# Tech Stack Detector: Wappalyzer & BuiltWith Alternative (`hxckya/tech-stack-security-check`) Actor Detect any website's tech stack (7,600+ technologies) and its e-mail and DNS provider, and grade security headers, TLS, cookies, SPF and DMARC from A+ to F with the exact fix for every weak setting. A pay-per-site alternative to Wappalyzer and BuiltWith lookups. - **URL**: https://apify.com/hxckya/tech-stack-security-check.md - **Developed by:** [KO HYEONSEUNG](https://apify.com/hxckya) (community) - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $35.00 / 1,000 websites This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. - **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use). - **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`. - **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`. - **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`. - **Any other language** — the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Tech Stack Detector & Website Security Check Paste a list of websites and get back, for each one: - **What it is built with**: CMS, ecommerce platform, frameworks, analytics, tag managers, CDN, hosting, payment and marketing tools, with versions where the site reveals them. More than 7,600 technologies from the open Wappalyzer fingerprint set, refreshed every week. - **How well it is protected**: a security grade (A+ to F) and score from the site's headers, TLS certificate and cookies, and **a concrete fix for every weak setting**. - **Who runs its mail and DNS**: the e-mail provider behind the MX records (Google Workspace, Microsoft 365, Proofpoint…), the DNS provider behind the nameservers, and whether SPF and DMARC stop anyone from sending mail in the domain's name. It is a pay-as-you-go alternative to Wappalyzer and BuiltWith lookups, with a security review included in the same price. There is no API key or subscription to manage. *Independent tool, not affiliated with Wappalyzer, BuiltWith or any site it checks.* ### Example: the three prefilled sites | Website | Built with (excerpt) | E-mail provider | DNS provider | SPF / DMARC | Grade | First fix | |---|---|---|---|---|---|---| | wordpress.org | WordPress 7.2, Nginx, PHP, Google Tag Manager | Self-hosted | Self-hosted | -all / reject | C (65) | Add a Content-Security-Policy | | shopify.com | Shopify, Cloudflare, HTTP/3 | Google Workspace | Cloudflare DNS | ~all / reject | C (67) | Add a Content-Security-Policy | | nextjs.org | Next.js, React, Vercel, Webpack | Google Workspace | Vercel DNS | ~all / quarantine | A (90) | Replace 'unsafe-inline' in the CSP with nonces or hashes | Scanned 2026-09-13. Press **Try for free** to run the same three sites; the first row of the price table below shows what that costs. Found a wrong detection or need a field? Open an issue on the **Issues** tab. ### Who uses a website technology lookup - **Sales prospecting and lead enrichment:** run your list of prospect domains and keep the ones on Shopify, WordPress or WooCommerce, or the ones using a competitor's tool. - **Agencies and freelancers:** audit a client's site before a pitch. The list of weak settings, with the fix for each, is a ready-made proposal. - **Security and IT teams:** grade all your company domains in one run. Spot expiring certificates, missing HSTS and CSP, and version leaks before an auditor does. - **Market research and competitive analysis:** measure technology adoption across thousands of domains. ### Security headers check: what it grades Every check uses only what a normal visit reveals. Each finding comes with a severity and a fix. | Check | What it flags | |---|---| | HTTPS | Site served over plain HTTP; `http://` not redirecting to `https://` | | TLS certificate | Invalid or expired certificate, expiry within 30 days, TLS 1.0/1.1 | | Strict-Transport-Security | Missing HSTS, or a max-age under 180 days | | Content-Security-Policy | Missing CSP, report-only CSP, `'unsafe-inline'`, `'unsafe-eval'`, wildcard script sources | | Clickjacking | No `frame-ancestors` and no `X-Frame-Options` | | Other headers | `X-Content-Type-Options`, `Referrer-Policy` (or `unsafe-url`), `Permissions-Policy` | | Cookies | Missing `Secure`, `HttpOnly` on session cookies, `SameSite` (names