Tech Stack Detector & Website Security Check

Paste a list of websites and get back, for each one:

• What it is built with: CMS, ecommerce platform, frameworks, analytics, tag managers, CDN, hosting, payment and marketing tools, with versions where the site reveals them. More than 7,600 technologies from the open Wappalyzer fingerprint set, refreshed every week.
• How well it is protected: a security grade (A+ to F) and score from the site's headers, TLS certificate and cookies, and a concrete fix for every weak setting.
• Who runs its mail and DNS: the e-mail provider behind the MX records (Google Workspace, Microsoft 365, Proofpoint…), the DNS provider behind the nameservers, and whether SPF and DMARC stop anyone from sending mail in the domain's name.

It is a pay-as-you-go alternative to Wappalyzer and BuiltWith lookups, with a security review included in the same price. There is no API key or subscription to manage.

Independent tool, not affiliated with Wappalyzer, BuiltWith or any site it checks.

Example: the three prefilled sites

Website	Built with (excerpt)	E-mail provider	DNS provider	SPF / DMARC	Grade	First fix
wordpress.org	WordPress 7.2, Nginx, PHP, Google Tag Manager	Self-hosted	Self-hosted	-all / reject	C (65)	Add a Content-Security-Policy
shopify.com	Shopify, Cloudflare, HTTP/3	Google Workspace	Cloudflare DNS	~all / reject	C (67)	Add a Content-Security-Policy
nextjs.org	Next.js, React, Vercel, Webpack	Google Workspace	Vercel DNS	~all / quarantine	A (90)	Replace 'unsafe-inline' in the CSP with nonces or hashes

Scanned 2026-09-13. Press Try for free to run the same three sites; the first row of the price table below shows what that costs. Found a wrong detection or need a field? Open an issue on the Issues tab.

Who uses a website technology lookup

• Sales prospecting and lead enrichment: run your list of prospect domains and keep the ones on Shopify, WordPress or WooCommerce, or the ones using a competitor's tool.
• Agencies and freelancers: audit a client's site before a pitch. The list of weak settings, with the fix for each, is a ready-made proposal.
• Security and IT teams: grade all your company domains in one run. Spot expiring certificates, missing HSTS and CSP, and version leaks before an auditor does.
• Market research and competitive analysis: measure technology adoption across thousands of domains.

Security headers check: what it grades

Every check uses only what a normal visit reveals. Each finding comes with a severity and a fix.

Check	What it flags
HTTPS	Site served over plain HTTP; http:// not redirecting to https://
TLS certificate	Invalid or expired certificate, expiry within 30 days, TLS 1.0/1.1
Strict-Transport-Security	Missing HSTS, or a max-age under 180 days
Content-Security-Policy	Missing CSP, report-only CSP, 'unsafe-inline', 'unsafe-eval', wildcard script sources
Clickjacking	No frame-ancestors and no X-Frame-Options
Other headers	X-Content-Type-Options, Referrer-Policy (or unsafe-url), Permissions-Policy
Cookies	Missing Secure, HttpOnly on session cookies, SameSite (names only; values are never stored)
Version disclosure	Versions in Server, X-Powered-By, X-AspNet-Version or the generator meta tag
Mixed content	Scripts, stylesheets or iframes loaded over http:// on an HTTPS page
security.txt	No /.well-known/security.txt (RFC 9116), reported as information only
SPF	No SPF record, a record ending in +all, or one with no all mechanism at all
DMARC	No DMARC record, or a policy that only monitors (p=none) — a policy inherited from the organisational domain counts

The score starts at 100 and loses points per finding; critical problems such as no HTTPS or an invalid certificate cost the most. A+ needs a score of 95 or more and both HSTS and CSP.

How to check what technology a website uses

{
  "urls": ["wordpress.org", "https://www.shopify.com", "example.com"],
  "includeSecurity": true,
  "includeDns": true,
  "maxConcurrency": 10,
  "requestTimeoutSecs": 20
}

• Websites: domains or full URLs, one per line. Lists pasted with commas or spaces work too, and duplicates are removed. A bare domain is tried over HTTPS first, then HTTP.
• Security check: switch it off if you only need the tech stack.
• DNS and e-mail check: four DNS queries per domain (NS, MX, TXT, _dmarc). Switch it off if you only care about the website itself.
• Sites in parallel and Timeout per site: tune these for very large lists or slow sites.

