Website Tech Stack Detector

Find out what any website is built with. Give it a list of domains and get back the CMS, ecommerce platform, analytics, JavaScript frameworks, CDN, hosting, payment providers and more, with versions, confidence scores and the evidence behind every detection.

It works as a bulk alternative to browser extensions and technology-lookup APIs such as Wappalyzer and BuiltWith: no API key, no login, no monthly plan. You pay only for websites that were successfully analyzed.

What you can do with it

• Qualify leads by technology. Find the Shopify stores, WordPress sites or HubSpot users in a list of prospects.
• Research competitors. See which frameworks, CDNs, payment providers and marketing tools they rely on.
• Enrich a CRM or spreadsheet. One row per domain, with ready-made columns for the categories people filter on most.
• Track migrations. Run it on a schedule to see when a site changes platform or adds a tool.

What makes it different

• More than 7,000 technologies across 100+ categories, refreshed with every build.
• Evidence for every detection. Each technology comes with the header, script URL, cookie, meta tag or DNS record that triggered it, so you can check the result yourself.
• Versions and confidence scores where the website exposes them.
• DNS and TLS signals. Finds the email provider, DNS host, certificate authority and the SaaS vendors a company has verified its domain with. These never appear in the page itself.
• Website technology and company vendors are kept apart. A DNS record proves a company uses a service, not that the website runs on it, so those results go in their own column.
• Fair billing. Unreachable, blocked and invalid websites are returned with a status and are not charged.

Input

Field	Description
urls	Domains or URLs to analyze. A bare domain such as stripe.com works.
minConfidence	Only return technologies detected with at least this confidence (default 50).
includeEvidence	Include the evidence and a short description for each technology (default on).
checkDns	Also check DNS records, the TLS certificate and robots.txt (default on).
maxConcurrency	Websites analyzed in parallel (default 10).

{
    "urls": ["allbirds.com", "https://woocommerce.com"],
    "minConfidence": 50
}

Output

One item per website. The flat columns are convenient for CSV and Excel exports; technologies holds the full detail.

{
    "url": "allbirds.com",
    "finalUrl": "https://www.allbirds.com/",
    "domain": "allbirds.com",
    "status": "ok",
    "httpStatus": 200,
    "title": "Allbirds",
    "technologyCount": 16,
    "technologyNames": "Apple Pay, Cloudflare, Google Tag Manager, PayPal, Shopify, Swiper",
    "dnsVerifiedServices": "DocuSign, Microsoft 365, Miro",
    "cms": null,
    "ecommerce": "Shopify",
    "cdn": "Cloudflare",
    "paymentProcessors": "Apple Pay, PayPal",
    "email": "Microsoft 365",
    "technologies": [
        {
            "name": "Shopify",
            "slug": "shopify",
            "categories": ["Ecommerce"],
            "version": null,
            "confidence": 100,
            "detectedVia": ["page"],
            "website": "https://shopify.com",
            "evidence": ["script: https://cdn.shopify.com/s/files/1/1104/4168/files/app.js"]
        }
    ],
    "analyzedAt": "2026-10-04T18:00:00.000Z"
}

Summary columns: cms, ecommerce, analytics, tagManagers, jsFrameworks, webFrameworks, programmingLanguages, webServers, cdn, hosting, paymentProcessors, marketingAutomation, advertising, liveChat, crm, email.

status is one of:

Status	Meaning	Charged
ok	The website was fetched and analyzed.	Yes
blocked	The website answered with an error or a bot challenge. Whatever the response revealed is still returned.	No
unreachable	The website could not be reached.	No
invalid_url	The input is not a website address.	No

How it works

For each website the actor makes one request for the page, plus optional DNS, TLS and robots.txt lookups. It then matches the response against a library of technology fingerprints: HTTP headers, cookies, HTML, meta tags, script URLs, inline scripts, page elements, DNS records and the certificate issuer.

It does not run a browser, which keeps it fast and inexpensive: websites are analyzed in parallel, and a list of several hundred finishes in a few minutes.

Limitations

• Tools that only appear after JavaScript runs, for example an analytics tag injected by a tag manager, can be missed. The tag manager itself is detected.
• Websites behind a strict bot challenge return blocked. Their CDN, security vendor and DNS-based results are still reported.
• Detection covers the page you provide, usually the homepage. Technologies used only on other pages, such as a checkout, are not seen.
• Results reflect public signals and can occasionally be wrong. Check the evidence field when a detection matters.

Credits

Technology fingerprints come from the open-source webappanalyzer project (GPL-3.0). This actor is not affiliated with Wappalyzer or BuiltWith.