Website Tech Stack Scraper – Detect CMS, Analytics, CDN, Hosting & Email Provider

Find out which technologies any website runs on. Paste a list of domains and get a clean JSON/CSV/Excel table with the CMS, e-commerce platform, JavaScript frameworks, analytics and ad pixels, tag managers, chat and marketing tools, CDN, hosting and web server of every site – with a confidence score and the evidence for each detection.

It uses plain HTTP (no browser), so it is fast and cheap: hundreds of sites in a few minutes. Failed or empty sites are returned as clear rows and are never charged.

What you get

Feature	Details
🧩 Technology detection	250+ hand-maintained fingerprints in 40+ categories: CMS, website builders, e-commerce, payments, frameworks, UI libraries, analytics, advertising pixels, tag managers, marketing automation, live chat, cookie consent, CDN, hosting, web servers, languages
📊 Confidence + evidence	Every technology has confidence (0-100), version when visible, and evidence (header, cookie, meta tag, script URL, markup)
🏷️ Grouped output	technologyNames (flat list) and categories (grouped), ready for filters and pivot tables
🎯 Lead-list filter	Enter requireTechnologies (e.g. Shopify, Klaviyo) and every row gets matchesAllRequired
📧 DNS & email provider (add-on)	MX / NS / TXT records plus detection of Google Workspace, Microsoft 365, email-sending services and DNS host
🔐 Security header audit (add-on)	HTTPS + six security headers, 0-100 score and list of missing headers
🛡️ Reliability	Automatic retries with fresh proxy IPs, residential fallback, robots.txt respected, per-site error rows

Use cases

• Sales & agencies: build lead lists of sites that use a specific platform ("all Shopify stores without Klaviyo").
• Competitor research: see which analytics, ad pixels and tools competitors run.
• Market sizing: measure how widely a CMS, framework or CDN is used in a list of domains.
• Security & compliance: quickly spot sites without HSTS or CSP, or without a cookie-consent tool.
• Data enrichment: add a tech profile to your CRM or spreadsheet via API, n8n, Make or Zapier.

How to use it

1. Enter websites to scan (domains or URLs, one per line).
2. Optionally set required technologies, and turn on the DNS and security audit add-ons.
3. Click Start and download the results as JSON, CSV or Excel, or read them through the API.

Input example

{
  "urls": ["https://wordpress.org", "shopify.com", "https://vercel.com"],
  "requireTechnologies": ["Cloudflare"],
  "includeDnsRecords": true,
  "includeSecurityAudit": true
}

Output example (one item per website)

{
  "url": "https://wordpress.org",
  "finalUrl": "https://wordpress.org/",
  "domain": "wordpress.org",
  "statusCode": 200,
  "title": "WordPress.org",
  "generator": null,
  "server": "nginx",
  "technologyCount": 6,
  "technologies": [
    {"name": "Nginx", "category": "Web server", "version": null, "confidence": 60, "evidence": ["header Server"]},
    {"name": "Google Workspace", "category": "Email provider", "version": null, "confidence": 80, "evidence": ["dns MX record"]}
  ],
  "technologyNames": ["Nginx", "Google Workspace"],
  "categories": {"Web server": ["Nginx"], "Email provider": ["Google Workspace"]},
  "hasData": true,
  "dns": {"mx": ["aspmx.l.google.com"], "ns": ["ns1.example.com"], "txt": ["v=spf1 …"]},
  "emailAndDnsProviders": ["Google Workspace"],
  "securityAudit": {"score": 71, "https": true, "headers": {"Strict-Transport-Security": true}, "missing": ["Content-Security-Policy"]},
  "scrapedAt": "2026-10-18T10:00:00Z"
}

Sites that cannot be scanned come back as {"url": "...", "error": "...", "hasData": false, "scrapedAt": "..."}.

Run summary

Every run saves a RUN_STATS record (Storage → Key-value store) with the number of sites with technologies, sites without any, failures with reasons, and retry counts.

Pricing

Pay per result, no platform usage fees and no start fee:

Event	When it is charged
Website scanned	Once per website where at least one technology was detected
DNS & email provider (add-on)	Per website, only if you turned it on and DNS records exist
Security header audit (add-on)	Per website, only if you turned it on and the site was scanned

Failed websites and sites without detected technologies are never charged. Exact prices are on the Pricing tab and get lower on higher Apify plans.

FAQ

How accurate is the detection? The Actor analyses the HTTP response of the page you give it: headers, cookies, HTML, meta tags and script/stylesheet URLs. Technologies that only load after user interaction or only appear on other pages are not seen – scan a specific URL (e.g. the checkout page) if you need those. Technologies marked "implied by …" are inferred and have a lower confidence.

Does it run JavaScript? No. That keeps it fast and cheap. Server-rendered sites and most script tags are detected; things injected purely by late client-side code may be missed.

Which pages are scanned? Exactly the URL you enter (a bare domain means the homepage). One request per website.

Are robots.txt rules respected? Yes, by default. If a site disallows automated access to the page, you get an error row and no charge.

Is it legal? The Actor reads only public information that every browser receives when visiting a page, plus public DNS records, and collects no personal data. You are responsible for using the data in line with applicable laws and the terms of the sites you scan.

Can I schedule it? Yes. Use Apify Schedules and connect results to Sheets, Slack, n8n, Make or your own API.

Support

Found a bug, a missing technology or need a feature? Open an issue on the Issues tab – fixes usually ship within a few days.