Website Tech Stack Detector: What Technologies a Site Uses

Find out what a website is built with. Give it a list of sites and get back the CMS, e-commerce platform, JavaScript frameworks, analytics and tag managers, CDN, web server, programming language and more, with versions where the site shows them. It reads page code only, with no browser, using 6,500+ technology fingerprints that work without one. That keeps it fast and cheap.

Common uses

• An alternative to BuiltWith and Wappalyzer (not affiliated with either): look up the tech stack of thousands of domains in bulk, pay per site.
• Lead lists by technology: find which prospects run Shopify, WordPress, HubSpot or Google Analytics.
• Competitor and agency research: check a site's CMS, e-commerce platform, framework, CDN and analytics.

Example inputs

Paste any of these into the JSON input tab:

Quick check (2 sites)

{"urls": ["https://wordpress.org", "https://www.shopify.com"]}

E-commerce stores

{"urls": ["https://www.allbirds.com", "https://www.brooklinen.com", "https://www.kyliecosmetics.com"]}

Docs and developer sites

{"urls": ["https://vercel.com", "https://react.dev", "https://www.python.org"]}

What you get

One row per site:

Field	Meaning
url	The site as you entered it
finalUrl	The page that was analyzed, after redirects
status	HTTP status of that page
technologies	[{ name, categories, version?, confidence }], highest confidence first
error	null on normal rows; the reason on free error rows
duplicateOf	Only on free duplicate-host rows: the earlier URL on the same host

{ "url": "https://example-shop.com", "finalUrl": "https://example-shop.com/", "status": 200,
  "technologies": [ { "name": "Shopify", "categories": ["Ecommerce"], "confidence": 100 },
                    { "name": "Cloudflare", "categories": ["CDN"], "confidence": 100 } ], "error": null }

Pricing

$1.50 per 1,000 sites analyzed (pay per event site). Sites that could not be analyzed are free: robots.txt says no, the address is unsafe or unreachable, the server answered with an error, or the page is not HTML. Set a maximum charge per run in Apify and the Actor stops cleanly when it is reached; nothing past the limit is charged.

Free-plan accounts get up to 20 sites per run to try it out; the run ends with one free row explaining the limit. Paid Apify plans get full results.

Each site is fetched once per run, with one request at a time to any one site; repeat URLs for the same site come back as a free duplicate-host row. For checking public sites, not for load testing or probing systems you don't own.

How it works

• Reads one page per site (the URL you give, following up to 5 redirects). No browser and no JavaScript is run, and no extra pages are crawled.
• "Same site" means the same host: example.com, https://www.example.com/ and https://example.com/about count as one (case, a leading www., a trailing dot and the default port are ignored). The first URL you list for it is the one analyzed.
• Looks at the HTML (meta tags, script and stylesheet addresses, inline scripts, page structure), response headers, and the names of cookies the site sets. Cookie values are never read or stored.
• robots.txt is checked for every site (and every redirect target). If it disallows the page, or can't be read, the site is skipped as a free row. Crawl-delay is honored.
• Only public websites: private, internal and cloud-metadata addresses, unusual address forms and non-web ports are refused.
• Each page is capped at 2 MB and 20 seconds.

Limits

The fingerprint list covers 7,600+ technologies. About 6,500 of them have fingerprints this scan reads (headers, cookies, HTML, meta tags, script links and inline scripts). About 900 can only be found by a browser running the page's JavaScript, and about 150 depend on DNS lookups or are only inferred from other technologies; this Actor checks neither. It also finds some tools less often than a browser would, such as analytics and ad tags that a tag manager loads after the page opens. Server-side tools that leave no trace in HTML or headers can't be seen by anyone from outside. Confidence below 100 means the evidence is weaker (for example one generic header).

FAQ

What does it access? For each URL you list, it reads that one public page's HTML and headers (following up to 5 redirects) and the site's robots.txt. Nothing behind a login, and no JavaScript is run.

Anything I should watch out for? Check that your own use fits each site's terms, and don't use the results to send unsolicited messages.

How often should I run it? Stacks change slowly; monthly is usually enough for lead lists, weekly for competitor monitoring.

Can I get every page of a site? No. Each host is checked once per run, on the first URL you list for it; other URLs on the same host come back as free duplicate-host rows.

Credits

Technology fingerprints come from the open-source webappanalyzer project (GPL-3.0), originally from Wappalyzer.