Tech stack output: JSON example

One row per website. The dataset has four views: Overview, Security findings, E-mail and DNS and Technologies by category. You can export to JSON, CSV, Excel or HTML, or read it through the API.

{
  "input": "wordpress.org",
  "url": "https://wordpress.org/",
  "finalUrl": "https://wordpress.org/",
  "statusCode": 200,
  "title": "Blog Tool, Publishing Platform, and CMS – WordPress.org",
  "techCount": 13,
  "techNames": [
    "Google Font API",
    "Google Tag Manager",
    "Gutenberg 23.9.1",
    "HSTS",
    "MySQL",
    "Nginx",
    "Open Graph",
    "PHP",
    "Priority Hints",
    "RSS",
    "WordPress 7.2",
    "WordPress Block Editor",
    "WordPress Site Editor"
  ],
  "technologies": [
    {
      "name": "Nginx",
      "version": null,
      "confidence": 100,
      "categories": [
        "Web servers",
        "Reverse proxies"
      ],
      "website": "https://nginx.org/en",
      "implied": false
    },
    {
      "name": "PHP",
      "version": null,
      "confidence": 100,
      "categories": [
        "Programming languages"
      ],
      "website": "https://php.net",
      "implied": true
    },
    {
      "name": "WordPress",
      "version": "7.2",
      "confidence": 100,
      "categories": [
        "CMS",
        "Blogs"
      ],
      "website": "https://wordpress.org",
      "implied": false
    }
  ],
  "categories": {
    "Font scripts": [
      "Google Font API"
    ],
    "Tag managers": [
      "Google Tag Manager"
    ],
    "WordPress plugins": [
      "Gutenberg"
    ],
    "Security": [
      "HSTS"
    ]
  },
  "security": {
    "grade": "C",
    "score": 65,
    "https": true,
    "httpRedirectsToHttps": true,
    "headers": {
      "strictTransportSecurity": "max-age=3600",
      "contentSecurityPolicy": null,
      "contentSecurityPolicyReportOnly": null,
      "xFrameOptions": "SAMEORIGIN",
      "xContentTypeOptions": null,
      "referrerPolicy": null,
      "permissionsPolicy": null,
      "crossOriginOpenerPolicy": null
    },
    "tls": {
      "protocol": "TLSv1.3",
      "valid": true,
      "issuer": "Let's Encrypt",
      "validTo": "2026-10-23T19:43:55.000Z",
      "daysLeft": 42
    },
    "disclosures": [
      "meta generator: WordPress 7.2-alpha-63586"
    ],
    "issueCount": 6,
    "issues": [
      {
        "id": "csp-missing",
        "severity": "high",
        "title": "Content-Security-Policy header is missing",
        "fix": "Start with \"Content-Security-Policy-Report-Only\" to learn what the site loads, then enforce a policy that lists only trusted sources."
      },
      {
        "id": "hsts-short",
        "severity": "low",
        "title": "HSTS max-age is short (3600 seconds)",
        "fix": "Use a max-age of at least 180 days (15552000), ideally one year."
      }
    ]
  },
  "scannedAt": "2026-09-11T02:17:42.115Z",
  "scanTimeMs": 6817
}

E-mail and DNS part of the nextjs.org row. The same keys are on every scanned row. emailProvider and dnsProvider name the service when it is recognised, say Self-hosted when every mail server (or nameserver) is named under the domain itself (such names can still be run by a hosting provider), and are null otherwise. dns is null when the DNS check is off or fails.

{
  "dnsProvider": "Vercel DNS",
  "emailProvider": "Google Workspace",
  "dns": {
    "domain": "nextjs.org",
    "nameservers": ["ns1.vercel-dns.com", "ns2.vercel-dns.com"],
    "dnsProvider": "Vercel DNS",
    "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "alt4.aspmx.l.google.com", "alt3.aspmx.l.google.com"],
    "emailProvider": "Google Workspace",
    "acceptsMail": true,
    "spf": { "record": "v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all", "all": "~all" },
    "dmarc": { "record": "v=DMARC1; p=quarantine; rua=mailto:...; ruf=mailto:...; pct=100; fo=1;", "policy": "quarantine", "subdomainPolicy": null, "pct": 100, "reporting": true },
    "error": null
  }
}

Sites that cannot be reached at all still get a row with an error (DNS failure, timeout, a certificate error with no working http:// fallback, and so on), and so do invalid entries and private addresses. You are not charged for those rows.

