# Tech Stack Detector & WHOIS, SSL Checker: BuiltWith Alternative (`fguiraud/website-tech-dns-whois-ssl`) Actor

Detect any website's tech stack (7,000+ technologies, Wappalyzer & BuiltWith alternative) plus WHOIS domain age and expiry, DNS, SPF/DMARC, email provider, SSL certificate expiry, hosting, security grade and SEO audit. Bulk domains or a Google Sheet; one JSON per domain.

- **URL**: https://apify.com/fguiraud/website-tech-dns-whois-ssl.md
- **Developed by:** [Fernando Guiraud](https://apify.com/fguiraud) (community)
- **Categories:** Lead generation, Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $4.00 / 1,000 domain analyzeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

### What does Tech Stack Detector & WHOIS, SSL Checker do?

A **tech stack detector** (a **BuiltWith and Wappalyzer alternative**), **WHOIS lookup**, **domain age and expiry checker**, **DNS lookup**, **SSL certificate checker** and **SEO audit** in one Actor. Give it a list of domains or URLs (or a Google Sheet) and get **one clean JSON record per domain** with:

- 🧩 **Technology stack**: 7,000+ technologies (CMS, ecommerce, analytics, frameworks, CDN, hosting, marketing tools) detected from the website, plus **SaaS tools revealed by DNS** (Google Workspace, Microsoft 365, HubSpot, Atlassian, Stripe…). Each one comes with its category and version when it can be detected.
- 📇 **WHOIS / RDAP**: registrar, **registration date, domain age, expiry date**, status codes, nameservers, DNSSEC. Uses RDAP, with an automatic classic-WHOIS fallback for ccTLDs such as .io, .co, .de, .it, .jp, .me, .mx, .se and .eu.
- 🌐 **DNS records**: A, AAAA, MX, NS, TXT, CAA, SOA, CNAME, the **SPF and DMARC** setup, and the company's **email provider** (Google Workspace, Microsoft 365, Zoho, Proofpoint…).
- 🛡️ **Security grade A-F** with a 0-100 score and the individual checks behind it (valid certificate, TLS 1.3, HTTPS redirect, HSTS, CSP, clickjacking/sniffing protection, SPF, enforced DMARC, CAA, DNSSEC).
- 🔒 **SSL certificate**: issuer, validity dates, **days until expiry**, SANs, TLS version, and whether the certificate chain is valid.
- ⚡ **HTTP & site profile**: final URL after redirects, status code, response time, title, description, language, and a **security headers score** (HSTS, CSP, X-Frame-Options…).
- 🏢 **Hosting provider**: who owns the server's network (Cloudflare, AWS, Google Cloud, Hetzner, OVH…), with IP range, from official IP registries.
- 🔔 **Alerts and change monitoring**: every result lists problems worth acting on (SSL or domain expiring soon, site down, noindex, missing DMARC), and `monitorChanges` reports **what changed since the last run** (technologies added/removed, new certificate, DNS/MX/hosting moves, title or SEO score).
- 🔗 **Company social profiles** linked from the home page: LinkedIn, X/Twitter, Facebook, Instagram, YouTube, GitHub, TikTok.
- 🔎 **SEO audit** with a 0-100 score and a plain-English issue list: title and meta description length, H1s, canonical, noindex, `lang`, mobile viewport, Open Graph, JSON-LD structured data, images without alt text, **robots.txt and XML sitemap** (with URL count).
- 🚀 **Performance**: time to first byte, HTML size, compression, caching, HTTP/3, and render-blocking and third-party scripts. Add your own free Google API key to also get **Lighthouse scores and Core Web Vitals (LCP, INP, CLS)** from PageSpeed Insights.

All of this comes from **one call instead of six different tools**, with no API keys. It runs on Apify, so you get an API, scheduling, integrations (Make, Zapier, n8n, Google Sheets) and access for **AI agents through the [Apify MCP server](https://mcp.apify.com)**.