only; values are never stored) | | Version disclosure | Versions in `Server`, `X-Powered-By`, `X-AspNet-Version` or the generator meta tag | | Mixed content | Scripts, stylesheets or iframes loaded over `http://` on an HTTPS page | | security.txt | No `/.well-known/security.txt` (RFC 9116), reported as information only | | SPF | No SPF record, a record ending in `+all`, or one with no `all` mechanism at all | | DMARC | No DMARC record, or a policy that only monitors (`p=none`) — a policy inherited from the organisational domain counts | The score starts at 100 and loses points per finding; critical problems such as no HTTPS or an invalid certificate cost the most. **A+** needs a score of 95 or more *and* both HSTS and CSP. ### How to check what technology a website uses ```json { "urls": ["wordpress.org", "https://www.shopify.com", "example.com"], "includeSecurity": true, "includeDns": true, "maxConcurrency": 10, "requestTimeoutSecs": 20 } ``` - **Websites:** domains or full URLs, one per line. Lists pasted with commas or spaces work too, and duplicates are removed. A bare domain is tried over HTTPS first, then HTTP. - **Security check:** switch it off if you only need the tech stack. - **DNS and e-mail check:** four DNS queries per domain (NS, MX, TXT, `_dmarc`). Switch it off if you only care about the website itself. - **Sites in parallel** and **Timeout per site:** tune these for very large lists or slow sites. ### Tech stack output: JSON example One row per website. The dataset has four views: *Overview*, *Security findings*, *E-mail and DNS* and *Technologies by category*. You can export to JSON, CSV, Excel or HTML, or read it through the API. ```json { "input": "wordpress.org", "url": "https://wordpress.org/", "finalUrl": "https://wordpress.org/", "statusCode": 200, "title": "Blog Tool, Publishing Platform, and CMS – WordPress.org", "techCount": 13, "techNames": [ "Google Font API", "Google Tag Manager", "Gutenberg 23.9.1", "HSTS", "MySQL", "Nginx", "Open Graph", "PHP", "Priority Hints", "RSS", "WordPress 7.2", "WordPress Block Editor", "WordPress Site Editor" ], "technologies": [ { "name": "Nginx", "version": null, "confidence": 100, "categories": [ "Web servers", "Reverse proxies" ], "website": "https://nginx.org/en", "implied": false }, { "name": "PHP", "version": null, "confidence": 100, "categories": [ "Programming languages" ], "website": "https://php.net", "implied": true }, { "name": "WordPress", "version": "7.2", "confidence": 100, "categories": [ "CMS", "Blogs" ], "website": "https://wordpress.org", "implied": false } ], "categories": { "Font scripts": [ "Google Font API" ], "Tag managers": [ "Google Tag Manager" ], "WordPress plugins": [ "Gutenberg" ], "Security": [ "HSTS" ] }, "security": { "grade": "C", "score": 65, "https": true, "httpRedirectsToHttps": true, "headers": { "strictTransportSecurity": "max-age=3600", "contentSecurityPolicy": null, "contentSecurityPolicyReportOnly": null, "xFrameOptions": "SAMEORIGIN", "xContentTypeOptions": null, "referrerPolicy": null, "permissionsPolicy": null, "crossOriginOpenerPolicy": null }, "tls": { "protocol": "TLSv1.3", "valid": true, "issuer": "Let's Encrypt", "validTo": "2026-10-23T19:43:55.000Z", "daysLeft": 42 }, "disclosures": [ "meta generator: WordPress 7.2-alpha-63586" ], "issueCount": 6, "issues": [ { "id": "csp-missing", "severity": "high", "title": "Content-Security-Policy header is missing", "fix": "Start with \"Content-Security-Policy-Report-Only\" to learn what the site loads, then enforce a policy that lists only trusted sources." }, { "id": "hsts-short", "severity": "low", "title": "HSTS max-age is short (3600 seconds)", "fix": "Use a max-age of at least 180 days (15552000), ideally one year." } ] }, "scannedAt": "2026-09-11T02:17:42.115Z", "scanTimeMs": 6817 } ``` E-mail and DNS part of the nextjs.org row. The same keys are on every scanned row. `emailProvider` and `dnsProvider` name the service when it is recognised, say `Self-hosted` when every mail server (or nameserver) is named under the domain itself (such names can still be run by a hosting provider), and are `null` otherwise. `dns` is `null` when the DNS check is off or fails. ```json { "dnsProvider": "Vercel DNS", "emailProvider": "Google