Tech Stack Detector — 7,600+ Technologies

Find out what any website is built with: CMS, ecommerce platform, JavaScript frameworks, analytics, marketing tools, CDN, hosting and security layers. Paste a list of domains and get one clean row per website, with versions, confidence and the exact evidence behind every detection.

What you get for each website

• Website stack — technologies running on the site itself, detected from its HTML, scripts, headers, cookies, meta tags and TLS certificate.
• Company tools — services the company behind the domain uses, found in its DNS records: email provider (Google Workspace, Microsoft 365), and SaaS verification records (Stripe, HubSpot, Notion, Zoom, DocuSign and more). Kept in a separate list so they never get mixed up with the site's own stack.
• Version when the site exposes it (for example WordPress 7.2).
• Confidence from 0 to 100.
• Evidence — the header, script URL, meta tag or HTML snippet that triggered the detection, so you can check any result yourself.

Why this one

• 7,613 technology fingerprints, maintained by the open-source community that continued the Wappalyzer rules after they went closed in 2023.
• You only pay for websites that were actually analyzed. Unreachable domains, timeouts and bot-protection challenge pages are reported but not charged.
• No browser needed. One HTTP request per website plus DNS and certificate lookups, so runs are fast and cheap: 40 websites analyzed in about 12 seconds in our tests.
• Honest output. When a site answers with a bot challenge instead of its real page, the row says so in the blocked field instead of returning an empty or misleading stack.

Use cases

• Build lead lists of stores on Shopify, WooCommerce, VTEX or any platform: paste your domains, set Only websites using to Shopify, and get back only the Shopify stores.
• Qualify prospects by the tools they already pay for.
• Track competitors' tech changes over time.
• Enrich a CRM with CMS, analytics and email provider.
• Audit agency client portfolios for outdated software versions.

Use it from AI agents

Ask Claude, Cursor or VS Code "what is example.com built with?" and let the agent run this Actor for you. Connect your AI client to the official Apify MCP server at https://mcp.apify.com: agents can find this Actor in Apify Store and run it, and the result comes back as structured data the agent can reason about.

Input

Field	Description
urls	Websites to analyze. example.com works; https:// is added for you. domains, startUrls and url are accepted too.
technologies	Optional filter. Keep only websites using at least one of these technologies or categories, like Shopify, HubSpot or Ecommerce. Matching websites get a matchedTechnologies field.
includeEvidence	Add the snippet that triggered each detection. Default true.
checkDns	Look up MX and TXT records to find company tools. Default true.
timeoutSecs	Seconds to wait for each website. Default 20.
maxConcurrency	Websites analyzed in parallel. Default 10.

Output example

A real result for wordpress.org, abridged to one technology:

{
  "url": "https://wordpress.org/",
  "finalUrl": "https://wordpress.org/",
  "statusCode": 200,
  "blocked": null,
  "techCount": 14,
  "techNames": [
    "Google Font API", "Google Tag Manager", "Gutenberg", "HSTS", "Let's Encrypt", "MySQL", "Nginx",
    "Open Graph", "PHP", "Priority Hints", "RSS", "WordPress", "WordPress Block Editor", "WordPress Site Editor"
  ],
  "technologies": [
    {
      "name": "WordPress",
      "version": "7.2",
      "confidence": 100,
      "categories": ["CMS", "Blogs"],
      "website": "https://wordpress.org",
      "implied": false,
      "evidence": [
        { "type": "meta", "name": "generator", "value": "WordPress 7.2-alpha-63605" },
        { "type": "scriptSrc", "value": "https://wordpress.org/wp-content/mu-plugins/pub-sync/blocks/language-suggest/build/front.js?ver=415cd060560d9af45f39" }
      ]
    }
  ],
  "companyToolNames": [],
  "companyTools": [],
  "scanTimeMs": 2495,
  "error": null
}

Limitations

• Technologies that only appear after JavaScript runs are not detected. About 12% of the fingerprints (for example some React, Angular and VitePress checks) need a real browser. Server-rendered markers are detected normally.
• Websites behind aggressive bot protection may serve a challenge page. These rows are flagged in blocked and are not charged.
• If you set a maximum cost per run, the run stops starting new websites once that budget is used up. The run's status message tells you how many websites were left out, so you can raise the limit and analyze the rest.
• With Only websites using, websites that don't match are left out of the results but still charged, since they were analyzed. Unreachable and blocked websites are left out and not charged; the run's status message counts both.
• Company tools come from public DNS records. They show what a company has set up, not necessarily what it actively uses today.

Credits and license

Technology fingerprints come from webappanalyzer, a community continuation of the Wappalyzer rules, licensed under GPL-3.0.