# Tech Stack Detector — Wappalyzer Alternative with Evidence (`dropin-apis/tech-stack-detector`) Actor

Detect CMS, ecommerce, frameworks, analytics, CDN, hosting, payments and widgets on public websites. Every match includes evidence and confidence; unknown technologies are never guessed. A clean-room Wappalyzer alternative with no affiliation.

- **URL**: https://apify.com/dropin-apis/tech-stack-detector.md
- **Developed by:** [drop-in apis](https://apify.com/dropin-apis) (community)
- **Categories:** Developer tools, SEO tools, Lead generation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.00 / 1,000 domain analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Tech Stack Detector — Wappalyzer alternative with evidence for every match

This **tech stack detector** finds the public technology stack of a website (no affiliation with Wappalyzer or BuiltWith) from HTML, response headers, cookie **names**, meta generators and resource URLs. Every result includes a category, confidence, visible version when exposed, and the exact redacted evidence that matched; the Actor never fills gaps with a guess.

**At a glance:** **$0.008 per successfully analyzed domain** · 1–20 domains per run · 480 clean-room technology signatures · one to three same-site pages · measured mean 2.1 seconds and p95 11.2 seconds per domain in the 20-site pre-release benchmark. Click **Start** to run the small WordPress.org example.

This is an independent, clean-room Wappalyzer alternative. It is not affiliated with Wappalyzer, BuiltWith or any technology vendor, and it does not copy their signature databases.

### What you get

The catalog covers common technologies across ten groups:

- CMS and site builders
- ecommerce
- JavaScript frameworks and UI
- analytics
- advertising and optimization
- CDN and hosting
- servers and runtimes
- payments
- chat, forms and consent
- marketing automation

Version numbers are returned only when the page or a safe response header exposes one. A missing version is `null`, not inferred from a library filename or release date.

### Input

```json
{
  "urls": ["https://wordpress.org/news/"],
  "maxPagesPerDomain": "1",
  "minimumConfidence": "high"
}
```

Send 1–20 public HTTP(S) domains or URLs. Bare domains are normalized to HTTPS and duplicate origins are collapsed. Set `maxPagesPerDomain` to 2 or 3 to follow same-origin links found on the starting page; the result and price remain one item per domain.

### Output

```json
{
  "domain": "wordpress.org",
  "pagesChecked": ["https://wordpress.org/news/"],
  "technologies": [
    {
      "name": "WordPress",
      "category": "CMS & site builders",
      "version": "7.2",
      "confidence": 99,
      "evidence": [
        {
          "method": "meta",
          "pageUrl": "https://wordpress.org/news/",
          "pointer": "meta[name=generator]",
          "snippet": "WordPress 7.2",
          "confidence": 98
        }
      ]
    }
  ],
  "checkedNotFound": {
    "catalogTechnologies": 480,
    "categoriesWithoutDetections": ["Payments"],
    "note": "No match means no supported public marker was observed; it does not prove a hidden technology is absent."
  },
  "source": {
    "catalogVersion": "2026-10-04.1",
    "totalBytes": 150848,
    "durationMs": 1708,
    "redactedEvidenceCount": 0
  }
}
```

The example is shortened. Dataset items also include requested/final URLs and a SHA-256 hash, byte count and content type for every checked page.

### Evidence and confidence

- **High confidence** returns direct product-specific resource, generator, header, cookie-name or distinctive HTML evidence scoring 90 or above.
- **Medium confidence** also allows supported markers scoring 75 or above.
- Independent evidence methods combine, while repeated URLs of the same method do not inflate the score.
- Evidence snippets redact email addresses, common international phone formats, obvious profile URLs and credential-like query parameters.

The Actor reports what was observable in the fetched public response. It cannot prove that an undetected server-side tool is absent, and it does not execute client-side JavaScript.

### Pricing

**$0.008 per successfully analyzed domain.** That is below the recent $0.01/domain entrant and far below the $0.10/detection established Store alternative measured before launch. Optional same-site pages do not create extra paid events.