How much does a tech stack lookup cost?

You pay per website scanned. One event covers the tech stack, the security grade and the e-mail and DNS check for that site, with no platform usage charge on top.

Websites scanned	Free plan	Starter	Scale	Business
3 (the prefilled example)	$0.15	$0.135	$0.12	$0.105
100	$5.00	$4.50	$4.00	$3.50
1,000	$50	$45	$40	$35
10,000	$500	$450	$400	$350

• Websites that cannot be reached at all, invalid entries and private addresses get a row with an error and are not charged. A site that answers with an error page (for example HTTP 403 or 500) is scanned and charged, and its row carries a warning.
• Each run also has a start fee of $0.00005 per GB of memory, with a minimum of $0.00005.
• Apify's Free plan includes $5 of usage every month, enough to scan about 100 websites here, and needs no credit card.
• Set a maximum cost per run before a large list. The run stops when it reaches that amount, and the sites not yet scanned are left out.

Tech stack API and integrations

• API: start a run with the list of URLs and read the dataset. See the API tab for ready-made snippets.
• Integrations: Make, Zapier, n8n and Google Sheets through Apify integrations.

Use it with AI agents (MCP)

AI assistants such as Claude, ChatGPT and Cursor can find and run this Actor through the Apify MCP server: they search the Store with search-actors, read the input with fetch-actor-details and start a run with call-actor. To give an agent only this tool, connect it to https://mcp.apify.com?tools=hxckya/tech-stack-security-check. Because the Actor is priced per event, agents can also pay for runs with the MCP server's agentic payments.

Example prompt:

Here are 40 prospect domains. Check each one's tech stack and security grade, keep the ones on Shopify or WooCommerce, and give me a table with their e-mail provider, grade and the first fix from the findings.

How the tech stack detection works, and what it does not do

For each site the Actor makes at most one page request, one TLS handshake, one http:// redirect check, one security.txt lookup and four DNS queries. It does not crawl, guess paths, send attack payloads or try logins. The review is passive, the same information any browser receives. Private, local and internal addresses are refused.

Detection reads the HTTP response: headers, cookies, meta tags, script URLs, inline scripts, HTML and DOM selectors. Technologies that can only be seen by executing the page's JavaScript in a real browser may be missed, and only the page you give is examined, not the whole site.

FAQ

Is this a Wappalyzer or BuiltWith alternative?

Yes, for looking up the websites you already have. It uses the open Wappalyzer fingerprint rules (MIT, via ProjectDiscovery's wappalyzergo), updated weekly, and adds the security review and the e-mail and DNS check on top. It does not call the Wappalyzer or BuiltWith APIs.

Can it find every website that uses a technology?

No. It checks the websites you give it and has no database of domains to search. Start from your own prospect or domain list, then filter the results by technology.

Does it detect technologies loaded by JavaScript?

Partly. It does not run a browser. A tool can be detected when it shows up in the page's <script src> tags, inline scripts, HTML, headers or cookies; anything that appears only after the page's JavaScript runs may be missed.

Can I check thousands of sites?

Yes. Raise Sites in parallel and set a maximum cost for the run. Each site takes about 1 to 7 seconds.

Why does a site I know get a low grade?

Most sites never set CSP or Permissions-Policy. The findings list says exactly which header is missing and what to add.

Can I scan my own staging server?

Only if it is reachable from the public internet. Private and internal addresses are blocked on purpose.

Changelog

• 1.2: The e-mail and DNS provider read Self-hosted when every mail server or nameserver is named under the scanned domain, and Cloudflare Foundation DNS nameservers (foundationdns.com, .net, .org) are reported as Cloudflare DNS.
• 1.1: E-mail and DNS check — e-mail provider from the MX records, DNS provider from the nameservers, and SPF/DMARC findings folded into the security grade (DMARC inherited from the organisational domain is honoured).
• 1.0: First release. More than 7,600 technologies, a passive security grade with fixes, TLS certificate check, and no charge for sites that cannot be reached.