Workspace", "dns": { "domain": "nextjs.org", "nameservers": ["ns1.vercel-dns.com", "ns2.vercel-dns.com"], "dnsProvider": "Vercel DNS", "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "alt4.aspmx.l.google.com", "alt3.aspmx.l.google.com"], "emailProvider": "Google Workspace", "acceptsMail": true, "spf": { "record": "v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net ~all", "all": "~all" }, "dmarc": { "record": "v=DMARC1; p=quarantine; rua=mailto:...; ruf=mailto:...; pct=100; fo=1;", "policy": "quarantine", "subdomainPolicy": null, "pct": 100, "reporting": true }, "error": null } } ``` Sites that cannot be reached at all still get a row with an `error` (DNS failure, timeout, a certificate error with no working `http://` fallback, and so on), and so do invalid entries and private addresses. You are **not charged** for those rows. ### How much does a tech stack lookup cost? You pay per website scanned. One event covers the tech stack, the security grade and the e-mail and DNS check for that site, with no platform usage charge on top. | Websites scanned | Free plan | Starter | Scale | Business | |---|---|---|---|---| | 3 (the prefilled example) | $0.15 | $0.135 | $0.12 | $0.105 | | 100 | $5.00 | $4.50 | $4.00 | $3.50 | | 1,000 | $50 | $45 | $40 | $35 | | 10,000 | $500 | $450 | $400 | $350 | - Websites that cannot be reached at all, invalid entries and private addresses get a row with an `error` and are **not charged**. A site that answers with an error page (for example HTTP 403 or 500) is scanned and charged, and its row carries a `warning`. - Each run also has a start fee of $0.00005 per GB of memory, with a minimum of $0.00005. - Apify's Free plan includes $5 of usage every month, enough to scan about 100 websites here, and needs no credit card. - Set a maximum cost per run before a large list. The run stops when it reaches that amount, and the sites not yet scanned are left out. ### Tech stack API and integrations - **API:** start a run with the list of URLs and read the dataset. See the *API* tab for ready-made snippets. - **Integrations:** Make, Zapier, n8n and Google Sheets through Apify integrations. ### Use it with AI agents (MCP) AI assistants such as Claude, ChatGPT and Cursor can find and run this Actor through the [Apify MCP server](https://mcp.apify.com): they search the Store with `search-actors`, read the input with `fetch-actor-details` and start a run with `call-actor`. To give an agent only this tool, connect it to `https://mcp.apify.com?tools=hxckya/tech-stack-security-check`. Because the Actor is priced per event, agents can also pay for runs with the MCP server's agentic payments. Example prompt: > Here are 40 prospect domains. Check each one's tech stack and security grade, keep the ones on Shopify or WooCommerce, and give me a table with their e-mail provider, grade and the first fix from the findings. ### How the tech stack detection works, and what it does not do For each site the Actor makes at most **one page request**, **one TLS handshake**, **one `http://` redirect check**, **one `security.txt` lookup** and **four DNS queries**. It does not crawl, guess paths, send attack payloads or try logins. The review is passive, the same information any browser receives. Private, local and internal addresses are refused. Detection reads the HTTP response: headers, cookies, meta tags, script URLs, inline scripts, HTML and DOM selectors. Technologies that can only be seen by executing the page's JavaScript in a real browser may be missed, and only the page you give is examined, not the whole site. ### FAQ #### Is this a Wappalyzer or BuiltWith alternative? Yes, for looking up the websites you already have. It uses the open Wappalyzer fingerprint rules (MIT, via ProjectDiscovery's wappalyzergo), updated weekly, and adds the security review and the e-mail and DNS check on top. It does not call the Wappalyzer or BuiltWith APIs. #### Can it find every website that uses a technology? No. It checks the websites you give it and has no database of domains to search. Start from your own prospect or domain list, then filter the results by technology. #### Does it detect technologies loaded by JavaScript? Partly. It does not run a browser. A tool can be detected when it shows up in the page's `