Website Tech Stack Lookup - Technology Detector

What does Website Tech Stack Lookup do?

Website Tech Stack Lookup tells you which technologies a list of websites runs on: CMS, ecommerce platform, analytics, tag manager, CDN, hosting, web server, JavaScript framework, marketing and chat tools, payment providers and hundreds more, with the version when the site exposes it, a confidence score and the evidence behind every detection. It also reads the public DNS of each domain to report the mail provider (MX), the SPF record with the email services it authorises, the DMARC policy and the DNS provider. Paste domains or URLs, run, and export JSON, CSV or Excel, or call it from the Apify API, n8n, Make or an AI agent through MCP.

Why use a website technology detector?

• Lead generation and list building – keep only the Shopify, WooCommerce, Magento or HubSpot sites from a list of thousands (Only sites using any of these technologies) and get the mail provider for outreach planning.
• Sales qualification – see whether a prospect uses a competitor, which analytics and marketing automation it pays for, and whether its email is on Google Workspace or Microsoft 365.
• Competitor and market research – measure how often a platform, framework or CDN appears across a market segment.
• Email deliverability audits – check SPF and DMARC for a whole portfolio of domains in one run.
• Agency and M&A due diligence – get the server, hosting, CMS version and plugin footprint of a site before a pitch or a deal.

Example output

input	cms	ecommerce	cdn	hosting	mailProvider	dmarcPolicy	technologyCount
porterandyork.com	WordPress	WooCommerce	Cloudflare	WP Engine	Google Workspace	none	11
coxandcox.co.uk		Magento 2	Fastly	Adobe Commerce Cloud, Platform.sh	Google Workspace	quarantine	16
jquery.com	WordPress 7.1		Cloudflare		Forward Email	reject	6

{
  "input": "porterandyork.com",
  "domain": "porterandyork.com",
  "finalUrl": "https://porterandyork.com/",
  "statusCode": 200,
  "title": "Buy Premium Meat Online | Porter & York Butcher Shop",
  "language": "en-US",
  "technologyCount": 11,
  "technologyNames": "Cloudflare, WordPress, Cloudflare DNS, Google Workspace, WP Engine, Google Search Console, WooCommerce, Google Tag Manager, Cloudflare Bot Management, PHP, Rank Math",
  "technologies": [
    { "name": "WooCommerce", "category": "Ecommerce", "version": null, "confidence": 99, "evidence": ["html /wp-content/plugins/woocommerce/", "html wc_add_to_cart_params"] },
    { "name": "Google Workspace", "category": "Email provider", "version": null, "confidence": 100, "evidence": ["dns mx aspmx.l.google.com", "dns spf include:_spf.google.com"] }
  ],
  "cms": "WordPress",
  "ecommerce": "WooCommerce",
  "cdn": "Cloudflare",
  "hosting": "WP Engine",
  "mailProvider": "Google Workspace",
  "hasSpf": true,
  "spfRecord": "v=spf1 include:_spf.google.com ~all",
  "hasDmarc": true,
  "dmarcPolicy": "none",
  "dnsChecked": true,
  "found": true
}

The Technologies with evidence view unwinds the list into one row per technology.

How much does it cost?

You pay per website analyzed. Pricing depends on your Apify plan: a small fee when a run starts, then a price per analyzed website that is lower on paid plans. The Apify free plan includes monthly credit you can use to try it. Sites that could not be analyzed (domain does not exist, timeout, bot challenge page, HTTP error) get a row with found: false and the reason, and are never charged; sites skipped by the technology filter are not charged either. Set a maximum spend on the run and the Actor stops when it is reached. Each site costs one page request plus a few DNS lookups, so runs are fast and light on platform resources.

Input

• Domains or URLs – bare domains (shopify.com), hostnames (www.bbc.co.uk) or full URLs. A bare domain is tried at https://domain/, then https://www.domain/, then http://domain/. Duplicates are merged and invalid entries are listed in the run status. Leave empty for a free example run.
• Technology categories to list – limit the technologies list to categories such as CMS, Ecommerce or Analytics; the summary columns stay complete.
• Only sites using any of these technologies – lead filter by technology name, for example Shopify, WooCommerce, Magento, HubSpot or Klaviyo.
• Follow redirects, Check DNS, Parallel sites, Request timeout, Proxy configuration.

What is detected and how?

The Actor loads the home page (or the URL you give) over plain HTTP and matches 847 technology fingerprints written for this Actor against the response headers, cookie names, meta tags, script URLs and page HTML. DNS adds MX, SPF, DMARC, NS, CNAME, A and PTR signals: mail providers and security gateways, sending services authorised in SPF, DNS hosts, hosting and CDN networks, and services the domain was verified with. Versions come from generator tags, headers such as Server and X-Powered-By, and versioned CDN paths. Technologies implied by another one (PHP by WordPress, React by Next.js) are marked "implied by" and carry a lower confidence.

FAQ

Is it legal to use this data?

The Actor reads only what any browser or DNS client receives from a public website and public DNS: it does not log in, does not use your cookies and does not solve captchas. How you use the results is your responsibility, including data protection and anti-spam rules for outreach. This description is not legal advice.

How accurate is it?

On 1 October 2026 the page and header detections on 23 well-known sites (shopify.com, wordpress.org, vercel.com, hubspot.com, stripe.com, bbc.co.uk, several Shopify, WooCommerce and Magento stores and others) were checked by hand against their page source: 175 detections, 2 false positives found in the first pass (WordPress.com hosting inferred from a Jetpack statistics script, and a Vue.js signal that also appears in Inertia/React pages), both fixed; after the fix all 175 were correct. DNS detections on the same sites (199) are read directly from public records; a TXT verification record shows that the domain was verified with a service at some point, not that it is still in use. The same sample was used to tune the fingerprints, so treat this as a sanity check rather than a benchmark. Technologies loaded only by JavaScript after the page renders, or only on inner pages, are not visible to a single HTTP request.

Why is a site reported as blocked-by-bot-protection?

Some sites answer requests from data center addresses with a challenge page (Cloudflare, Akamai, Fastly, DataDome and similar). The Actor recognises these pages, returns found: false with the reason and does not charge. A residential proxy in Proxy configuration often gets through.

What are the limits?

One page per site (after redirects, up to 8 hops and one meta refresh), the first 2 MB of HTML, 20 seconds per request by default. There is no limit on the number of domains. The Actor analyzes 10 sites at a time by default (up to 50), and never more than 2 URLs of the same host at once; in a local test on 1 October 2026, 12 well-known sites took 5.9 seconds in total including DNS. Slow or unreachable sites take longer, up to the request timeout for each address tried.

How often should I run it?

Tech stacks change slowly: monthly runs through an Apify schedule are enough for most lead lists; weekly for competitive monitoring.

Related Actors

Other datagrit Actors cover job boards with salary data (Greenhouse, Ashby) and company registers, useful next to a tech stack when you build company profiles.