### Why use it?

- **Sales and lead enrichment**: find companies using Shopify, HubSpot or Salesforce, and qualify leads by their stack.
- **Competitive research**: see which analytics, CDN, hosting and marketing tools competitors use, and **get notified when they add or drop one** (weekly schedule + `monitorChanges`).
- **SEO and web agencies**: audit prospects' or clients' sites in bulk and turn the issue list into a sales pitch or a fix list.
- **Security and IT monitoring**: catch SSL certificates and domains that are about to expire, missing DMARC, or weak security headers across a portfolio of sites.
- **Due diligence**: check a domain's age, registrar and infrastructure in seconds.

### How to look up a website's tech stack, WHOIS and SSL

1. Click **Try for free**.
2. Enter domains or URLs, one per line.
3. Optionally choose which checks to run (all are on by default).
4. Click **Start**, then download the results as JSON, CSV, Excel or HTML, or fetch them via API.

### Input

| Field | Description | Default |
|---|---|---|
| `domains` | Domains or URLs | `domains` or `domainsFromUrl` required |
| `domainsFromUrl` | Link to a TXT/CSV file or a Google Sheet (shared as "Anyone with the link") with one domain per row; extra columns and headers are ignored | - |
| `checks` | Any of `tech`, `whois`, `dns`, `ssl`, `http`, `seo`, `performance`, `hosting` | all |
| `monitorChanges` | Report differences since the previous run (state kept in your account) | `false` |
| `alertDaysBeforeExpiry` | Alert when SSL/domain expires within N days | 30 |
| `pageSpeedApiKey` | Optional: your Google API key, for Lighthouse scores and Core Web Vitals | — |
| `pageSpeedStrategy` | `mobile` or `desktop` (PageSpeed only) | `mobile` |
| `maxConcurrency` | Domains analyzed in parallel | 10 |
| `failOnError` | Mark the run FAILED if a domain returns no data | false |

```json
{ "domains": ["apify.com", "https://www.bbc.co.uk/news"], "checks": ["tech", "whois", "ssl"] }
```

### Output

One record per domain. You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

```json
{
  "input": "wordpress.org",
  "host": "wordpress.org",
  "domain": "wordpress.org",
  "status": "ok",
  "technologyNames": ["WordPress", "PHP", "MySQL", "Nginx", "Google Tag Manager"],
  "technologies": [
    { "name": "WordPress", "version": null, "confidence": 100, "detectedVia": ["website"], "categories": ["CMS", "Blogs"], "website": "https://wordpress.org" }
  ],
  "whois": { "registrar": "MarkMonitor Inc.", "created": "2003-03-28T01:07:35Z", "expires": "2035-03-28T01:07:35Z", "ageDays": 8580, "daysUntilExpiry": 3107, "status": ["client transfer prohibited"], "nameservers": ["ns1.wordpress.org"], "dnssec": false },
  "dns": { "a": ["198.143.164.252"], "mx": ["10 smtp1-dca.wordpress.org"], "ns": ["ns0.wordpress.org"], "txt": ["v=spf1 …"], "emailSecurity": { "spf": "v=spf1 …", "dmarc": "v=DMARC1; p=reject; …", "dmarcPolicy": "reject" } },
  "ssl": { "valid": true, "issuer": "Let's Encrypt", "validTo": "2026-10-23T00:00:00+00:00", "daysUntilExpiry": 30, "sanCount": 2, "tlsVersion": "TLSv1.3" },
  "http": { "finalUrl": "https://wordpress.org/", "statusCode": 200, "responseTimeMs": 310, "title": "Blog Tool, Publishing Platform, and CMS – WordPress.org", "description": "…", "language": "en", "socialProfiles": { "x": "https://x.com/WordPress" }, "securityHeadersScore": "2/6" },
  "seo": { "score": 92, "title": "Blog Tool, Publishing Platform, and CMS", "titleLength": 58, "h1Count": 1, "indexable": true, "structuredDataTypes": ["Organization", "WebSite"], "imagesMissingAlt": 9, "sitemap": { "exists": true, "childSitemaps": 3 }, "issues": ["9 of 18 images missing alt text"] },
  "performance": { "ttfbMs": 216, "htmlKb": 161.1, "compression": "br", "http3Advertised": true, "scripts": { "external": 5, "renderBlocking": 0, "thirdPartyDomains": 1 }, "issues": [] },
  "hosting": { "ip": "198.143.164.252", "provider": "Automattic, Inc", "network": "AUTOMATTIC", "cidr": "198.143.164.0/24" },
  "security": { "score": 71, "grade": "C", "checks": { "validCertificate": true, "tls13": true, "hsts": true, "contentSecurityPolicy": false, "dmarcEnforced": true } },
  "alerts": ["SSL certificate expires in 30 days"],
  "changes": [{ "field": "technologies", "added": ["Cloudflare"], "removed": [] }],
  "errors": {}
}
```

