Website Tech Stack Detector: a Wappalyzer & BuiltWith alternative

Find out what technology any website uses. Give it a list of domains. For each one you get the CMS, ecommerce platform, analytics, tag managers, CRM and marketing automation, live chat, payments, CDN and hosting, JavaScript frameworks and A/B testing tools it runs. You also get its email provider (MX), the sending services in its SPF record and its SaaS domain verifications. Every detection comes with a confidence score and the evidence behind it: the header, script URL, meta tag, cookie or DNS record we saw.

• 508 technologies in our own fingerprint set, built from public signals
• $0.002 per domain. Unreachable domains are free.
• Fast: 20 real sites in about 5 seconds (homepage only) or about 11 seconds (deep crawl)
• Polite: one clear User-Agent, robots.txt respected, no proxies, no headless browser
• Structured JSON that works well for lead enrichment, technographics, competitor research and AI agents

What you can use it for

• Sales prospecting & lead scoring: find Shopify stores using Klaviyo, or SaaS companies on HubSpot that run Intercom
• Technographic enrichment: add cms, ecommerce, crmMarketing and emailProvider columns to a CRM or a Clay/Sheets list
• Competitive intelligence: see which analytics, A/B testing and chat vendors competitors use, and track changes over time
• Agency audits & migrations: check WordPress or Drupal version, page builder, CDN, consent banner and tracking pixels
• Security & compliance checks: HSTS and CSP headers, bot protection, consent management platform, risky third-party scripts (for example polyfill.io)

Input and examples

Field	Type	Default	Description
domains	array of strings	required	Domains (stripe.com) or URLs (https://shop.example.com/pricing). Duplicates and www. are merged. Up to 10,000 per run.
deepCrawl	boolean	false	Also analyse up to N internal pages (pricing, cart, contact, login, blog …). This catches tools that only load off the homepage, such as checkout payments or chat widgets.
deepCrawlPages	integer 1–10	4	Internal pages per domain when deepCrawl is on.
includeDns	boolean	true	MX, SPF, TXT verification, NS and www CNAME lookups.
includeEvidence	boolean	true	Attach the observed signal to each technology.
minConfidence	integer 0–100	0	Drop weak detections. A value of 50 removes technologies that are only implied by another one, such as PHP implied by WordPress.
maxConcurrency	integer 1–50	10	Domains analysed in parallel. Pages within one domain are always fetched one at a time.
requestTimeoutSecs	integer 5–60	15	Timeout per HTTP request.

{
  "domains": ["allbirds.com", "stripe.com", "wordpress.org", "hubspot.com"],
  "deepCrawl": true,
  "deepCrawlPages": 3
}

Output: one item per domain

{
  "domain": "allbirds.com",
  "url": "https://www.allbirds.com/",
  "status": "ok",
  "httpStatus": 200,
  "title": "Allbirds: Comfortable, Sustainable Shoes & Apparel",
  "technologyCount": 13,
  "technologyNames": ["Shopify", "Microsoft Clarity", "Google Tag Manager", "Attentive", "Cloudflare", "Swiper", "Microsoft 365", "…"],
  "technologies": [
    {
      "name": "Shopify",
      "slug": "shopify",
      "category": "Ecommerce",
      "group": "ecommerce",
      "version": null,
      "confidence": 100,
      "website": "https://www.shopify.com",
      "evidence": [
        { "type": "header", "key": "powered-by", "value": "Shopify", "page": "https://www.allbirds.com/" },
        { "type": "cookie", "key": "_shopify_essential", "value": "Set-Cookie", "page": "https://www.allbirds.com/" },
        { "type": "script", "key": "src", "value": "https://cdn.shopify.com/shopifycloud/…", "page": "https://www.allbirds.com/" }
      ]
    }
  ],
  "categories": {
    "cms": [], "ecommerce": ["Shopify"], "analytics": ["Microsoft Clarity"], "tagManagers": ["Google Tag Manager"],
    "crmMarketing": ["Attentive"], "chat": [], "payments": [], "cdnHosting": ["Cloudflare"],
    "frameworks": ["Swiper"], "abTesting": [], "advertising": [], "email": ["Microsoft 365", "…"], "other": ["HSTS", "…"]
  },
  "dns": {
    "mxRecords": ["allbirds-com.mail.protection.outlook.com"],
    "mxProviders": ["Microsoft 365"],
    "spfRecord": "v=spf1 include:allbirds_com._es.easydmarc.com include:spf.protection.outlook.com ~all",
    "spfIncludes": ["allbirds_com._es.easydmarc.com", "spf.protection.outlook.com"],
    "spfServices": ["EasyDMARC", "Microsoft 365"],
    "txtVerifications": ["Google Search Console", "Microsoft 365", "DocuSign", "Apple Business", "Miro"],
    "nameservers": ["ns2.markmonitor.com", "…"],
    "dnsProviders": ["MarkMonitor DNS"],
    "wwwCname": "shops.myshopify.com",
    "hostingFromCname": ["Shopify"]
  },
  "emailProvider": "Microsoft 365",
  "deepCrawl": true,
  "pagesAnalyzed": ["https://www.allbirds.com/", "https://www.allbirds.com/collections/new-arrivals-26", "https://www.allbirds.com/products/…"],
  "billableEvents": ["domain-analyzed", "deep-crawl"],
  "fetchedAt": "2026-10-20T18:27:18.512Z",
  "durationMs": 6697
}

