Tech Stack Detector

Tech Stack Detector checks each website and returns one row with the technologies it uses: CMS, ecommerce platform, analytics and ad tags (including those loaded through Google Tag Manager), frameworks, CDN and hosting, plus the email provider and business tools named in the domain's DNS records. Every finding lists the evidence that matched. Paste domains or URLs and click Start. Pages are read without a browser, so a tool that appears only after the page's scripts run can be missed. It costs $1.00 per 1,000 websites on the Free plan ($0.50 on Business), and the $5 of monthly credit in Apify's Free plan covers about 5,000 websites.

What data does it return?

Field	Description
status	ok (analyzed and charged), blocked (a bot protection page answered), http_error, unreachable, robots_disallowed (the website's robots.txt disallows the page) or invalid_input.
technologyNames, technologyCount	Every technology found, the most important categories first, and how many there are.
cms, ecommerce, analytics, tagManagers, advertising	Findings sorted into columns, for example Shopify in ecommerce and Facebook Pixel in analytics.
marketingAutomation, crm, liveChat, payments, reviews, cookieConsent	More columns of the same kind, for example Yotpo Reviews in reviews.
jsFrameworks, webFrameworks, uiFrameworks, programmingLanguages, webServers, cdn, hosting, security	The technical stack, with values such as React, Nginx or Cloudflare.
shopifyApps	Shopify apps found on a Shopify store.
emailServices	Mailbox provider from the MX records and sending services from the SPF record, for example Microsoft 365.
verifiedServices	Business tools whose verification record sits in the domain's TXT records, for example DocuSign or Miro.
technologies	One object per technology with categories, version, confidence (0 to 100), foundIn (website, dns or website and dns), saas, pricing and evidence.
url, title, language, generator	Address after redirects, page title, declared language and the generator meta tag.
sslIssuer, sslValidUntil, sslValid	Issuer and expiry of the TLS certificate, and whether it is trusted for the domain.
pagesScanned, pageUrls	Number and addresses of the pages analyzed on the website.
newTechnologies, removedTechnologies	With a watch name, the technologies added and removed since the previous run.
error, blockedBy	Why a row is not ok, and which bot protection answered.

How to detect a website's tech stack

1. Paste domains or URLs into Websites, one per line, for example allbirds.com, www.example.com or https://www.example.com/shop. A domain is checked at its homepage, a URL at that page.
2. Raise Pages per website (up to 10) to also check pages linked from the first one, such as shop, pricing, blog, contact or login pages. Tools that load only there are found this way, and the price per website stays the same.
3. Keep Read DNS records on for the email provider, sending services and verified business tools.
4. Click Start. The Output tab shows one row per website, ready to export as CSV, Excel or JSON or to read through the API.

The same run through the API, with three pages per website:

{
  "websites": ["apify.com", "allbirds.com", "wordpress.org"],
  "maxPagesPerSite": 3,
  "scanDns": true
}

Example output

One row from a run on 29 September 2026. technologies is cut to 4 of its 25 entries: one matched by script URLs, one by DNS records, one inside the site's Google Tag Manager container and one by a verification TXT record.