`status` is `ok`, `partial` (some checks failed, see `errors`) or `error` (nothing could be retrieved, not billed).

### How much does it cost?

Pay per event, with no monthly fee:

| Event | Price |
|---|---|
| Run start (per GB of memory, default 1 GB) | $0.001 |
| Domain analyzed (all selected checks) | **$0.004** (about $4 per 1,000 domains) |

Domains that return no data at all are **not billed**. Set **Max cost per run** in the run options, and the Actor stops cleanly at that limit.

### Lighthouse scores and Core Web Vitals (optional)

Create a free API key in the [Google Cloud Console](https://console.cloud.google.com/apis/library/pagespeedonline.googleapis.com): enable **PageSpeed Insights API** and create an API key. Paste it into `pageSpeedApiKey`. Each domain then also gets `performance.pageSpeed` with Lighthouse **performance, SEO, accessibility and best-practices scores**, lab metrics (LCP, FCP, CLS, TBT) and **real-user Core Web Vitals** from the Chrome UX Report when available. Google's free quota is 25,000 requests per day. The key is stored as a secret input.

### Monitor competitors or your own sites

1. Enable `monitorChanges` and keep the domain list stable.
2. Create an Apify **schedule** (daily or weekly).
3. Each run lists `changes` per domain and `alerts` for expiring certificates/domains, downtime or noindex. Connect a webhook, Slack, Zapier or Make integration to get notified only when something changes.

### Use it with AI agents (MCP): Claude, ChatGPT, Cursor

This Actor works as a **tool for AI agents** through the [Apify MCP server](https://mcp.apify.com). Add it to Claude Desktop, Claude Code, Cursor, VS Code or any MCP client with this server URL:

```text
https://mcp.apify.com?tools=fguiraud/website-tech-dns-whois-ssl
```

Then just ask in plain language, for example:

- *"What CMS, analytics and ecommerce platform does example.com use?"*
- *"Check when the SSL certificates and domains of these 20 client sites expire"*
- *"Which of these companies use Shopify and Google Workspace? (list of domains)"*

Smallest useful input for an agent:

```json
{
  "domains": ["example.com"],
  "checks": ["tech", "whois", "ssl"]
}
```

- Selecting only the `checks` you need makes each call faster and the answer shorter.
- `technologyNames` and `technologiesByCategory` give the agent a compact summary of the stack.
- Every result has an `alerts` list with problems worth acting on (expiring SSL/domain, site down, noindex).

Agents pay per result like everyone else (Apify also supports agentic payments), so there is no subscription to set up.

### Tips

- Have a lead list in a spreadsheet? Paste the Google Sheets link in `domainsFromUrl` instead of copying the domains one by one.
- Long runs are safe: if the platform restarts or migrates the run, domains already analyzed are skipped, so they are never charged twice.
- Put many domains in one run. They are processed in parallel, and the start fee is paid once.
- Only need expiry monitoring? Run `checks: ["whois", "ssl"]` on a schedule and alert on `daysUntilExpiry`.
- `detectedVia: ["dns"]` means the service was found in DNS records (for example a domain-verification TXT record), so the company uses that tool even if it is not visible on the website.

### Related tools

- Only need registration data? [Bulk WHOIS Domain Lookup](https://apify.com/fguiraud/bulk-whois-domain-lookup) returns one flat row per domain (age, expiry, registrar, availability, email provider, SSL expiry) at half the price.