status values: ok (charged), blocked (bot challenge or 401/403/429/503; header-level detections are still returned), http_error, unreachable, robots_disallowed, invalid_input, skipped_budget. Only ok is charged.

Category groups: cms, ecommerce, analytics, tagManagers (including CDPs such as Segment), crmMarketing (CRM, marketing automation, email marketing, forms, scheduling, B2B intent), chat (live chat, helpdesk, AI chatbots), payments (including buy now pay later), cdnHosting (CDN, PaaS, web servers), frameworks (JS frameworks, backend frameworks, languages, UI libraries), abTesting (experimentation, personalization, feature flags), advertising (pixels and ad tech), email (MX hosting, email security, SPF senders, DNS providers, verifications) and other (consent, security, CAPTCHA, video, maps, search, SEO, accessibility …).

The Overview dataset view gives one row per domain, with a technology list and email provider, ready to export to CSV or Excel.

Pricing (pay per event)

Event	Price	When
domain-analyzed	$0.002	One reachable domain analysed (homepage plus DNS).
deep-crawl	$0.005	Added once per domain when deepCrawl is on and at least one internal page was analysed.

• 1,000 domains cost $2. With deep crawl they cost $7.
• Not charged: unreachable, blocked, robots-disallowed, invalid or duplicate inputs, and any domain where deep crawl found no extra page.
• Your budget is respected. Set Maximum cost per run (maxTotalChargeUsd). The Actor reserves the worst-case cost of each domain before it starts work, so parallel workers can never overshoot. Domains that no longer fit are returned as skipped_budget and are free. If the budget is below $0.002, the run stops at once with BUDGET_TOO_LOW.
• No proxies and no browser keep platform usage small.

Compared with the alternatives: the official BuiltWith API needs a subscription, and the Wappalyzer-style Actors in the Store charge $0.01–$0.10 per domain.

Use it from the API, Python, n8n/Make or an AI agent (MCP)

REST (synchronous, returns the dataset):

curl -X POST "https://api.apify.com/v2/acts/impressionable_lupine~website-tech-stack-detector/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"domains":["stripe.com","allbirds.com"],"deepCrawl":false}'

JavaScript:

import { ApifyClient } from 'apify-client';
const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('impressionable_lupine/website-tech-stack-detector').call({ domains: ['stripe.com'] });
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items[0].categories);

MCP (Claude, Cursor, any MCP client): add the Apify MCP server and enable this Actor:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?actors=impressionable_lupine/website-tech-stack-detector",
      "headers": { "Authorization": "Bearer <APIFY_TOKEN>" }
    }
  }
}

Then ask: "What CMS, analytics and chat tools do allbirds.com and gymshark.com use? Who hosts their email?" The agent calls the Actor with {"domains":["allbirds.com","gymshark.com"]} and reads the categories and dns fields.

