Tech Stack Detector — Website Technology Lookup

Detect the technology stack behind any website: frameworks, CMS, JavaScript libraries, analytics, CDN, hosting, payments and marketing tools. A cheaper, scriptable way to get technology data than enterprise API tiers.

Unofficial. This is an independent tool. It is not affiliated with, endorsed by, or sponsored by Wappalyzer, BuiltWith, or any other technology-profiling service. All trademarks belong to their respective owners.

Licence note. The technology fingerprint data is derived from the GPL-3.0 enthec/webappanalyzer database, so this Actor is distributed under GPL-3.0. The full licence and attribution are in LICENSE-AND-ATTRIBUTION.md.

Give it a list of URLs. Get back one record per site, with every technology it found and the evidence that produced each match — header, HTML pattern, script URL or cookie.

What you get

For each URL:

Field	Description
url, final_url	Requested and post-redirect URL
status_code, elapsed_ms	Response status and fetch time
technologies	Flat list of detected technology names
technology_count	How many were found
detail	Per technology: name, version (when exposed), confidence (confirmed or inferred), evidence[]
server, powered_by	Raw Server / X-Powered-By headers

Why this exists

Wappalyzer and BuiltWith are excellent but their API tiers are priced for enterprises, and the free browser extension doesn't help you at scale or in a pipeline. This Actor gives you the same class of signal as clean JSON you can schedule, loop over, and feed into your own systems — at pay-per-result pricing with no monthly seat.

Typical uses

• Lead qualification — filter prospect lists by what they actually run (Shopify vs custom, HubSpot vs none) before your sales team wastes calls.
• Market research — how many sites in a niche use a given CMS, analytics tool or CDN.
• Competitive monitoring — watch a list of competitor domains and alert on stack changes.
• Migration prospecting — find sites on an old platform worth migrating.
• Due diligence — technical profile of an acquisition target's public estate.

Input

{
  "urls": ["https://www.shopify.com", "https://wordpress.org"],
  "timeoutSeconds": 20,
  "maxResults": 0
}

urls accepts a list of bare domains or full URLs (https:// is assumed if omitted). maxResults caps processing — set it to control spend on large lists.

Output example

{
  "url": "https://www.shopify.com",
  "ok": true,
  "status_code": 200,
  "elapsed_ms": 182,
  "technologies": ["Cloudflare", "Google Analytics", "React", "Shopify", "Tailwind CSS"],
  "technology_count": 5,
  "detail": [
    {
      "name": "Shopify",
      "version": null,
      "evidence": [{"surface": "header:x-shopify-stage", "match": "x-shopify-stage: production"}]
    }
  ]
}

How detection works

One HTTP GET per URL. Signals are matched across five surfaces:

1. Response headers — Server, X-Powered-By, X-Generator, platform-specific headers
2. Cookies — session and analytics cookie names
3. HTML body — library and vendor URL patterns, embedded config markers
4. Script and asset URLs — CDN hosts, plugin/theme paths
5. Meta tags — generator and friends

Each match records which surface fired, so results are auditable rather than a black box. Version numbers are reported when the site exposes them.

Pricing

Pay per result — $5 per 1,000 results ($0.005 per domain). No monthly fee, no seat, no minimum. 1,000 URLs ≈ $20. 100,000 URLs ≈ $2,000.

Limitations — read before buying

Honest scope, so you can judge fit:

• Client-side rendered sites reveal less. If a site injects its stack in JavaScript after load, a plain HTTP fetch sees only the initial HTML. Single-page apps built on Next.js, Nuxt or similar are usually still identified from the shell, but deeply dynamic stacks may be under-reported.
• Detection is evidence-based, not exhaustive. A technology that leaves no trace in headers, HTML, cookies or asset URLs will not be found. Absence of a technology is not proof of absence.
• Some sites hide their stack deliberately and will return few or no matches.
• Anti-bot protection is respected, not defeated. If a site blocks automated requests, the result is an error record for that URL — no attempt is made to bypass it.
• Versions are opportunistic. Many sites deliberately omit them.

If you need pixel-perfect rendering or JavaScript execution for every target, use a browser-rendering Actor instead; this one optimises for speed and cost per URL.

Legal and ethical use

This Actor fetches publicly accessible pages and reports technology signals. It does not log in, does not bypass access controls, and does not reproduce page content — the output is a short list of technology names with evidence pointers.

You are responsible for using it lawfully: respect target sites' terms of service, robots.txt, and applicable law in your jurisdiction. Do not use it to build profiles of individuals or to facilitate unauthorised access.

Support

Issues or feature requests: open an issue on the Actor's page. Requests for additional technology signatures are welcome — include an example URL where the technology is visible.