### FAQ and limitations

- **JavaScript is not executed**, so technologies that are only visible after JS runs may be missed. This keeps the Actor fast and cheap.
- **WHOIS** uses RDAP first and falls back to classic WHOIS (`whois.source` says which one was used). A few registries restrict automated WHOIS (for example `.es` and `.ch`), and some (for example `.de`) publish only status and nameservers. Registrant personal contact data is **never collected**, and neither are emails or phone numbers from websites.
- Some sites block automated requests. The other checks (DNS, WHOIS, SSL) still work, and the result is marked `partial`.
- Technology fingerprints come from the open-source [webappanalyzer](https://github.com/enthec/webappanalyzer) project (GPL-3.0) and are refreshed on every build.

Questions or a missing technology? Open an issue in the **Issues** tab.

# Actor input Schema

## `domains` (type: `array`):

Domains (example.com) or website URLs (https://www.example.com/page). Each unique host is analyzed once. Optional if you use "Domain list URL" below.

## `domainsFromUrl` (type: `string`):

Link to a plain-text or CSV file with one domain/URL per row, or a Google Sheets link shared as "Anyone with the link". In each row the first cell that looks like a domain or URL is used; headers and other columns are ignored. Added to the domains above (duplicates are analyzed once).

## `checks` (type: `array`):

'tech': technologies from the home page and DNS. 'whois': registrar, creation/expiry dates, status (RDAP). 'dns': A, AAAA, MX, NS, TXT, CAA, SOA + SPF/DMARC. 'ssl': certificate issuer, expiry, SANs, TLS version. 'http': final URL, redirects, status, response time, security headers. 'seo': on-page SEO audit (title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt text, robots.txt, sitemap) with a score and issue list. 'performance': TTFB, HTML size, compression, HTTP version, caching, render-blocking and third-party scripts. 'hosting': organisation that owns the server's IP network (e.g. Cloudflare, AWS, Hetzner) and its IP range.

## `monitorChanges` (type: `boolean`):

Remember each domain's state (in a key-value store named 'website-intel-monitor' in your account) and report what changed since the previous run: technologies added/removed, new SSL certificate, registrar, DNS/MX/nameserver, hosting provider, title or SEO score. Run it on a schedule to track competitors or your own sites.

## `alertDaysBeforeExpiry` (type: `integer`):

Add an alert when the SSL certificate or the domain registration expires within this many days.

## `pageSpeedApiKey` (type: `string`):

Add your own free Google API key (Google Cloud Console → enable 'PageSpeed Insights API' → create an API key) to also get Lighthouse scores (performance, SEO, accessibility, best practices), lab metrics and real-user Core Web Vitals (LCP, INP, CLS) for each site. Requires the 'performance' check. Adds ~15-40 s per domain.

## `pageSpeedStrategy` (type: `string`):

Emulated device for PageSpeed Insights.

## `maxConcurrency` (type: `integer`):

How many domains are analyzed at the same time.

## `failOnError` (type: `boolean`):

Mark the run as FAILED when any domain returns no data at all. Useful for monitoring pipelines.

## Actor input object example

```json
{
  "domains": [
    "apify.com",
    "wordpress.org",
    "bbc.co.uk"
  ],
  "checks": [
    "tech",
    "whois",
    "dns",
    "ssl",
    "http",
    "seo",
    "performance",
    "hosting"
  ],
  "monitorChanges": false,
  "alertDaysBeforeExpiry": 30,
  "pageSpeedStrategy": "mobile",
  "maxConcurrency": 10,
  "failOnError": false
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "apify.com",
        "wordpress.org",
        "bbc.co.uk"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("fguiraud/website-tech-dns-whois-ssl").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "apify.com",
        "wordpress.org",
        "bbc.co.uk",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("fguiraud/website-tech-dns-whois-ssl").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "apify.com",
    "wordpress.org",
    "bbc.co.uk"
  ]
}' |
apify call fguiraud/website-tech-dns-whois-ssl --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,fguiraud/website-tech-dns-whois-ssl"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/nM7cZ2KQJ0GfyfrV9/builds/xAyyozSKQD02Selek/openapi.json