How detection works

1. We fetch the homepage over HTTPS (falling back to HTTP, then www.) with the User-Agent WebsiteTechStackDetector/1.0, after checking robots.txt.
2. We read response headers, Set-Cookie names, <meta> tags, <script src>, <link> and <iframe> URLs, and raw HTML or inline JS markers.
3. Optionally we analyse up to N internal pages. Commercial pages come first (pricing, cart, contact, login, support, blog), with at most one page per site section.
4. We query DNS for MX (email host and security gateway), SPF includes (SendGrid, Mailgun, Amazon SES, HubSpot, Salesforce, Zendesk …), TXT verifications (Atlassian, Slack, Zoom, DocuSign, OpenAI, Meta …), NS (DNS provider) and the www CNAME (Vercel, Netlify, Shopify, WP Engine …).
5. We score each technology. Each signal type has a weight (meta generator 0.95, header 0.9, script URL 0.9, DNS 0.9, link 0.85, cookie 0.75, HTML marker 0.7), and independent signals combine as 1 − Π(1 − w). Implied technologies, such as React from Next.js or PHP from WordPress, get 60% of the parent's score and are labelled implied.

Accuracy notes

• High precision by design. Fingerprints target vendor-specific hosts and markers (js.hs-scripts.com, x-shopid, cdn.shopify.com/s/files), not brand names in page text. A blog post that mentions Shopify, Stripe and HubSpot produces zero detections (this is covered by a test). CMS rules only count asset URLs on the site's own domain, so a link to another site's /wp-content/ image does not flag WordPress.
• In our spot checks of real sites, every platform-level detection (CMS, ecommerce, framework, CDN, email host) matched what the site visibly runs. See TEST-REPORT.md in the source.
• Versions are reported only when the site exposes them, for example in <meta name="generator">, ?ver= asset query strings, ng-version or Server headers.
• Confidence below 60 usually means the technology was implied rather than observed. Use minConfidence: 60 if you only want direct evidence.
• DNS verifications (for example atlassian-domain-verification) prove the company owns an account with that vendor. They do not prove the vendor runs on the website.

Limitations

• No JavaScript execution. Tools injected only at runtime by a tag manager, with no trace in the HTML, will be missed. Turn on deepCrawl to raise recall. Results are still much better than "homepage HTML only" because DNS, headers and cookies are included.
• Sites behind aggressive bot protection (Cloudflare challenge, DataDome, Akamai) may return blocked. We do not use proxies or bypass challenges. Header-level detections, such as the CDN or WAF, are still returned and the domain is free.
• We respect robots.txt. A domain that disallows our bot is returned as robots_disallowed and is not charged.
• This tool covers 508 technologies, not BuiltWith's tens of thousands. Coverage focuses on the B2B and ecommerce tools buyers ask about. We do not provide historical data ("used since") or spend estimates.
• We return technologies observed on public pages at fetchedAt. We do not claim anything about logged-in product areas.

FAQ

Is this a Wappalyzer alternative? Yes. It answers the same "what is this site built with?" question and works in bulk via API. It adds DNS-based email and SaaS detection and returns evidence and confidence for every technology.

Is this a BuiltWith alternative? For current-stack lookups, yes, and at a fraction of the price. For historical technology timelines or very long-tail tags, BuiltWith's paid API goes further.

Do you use Wappalyzer's fingerprints? No. The open Wappalyzer forks are GPL-3.0. Our 508 fingerprints are an independent set written from public, observable signals.

Why was a domain not charged? Only status: "ok" is billable. Unreachable, blocked, robots-disallowed, invalid and budget-skipped domains are free. The billableEvents field on each item shows exactly what applies.

How fast is it? About 0.25 s per domain of wall time at the default concurrency of 10 (homepage only), or about 0.6 s with deep crawl. Each domain takes 1–10 s end to end.

Can I run it on a schedule to track changes? Yes. Save a task with your domain list, schedule it daily or weekly and compare technologyNames between runs.

Will it hit my target sites hard? No. Each domain gets one homepage request, a robots.txt check and at most N inner pages fetched one at a time with a delay. We honour Crawl-delay up to 10 s.

Can I get CSV? Yes. Export the dataset (Overview view) as CSV, Excel or JSON from the console or the API.