against Apify's dataset-item limits.

What does the security grade really mean? It's a transparent score: 6 security headers checked, each worth 1 point. A+ = all 6 present, F = none. The missingSecurityHeaders array tells you exactly what to fix.

Do bare domains work? Yes — https:// is prepended automatically. example.com and https://example.com behave identically.

Why did the scanner say Blogger for python.org? The Blogger fingerprint fires on any page whose HTML contains blogspot.com — python.org's <link rel="alternate"> RSS entry points to pyfound.blogspot.com (the PSF news blog), which trips the needle even though the site itself is a custom static build. The generator meta tag and server header are returned alongside, so you can judge the raw signals yourself. Known-stack detection covers the 12 most popular CMS/site builders; ambiguous sites return a best-effort guess with the evidence fields.

Does the security grade cover TLS/SSL? No — it grades six HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). TLS configuration is outside the current scope; the grade is a transparent, reproducible header score, not a penetration test.

Is scanning these sites allowed? You should only scan sites you own or have permission to probe, and comply with each site's terms of service and applicable law.

Limitations

• No JavaScript rendering — the scanner reads raw HTML and HTTP headers, so stacks that only appear client-side after rendering (e.g. heavily hydrated SPAs) may be under-reported. For JS-rendered stacks, combine with an Apify browser crawler.
• Homepage-only contact extraction — emails and social links come from the homepage, not the contact/about sub-pages (unlike the sibling Website Email & Contact Extractor, which crawls deeper). Set extractContacts only when you want a quick homepage signal.
• Concurrency is fixed — websites are scanned 5 at a time; a very large batch is processed in waves, so total runtime scales with list size.
• Best-effort fingerprinting — unknown or ambiguous stacks return null rather than a guess, and a small number of sites misidentify on shared markup patterns (see FAQ).