Tech Stack Detector — Wappalyzer alternative with evidence for every match

This tech stack detector finds the public technology stack of a website (no affiliation with Wappalyzer or BuiltWith) from HTML, response headers, cookie names, meta generators and resource URLs. Every result includes a category, confidence, visible version when exposed, and the exact redacted evidence that matched; the Actor never fills gaps with a guess.

At a glance: $0.008 per successfully analyzed domain · 1–20 domains per run · 480 clean-room technology signatures · one to three same-site pages · measured mean 2.1 seconds and p95 11.2 seconds per domain in the 20-site pre-release benchmark. Click Start to run the small WordPress.org example.

This is an independent, clean-room Wappalyzer alternative. It is not affiliated with Wappalyzer, BuiltWith or any technology vendor, and it does not copy their signature databases.

What you get

The catalog covers common technologies across ten groups:

• CMS and site builders
• ecommerce
• JavaScript frameworks and UI
• analytics
• advertising and optimization
• CDN and hosting
• servers and runtimes
• payments
• chat, forms and consent
• marketing automation

Version numbers are returned only when the page or a safe response header exposes one. A missing version is null, not inferred from a library filename or release date.

Input

{
  "urls": ["https://wordpress.org/news/"],
  "maxPagesPerDomain": "1",
  "minimumConfidence": "high"
}

Send 1–20 public HTTP(S) domains or URLs. Bare domains are normalized to HTTPS and duplicate origins are collapsed. Set maxPagesPerDomain to 2 or 3 to follow same-origin links found on the starting page; the result and price remain one item per domain.

Output

{
  "domain": "wordpress.org",
  "pagesChecked": ["https://wordpress.org/news/"],
  "technologies": [
    {
      "name": "WordPress",
      "category": "CMS & site builders",
      "version": "7.2",
      "confidence": 99,
      "evidence": [
        {
          "method": "meta",
          "pageUrl": "https://wordpress.org/news/",
          "pointer": "meta[name=generator]",
          "snippet": "WordPress 7.2",
          "confidence": 98
        }
      ]
    }
  ],
  "checkedNotFound": {
    "catalogTechnologies": 480,
    "categoriesWithoutDetections": ["Payments"],
    "note": "No match means no supported public marker was observed; it does not prove a hidden technology is absent."
  },
  "source": {
    "catalogVersion": "2026-10-04.1",
    "totalBytes": 150848,
    "durationMs": 1708,
    "redactedEvidenceCount": 0
  }
}

The example is shortened. Dataset items also include requested/final URLs and a SHA-256 hash, byte count and content type for every checked page.

Evidence and confidence

• High confidence returns direct product-specific resource, generator, header, cookie-name or distinctive HTML evidence scoring 90 or above.
• Medium confidence also allows supported markers scoring 75 or above.
• Independent evidence methods combine, while repeated URLs of the same method do not inflate the score.
• Evidence snippets redact email addresses, common international phone formats, obvious profile URLs and credential-like query parameters.

The Actor reports what was observable in the fetched public response. It cannot prove that an undetected server-side tool is absent, and it does not execute client-side JavaScript.

Pricing

$0.008 per successfully analyzed domain. That is below the recent $0.01/domain entrant and far below the $0.10/detection established Store alternative measured before launch. Optional same-site pages do not create extra paid events.

Fetch failures, robots denials, login/challenge pages and unsafe destinations produce no paid dataset item. A successfully fetched page with zero supported detections is charged because the domain was still checked against all 480 signatures and returns an explicit coverage summary.

See ./VERIFY.md for the dated Store comparison, the fixed 20-site accuracy set, latency/RAM measurements and margin calculation.

Safety and limits

• Public pages only; no credentials, cookies supplied by the user, login flows, form submission, CAPTCHA solving, Cloudflare bypass or browser fingerprinting.
• robots.txt is respected. Policy fetch errors fail closed, and crawl delays are honored.
• DNS is resolved before connecting; any private/reserved answer rejects the hostname. Approved addresses are pinned, and every redirect is revalidated.
• Only HTML/XHTML is accepted, with a 2 MiB decompressed cap per page and bounded redirects/timeouts.
• Password forms and common login/challenge pages are rejected before billing.
• Cookie values are never retained. Only safe header names/values and cookie names can become signals.
• Query strings and fragments are removed from resource and page URLs in evidence. Contact and credential-like text is replaced with [redacted contact] or [redacted secret].
• Up to 20 domains and three same-origin pages per domain. No cross-origin crawling.

For agents and batch workflows

The fixed input and dataset schemas make the Actor usable from the Apify API, schedules, webhooks and Apify's MCP integration. An agent can inspect confidence, evidence and checkedNotFound before relying on a detection instead of treating a technology name as an unsupported assertion.

FAQ

Is this Wappalyzer?

No. It is an independent clean-room detector and comparison alternative. No Wappalyzer code or signature database is bundled or used to generate this catalog.

Why did it not find a technology I know the company uses?

The technology may be server-side, loaded only after JavaScript runs, hidden on another path, or outside the current catalog. “Not found” means no supported public marker was observed in the pages checked.

Does it return emails, phone numbers or cookie values?

No. Contact-like evidence and credential-like parameters are redacted, and response cookie values are discarded.

Is a zero-detection result charged?

Yes, when a public page was fetched and checked successfully. The item documents the catalog, signal count and categories checked. Blocked, failed, login and challenge pages are not charged.

Can I check more than the home page?

Yes. Choose up to three same-origin pages. The Actor follows links found on the starting page while repeating the same robots, DNS, redirect, size and access-wall checks.