Tech Stack Detector: CMS, Shopify, Analytics, Hosting & Email

Find out which technologies any website uses: CMS, ecommerce platform, JavaScript frameworks, analytics, ad pixels, tag managers, marketing tools, live chat, cookie banners, payments, CDN, hosting and web server. On top of that it reads the DNS (email provider, email-sending tools, DNS provider, verified SaaS tools, SPF and DMARC) and the SSL certificate. Check thousands of websites per run and get alerts when a website switches tools.

• ✅ 330+ technologies in 46 categories, with version and evidence (why we think so)
• ✅ Email provider via MX (Google Workspace, Microsoft 365, Zoho, Proton ...)
• ✅ Email tools via SPF (Mailchimp, SendGrid, HubSpot, Klaviyo, Salesforce ...)
• ✅ SaaS tools verified in DNS (Stripe, Atlassian, Zoom, DocuSign, OpenAI ...): BuiltWith-level insights a page scan can't see
• ✅ DNS provider, DMARC policy, SPF record, IP addresses
• ✅ SSL issuer, expiry date and days left
• ✅ Security headers present/missing, company social profiles, response time
• ✅ Change tracking: added/removed technologies since the last run; "only changed" mode for alerts
• ✅ Fast: plain HTTP + DNS over HTTPS, 10 websites in parallel (about 1,000 websites in a few minutes)
• ✅ Handy flat columns for Excel/CSV: cms, ecommerce, analytics, hosting, emailProvider ...

Who is it for?

• Sales and lead generation: find all Shopify stores using Klaviyo, or companies on Microsoft 365 without DMARC, and enrich your leads.
• Agencies and freelancers: find websites on old WordPress or Joomla versions, or without analytics, and offer your services.
• SaaS companies: see which competitors' tools your prospects use, and get alerted when they switch.
• Market research: measure the market share of platforms in a country or industry.
• Security and IT teams: check SSL expiry, missing security headers and email security (SPF/DMARC) across all your domains.

How to use it

1. Paste your websites (domains or URLs, up to 50,000).
2. Leave DNS and SSL on for the full picture.
3. Click Start. Download as Excel, CSV or JSON, or use the API.
4. For alerts: turn on Only websites that changed and add a schedule.

Input examples

{ "urls": ["apify.com", "kith.com", "wordpress.org/news"] }

Weekly monitor of competitors:

{
    "urls": ["competitor-one.com", "competitor-two.com", "competitor-three.com"],
    "onlyChanged": true
}

Field	Default	Meaning
urls	–	Domains or URLs (max 50,000)
includeDns	true	Email provider, email tools, DNS provider, verifications, SPF, DMARC
includeSsl	true	SSL issuer and expiry
trackChanges	true	Fill addedTechnologies / removedTechnologies
onlyChanged	false	Only websites that changed since the last run
maxConcurrency	10	Websites in parallel
maxResults	1000	Maximum websites per run

Output example

{
    "url": "https://apify.com/",
    "domain": "apify.com",
    "statusCode": 200,
    "title": "Apify: Full-stack web scraping and data extraction platform",
    "technologies": [
        {
            "name": "Next.js",
            "categories": ["JavaScript framework", "Web framework"],
            "version": null,
            "website": "https://nextjs.org",
            "evidence": ["html \"<script id=\"__NEXT_DATA__\"\"", "html \"/_next/static/\""]
        }
    ],
    "technologyNames": [
        "Amazon CloudFront",
        "Bootstrap",
        "Google Tag Manager",
        "HubSpot",
        "Intercom",
        "Next.js",
        "Node.js",
        "OneTrust",
        "React"
    ],
    "cms": [],
    "jsFrameworks": ["Next.js", "React"],
    "tagManagers": ["Google Tag Manager"],
    "marketingAutomation": ["HubSpot"],
    "liveChat": ["Intercom"],
    "cookieConsent": ["OneTrust"],
    "cdn": ["Amazon CloudFront"],
    "emailProvider": "Google Workspace",
    "emailServices": ["Google Workspace", "Mailgun", "Amazon SES", "HubSpot"],
    "dnsProvider": "Amazon Route 53",
    "verifiedServices": ["Google Search Console", "Mixpanel", "Zapier", "OpenAI"],
    "dmarcPolicy": "reject",
    "sslIssuer": "Amazon",
    "sslDaysLeft": 212,
    "securityHeaders": [
        "strict-transport-security",
        "content-security-policy",
        "x-frame-options",
        "x-content-type-options"
    ],
    "socialProfiles": {
        "linkedin": "https://www.linkedin.com/company/apify",
        "x": "https://x.com/apify",
        "github": "https://github.com/apify"
    },
    "responseTimeMs": 718,
    "addedTechnologies": [],
    "removedTechnologies": [],
    "checkedAt": "2026-10-09T08:00:00.000Z"
}

Pricing

$2 per 1,000 websites (pay per website checked, DNS and SSL included). With Only websites that changed you only pay for websites with changes. Apify's free plan: max 100 websites per run.

Tips

• Use domains (example.com): the Actor tries https:// and falls back to http://.
• Some big websites refuse automated visitors (HTTP 403/429). They are marked blocked: true; DNS, SSL and the response headers (often the CDN) are still reported.
• Technologies that only load after a click or a cookie consent cannot be seen in the first page load. DNS results (email, verifications) do not have this limit.
• The evidence field shows exactly why each technology was detected.

Data and legal

The Actor only reads what every visitor and every DNS resolver can see: the public home page, its response headers, public DNS records and the SSL certificate. It does not log in, does not bypass blocks or captchas, and does not collect personal data such as e-mail addresses or names (social links are the company's own profiles found on its home page).