Tech Stack Detector: Website Technology & SaaS Lookup

What does Website Tech Stack & SaaS Detector do?

Give it a list of websites and it tells you what each one runs on: the CMS or ecommerce platform, analytics and ad pixels, chat and marketing tools, JavaScript frameworks, CDN and hosting. It also reads each domain's public DNS records to find the email provider, the services allowed to send email for the company, its SPF and DMARC policies, and SaaS tools the company verified its domain with (for example Atlassian, HubSpot or DocuSign).

• Pay per website with results, plus Apify's small start fee per run. Websites that fail (domain does not exist, site down, nothing found) cost nothing extra.
• 7,600+ technologies recognised, each with category, confidence, version when visible, and the evidence it was found by.
• Email and DNS insights that page-only tools miss.
• Change monitoring: run it on a schedule and get the technologies each site added or removed since the last run.
• Full or compact output. Compact gives one short row per website, ready for spreadsheets, CRMs and AI agents.

What can you use it for?

• Lead lists by technology: find the stores on Shopify that use Klaviyo, or the sites on WordPress without a cookie banner tool.
• Sales enrichment: add the tech stack and email provider to the companies in your CRM.
• Competitor and market research: see which tools your market uses and how that changes over time.
• Agency prospecting: spot sites on old versions or missing analytics.
• Email security checks for your own domains or clients: SPF, DMARC policy and DMARC reporting service per domain.

How to use it

1. Paste your websites into Websites, one per line (example.com or a full URL). Up to 100,000 per run; duplicates are skipped. With the default settings a run checks about 10,000 websites an hour.
2. Pick Full or Compact output. Optionally keep only some categories, for example Ecommerce or Analytics.
3. Click Start. Download the results as CSV, Excel or JSON, or read them through the Apify API.

Input

Field	What it does	Default
Websites	Domains or URLs to check	(required)
Output format	full (every detail) or compact (one short row)	full
Minimum confidence	Report only technologies at or above this confidence, 1 to 100	50
Only these categories	Keep only these categories or groups	all
Check DNS records	Email provider, sending services, SPF, DMARC and DNS-based SaaS	on
Report changes since the last run	Compare with this website's previous result	off
Storage name for change monitoring	Named key-value store in your account that keeps the last result	tech-stack-monitor
Respect robots.txt	Skip homepages that robots.txt asks tools not to load (DNS checks still run)	on
Parallel requests	Websites checked at the same time, 1 to 100	20
Page timeout	Seconds to wait for a homepage, 5 to 120	20

Output

One row per website. Example in compact format (a made-up site):

{
  "domain": "example.com",
  "status": "ok",
  "technologyNames": ["Atlassian Cloud", "Cloudflare", "Facebook Pixel", "Google Analytics", "Google Tag Manager",
    "Google Workspace", "HubSpot", "jQuery", "MySQL", "PHP", "WordPress"],
  "technologiesByCategory": { "Analytics": ["Facebook Pixel", "Google Analytics"], "CMS": ["WordPress"], "CDN": ["Cloudflare"] },
  "emailProvider": "Google Workspace",
  "emailSendingServices": ["Google Workspace", "MailChimp"],
  "technologiesFromDns": ["Atlassian Cloud", "Google Workspace", "HubSpot"],
  "errorCode": null
}

The full format adds, for each technology, its categories, version, confidence, website, SaaS and open-source flags, and the evidence it was found by:

{
  "name": "Cloudflare",
  "categories": ["CDN"],
  "version": null,
  "confidence": 100,
  "website": "https://www.cloudflare.com",
  "detectedVia": ["headers"],
  "evidence": ["header:server", "header:cf-ray"]
}

It also adds the email setup (inbox provider, MX hosts, sending services, SPF and DMARC policies, DMARC report services), DNS facts (nameservers, CNAME targets), site facts (title, description, language, generator tag, company social profiles), robots.txt status, and the time of the check. The dataset has ready-made views: Overview, Technologies, Email and DNS, Status details and Changes.

Status of each row

• ok: the homepage and DNS were analysed.
• partial: some data, but the page was blocked, returned an error, or was skipped (for example because of robots.txt). The statusDetail and error fields say what happened.
• failed: nothing could be checked. Not charged.

How much does it cost?

You pay a small fee for each website that returns at least one finding (a technology or an email setup), plus Apify's small fee for starting a run. Websites that fail, and partial rows with no findings, are not charged. See the Pricing tab for current prices.

Limitations

• One page per website. The tool reads the homepage (or the exact URL you give) plus DNS. Tools used only on other pages are not seen.
• No browser. Pages are read without running JavaScript. Install snippets written in the page are read, so many analytics, chat and ad tags are still found, but tags added only inside a tag manager (such as a Google Tag Manager container) and apps that build the whole page in the browser can be missed.
• Bot protection. Some sites block automated visits. Those rows come back as partial with the error code BLOCKED, usually still with DNS findings.
• Fingerprints are evidence, not proof. Each result has a confidence score and evidence. Raise Minimum confidence if you want fewer, surer results.
• robots.txt is followed by the standard (RFC 9309). When a website's robots.txt answers with a server error or not at all, its homepage is not loaded (DNS checks still run), and statusDetail says so. You can turn Respect robots.txt off for websites you own or may test.
• Only public websites: private and internal network addresses are refused, including when a website redirects to one.

Privacy and data

The tool reads only public web pages and public DNS records. It returns no email addresses and no personal profiles: DMARC report addresses are reduced to the service name, and only company social profile links (not personal ones) are kept. It never logs in, fills forms or bypasses access controls, and it respects robots.txt by default. You are responsible for using the results lawfully, for example under GDPR when you contact companies.

Use it from code or AI agents

Run it through the Apify API or the Apify clients for JavaScript and Python, or connect it to Make, Zapier, n8n and other tools through Apify integrations. Compact output keeps each row short for AI agents and spreadsheets.

Support

Found a wrong or missing detection? Open an issue on the Issues tab with the website and what you expected; we add fixes to our own fingerprint additions. This Actor is built and maintained with the help of AI (Claude), and replies to issues are AI-assisted.

Credits

Technology fingerprints come from the community-maintained webappanalyzer project (GPL-3.0), plus our own additions. The changelog lists the version in use.