{
  "input": "allbirds.com",
  "url": "https://www.allbirds.com/",
  "domain": "allbirds.com",
  "status": "ok",
  "httpStatus": 200,
  "title": "Allbirds: Comfortable, Sustainable Shoes & Apparel",
  "description": "Allbirds: The world’s most comfortable shoes, flats, and clothing made with natural materials like merino wool and eucalyptus. FREE shipping & returns.",
  "language": "en-US",
  "generator": null,
  "technologyCount": 25,
  "technologyNames": [
    "Shopify",
    "Microsoft 365",
    "Apple Pay",
    "PayPal",
    "Adalyser",
    "Attentive",
    "Cloudflare",
    "Cursor",
    "Facebook Pixel",
    "Google Ads",
    "Google Ads Conversion Tracking",
    "Google Analytics",
    "Google Tag Manager",
    "HSTS",
    "ipify",
    "Let's Encrypt",
    "Microsoft Advertising",
    "Outbrain",
    "Priority Hints",
    "Swiper",
    "Yotpo Reviews",
    "DocuSign",
    "HTTP/3",
    "Miro",
    "Open Graph"
  ],
  "cms": [],
  "ecommerce": [
    "Shopify"
  ],
  "analytics": [
    "Facebook Pixel",
    "Google Ads Conversion Tracking",
    "Google Analytics"
  ],
  "tagManagers": [
    "Google Tag Manager"
  ],
  "advertising": [
    "Adalyser",
    "Google Ads",
    "Microsoft Advertising",
    "Outbrain"
  ],
  "marketingAutomation": [
    "Attentive"
  ],
  "crm": [],
  "liveChat": [],
  "payments": [
    "Apple Pay",
    "PayPal"
  ],
  "jsFrameworks": [],
  "webFrameworks": [],
  "uiFrameworks": [],
  "programmingLanguages": [],
  "webServers": [],
  "cdn": [
    "Cloudflare"
  ],
  "hosting": [],
  "security": [
    "HSTS"
  ],
  "cookieConsent": [],
  "reviews": [
    "Yotpo Reviews"
  ],
  "shopifyApps": [],
  "emailServices": [
    "Microsoft 365"
  ],
  "verifiedServices": [
    "Cursor",
    "DocuSign",
    "Miro"
  ],
  "technologies": [
    {
      "name": "Shopify",
      "categories": [
        "Ecommerce"
      ],
      "version": null,
      "confidence": 100,
      "foundIn": "website",
      "website": "https://shopify.com",
      "saas": true,
      "pricing": [
        "low",
        "recurring"
      ],
      "evidence": [
        "script https://cdn.shopify.com/s/files/1/1104/4168/files/jsEncrypt.js?v=1756910700",
        "script https://cdn.shopify.com/shopifycloud/shop-js/modules/v2/loader.init-shop-cart-sync.en.esm.js",
        "script https://cdn.shopify.com/shopifycloud/storefront/assets/storefront/origin_trials-318ab40a.js"
      ]
    },
    {
      "name": "Microsoft 365",
      "categories": [
        "Webmail",
        "Email"
      ],
      "version": null,
      "confidence": 100,
      "foundIn": "dns",
      "website": "https://www.microsoft.com/microsoft-365",
      "saas": false,
      "pricing": [],
      "evidence": [
        "DNS MX allbirds-com.mail.protection.outlook.com",
        "DNS TXT MS=ms40651830",
        "DNS TXT MS=ms79507765"
      ]
    },
    {
      "name": "Facebook Pixel",
      "categories": [
        "Analytics"
      ],
      "version": null,
      "confidence": 100,
      "foundIn": "website",
      "website": "https://facebook.com",
      "saas": false,
      "pricing": [],
      "evidence": [
        "Google Tag Manager container GTM-TH8KRSBJ loads https://connect.facebook.net/en_US/fbevents.js"
      ]
    },
    {
      "name": "DocuSign",
      "categories": [
        "Miscellaneous"
      ],
      "version": null,
      "confidence": 100,
      "foundIn": "dns",
      "website": "https://www.docusign.com",
      "saas": true,
      "pricing": [
        "low",
        "recurring"
      ],
      "evidence": [
        "DNS TXT docusign=7de1885c-e938-41b0-9a4d-06213413de67"
      ]
    }
  ],
  "sslIssuer": "Let's Encrypt",
  "sslValidUntil": "2026-11-08T22:33:31.000Z",
  "sslValid": true,
  "pagesScanned": 1,
  "pageUrls": [
    "https://www.allbirds.com/"
  ],
  "blockedBy": null,
  "error": null,
  "responseTimeMs": 1048,
  "newTechnologies": null,
  "removedTechnologies": null,
  "checkedAt": "2026-09-29T05:50:11.403Z"
}

How much does it cost to detect a tech stack?

	Free plan	Starter	Scale	Business
1,000 websites	$1.00	$0.80	$0.65	$0.50

You pay only for the events in the table. There is no start fee, and compute time and proxies are included.

Checking 1,000 websites costs $1.00 on the Free plan and $0.50 on Business, however many Pages per website you allow. Rows with the status blocked, http_error, unreachable, robots_disallowed or invalid_input come with the reason and are not charged.

Limits

• Detection works from what the server sends: headers, cookies, HTML, script URLs, inline scripts, meta tags, the TLS certificate, robots.txt and DNS. Of the 7,628 technologies in the fingerprint set, 6,686 can be recognized this way; the rest need a running page.
• Up to 3 Google Tag Manager containers per website are opened, and the tags configured inside them are matched as well.
• A website that answers with a bot protection page, for example a Cloudflare challenge, gets the status blocked. Its technologies then come from headers, cookies and DNS only.
• DNS is read at the zone apex: for www.example.co.uk the actor reads the records of example.co.uk.
• A verification record shows that the company has an account with a tool. Such tools go to verifiedServices and stay out of website columns such as analytics.
• A website that does not answer at all still gets its DNS findings in an unreachable row.
• The actor reads each website's robots.txt first and follows it. A website whose robots.txt disallows the page gets a free robots_disallowed row with DNS findings only; a disallowed extra page is skipped. When robots.txt answers with a server error or not at all, the website is skipped in that run as unreachable.

Tracking changes on a list of websites

Fill in Watch name (report changes between runs), or save the input as a task, and schedule it. From the second run on, each analyzed row carries newTechnologies and removedTechnologies, and the CHANGES record lists every website that added or dropped a technology since the previous run.

FAQ

Is it legal to detect a website's technology stack?

The actor loads public pages the way a browser does and reads DNS records, which are public by design. It logs in nowhere and collects no personal data. You are responsible for how you use the results.

Where do the detection rules come from?

From the open-source webappanalyzer fingerprint set, in its version of 16 September 2026. Every match is listed in evidence, for example DNS MX allbirds-com.mail.protection.outlook.com, so you can check why a technology was reported.

Why is a tool I know about missing?

It may load only after the page's scripts run, only on pages other than the ones checked, or only for visitors who are logged in or have accepted cookies. Raising Pages per website helps in the second case.

Related scrapers

• Domain WHOIS and DNS Lookup
• WHOIS Domain Lookup
• Shopify Store Analyzer
• Google Ads Transparency Scraper

Support

This actor is built and maintained by deriverge s.r.o., a software company based in the Czech Republic. If a run fails or a field you need is missing, please open an issue in the Issues tab or write to us at info@deriverge.com. We respond in English and Czech. Runs can be scheduled in Apify Console or started from the API tab, which has examples for Python, JavaScript and cURL and works with Make, Zapier, n8n and the Apify MCP server. If the actor saves you time, a short review helps other people find it.