Fetch failures, robots denials, login/challenge pages and unsafe destinations produce no paid dataset item. A successfully fetched page with zero supported detections is charged because the domain was still checked against all 480 signatures and returns an explicit coverage summary.

See [`VERIFY.md`](./VERIFY.md) for the dated Store comparison, the fixed 20-site accuracy set, latency/RAM measurements and margin calculation.

### Safety and limits

- Public pages only; no credentials, cookies supplied by the user, login flows, form submission, CAPTCHA solving, Cloudflare bypass or browser fingerprinting.
- `robots.txt` is respected. Policy fetch errors fail closed, and crawl delays are honored.
- DNS is resolved before connecting; any private/reserved answer rejects the hostname. Approved addresses are pinned, and every redirect is revalidated.
- Only HTML/XHTML is accepted, with a 2 MiB decompressed cap per page and bounded redirects/timeouts.
- Password forms and common login/challenge pages are rejected before billing.
- Cookie **values** are never retained. Only safe header names/values and cookie names can become signals.
- Query strings and fragments are removed from resource and page URLs in evidence. Contact and credential-like text is replaced with `[redacted contact]` or `[redacted secret]`.
- Up to 20 domains and three same-origin pages per domain. No cross-origin crawling.

### For agents and batch workflows

The fixed input and dataset schemas make the Actor usable from the Apify API, schedules, webhooks and Apify's MCP integration. An agent can inspect `confidence`, `evidence` and `checkedNotFound` before relying on a detection instead of treating a technology name as an unsupported assertion.

### FAQ

#### Is this Wappalyzer?

No. It is an independent clean-room detector and comparison alternative. No Wappalyzer code or signature database is bundled or used to generate this catalog.

#### Why did it not find a technology I know the company uses?

The technology may be server-side, loaded only after JavaScript runs, hidden on another path, or outside the current catalog. “Not found” means no supported public marker was observed in the pages checked.

#### Does it return emails, phone numbers or cookie values?

No. Contact-like evidence and credential-like parameters are redacted, and response cookie values are discarded.

#### Is a zero-detection result charged?

Yes, when a public page was fetched and checked successfully. The item documents the catalog, signal count and categories checked. Blocked, failed, login and challenge pages are not charged.

#### Can I check more than the home page?

Yes. Choose up to three same-origin pages. The Actor follows links found on the starting page while repeating the same robots, DNS, redirect, size and access-wall checks.

# Actor input Schema

## `urls` (type: `array`):

One to twenty public domains or HTTP(S) URLs. Bare domains are normalized to HTTPS. Private networks, credentials, custom ports and duplicate domains are rejected or deduplicated.

## `maxPagesPerDomain` (type: `string`):

Check only the starting page, or follow up to two same-origin links found there. Each domain still produces at most one paid result.

## `minimumConfidence` (type: `string`):

High returns only direct vendor, generator, header or cookie evidence. Medium also returns distinctive HTML markers with lower confidence.

## Actor input object example

```json
{
  "urls": [
    "https://wordpress.org/news/"
  ],
  "maxPagesPerDomain": "1",
  "minimumConfidence": "high"
}
```

# Actor output Schema

## `results` (type: `string`):

Dataset items containing technologies, confidence, evidence and checked-not-found coverage.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://wordpress.org/news/"
    ],
    "maxPagesPerDomain": "1",
    "minimumConfidence": "high"
};

// Run the Actor and wait for it to finish
const run = await client.actor("dropin-apis/tech-stack-detector").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": ["https://wordpress.org/news/"],
    "maxPagesPerDomain": "1",
    "minimumConfidence": "high",
}

# Run the Actor and wait for it to finish
run = client.actor("dropin-apis/tech-stack-detector").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://wordpress.org/news/"
  ],
  "maxPagesPerDomain": "1",
  "minimumConfidence": "high"
}' |
apify call dropin-apis/tech-stack-detector --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,dropin-apis/tech-stack-detector"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/jFJwhTkjgASfeciPd/builds/b4fxtVbl1ryIatRd4/openapi.json