Tech Stack Detector - CMS & Technology Lookup

Find out which CMS, JavaScript framework, analytics and tag manager, CDN, hosting and web server a public website uses. Give it a list of URLs. For each site you get the detected technologies with a category, a version when the site shows one, a confidence (0-100) and the evidence (which header, tag or file matched). The evidence never contains page content or cookie values.

Cost: from $2 per 1,000 site scans, plus a $0.005 start fee per run. A site counts as a scan only when at least one technology is detected. Sites with nothing detected and failed sites have no per-site charge, but the run's start fee still applies.

Try it: the input is prefilled with one URL. Press Start and open the dataset's technologies view.

How to find what CMS or tech stack a website uses

1. Paste the website URLs into Website URLs (one per line).
2. Leave Minimum confidence (0-100) at 50, or lower it to see weaker findings (more false positives).
3. Optional: set Pages per site to 2-3 to also read up to 2 linked pages on the same site (still one charge per site).
4. Press Start. Each dataset record lists technologyNames, categories and, per technology, the evidence.
5. Export as CSV, JSON or Excel from the dataset, or call it from code via the API tab.

Example input and output

• Input: { "urls": ["https://www.python.org/"] } (the live Store example input; the input form's prefill in build 0.1.5 is https://example.com/).
• Output:

{"index": 0, "url": "https://www.python.org/", "status": "success", "ok": true, "key": null, "link": null, "httpStatus": 200, "charged": true, "chargedEvents": 1, "chargeEvent": "site-scan", "attempts": 1, "error": null, "robots": {"checked": true, "allowed": true, "overridden": false, "detail": "robots.txt HTTP 200"}, "startedAt": "2026-10-26T04:44:30.009Z", "timingMs": 340, "finalUrl": "https://www.python.org/", "redirects": 0, "pagesScanned": 1, "requests": 1, "technologyCount": 3, "technologyNames": ["jQuery", "nginx", "Varnish"], "categories": ["Cache", "JavaScript library", "Web server"], "truncated": false,
  "technologies": [
    {"name": "jQuery", "category": "JavaScript library", "version": "1.8.2", "confidence": 99, "evidence": [{"source": "script-src", "pattern": "/\\/jquery\\/(\\d+(?:\\.\\d+){0,3})\\/jquery(?:\\.slim)?(?:\\.min)?\\.js/i"}]},
    {"name": "nginx", "category": "Web server", "version": null, "confidence": 95, "evidence": [{"source": "header", "name": "server", "pattern": "/^nginx(?:\\/(\\d+(?:\\.\\d+){0,3}))?(?:\\s|$)/i"}]},
    {"name": "Varnish", "category": "Cache", "version": null, "confidence": 85, "evidence": [{"source": "header", "name": "via", "pattern": "/\\bvarnish\\b/i"}]}
  ] }

How it detects (and what it does NOT do)

• Give it a list of website URLs; for each site it reads one page (the URL you give) and reports the technologies it can see: CMS and site builders (WordPress, Shopify, Drupal, Wix, ...), JavaScript frameworks (React, Next.js, Vue, Angular, ...), analytics and tag managers, CDN / hosting and the web server. Each finding has a category, a version when the site shows one, a confidence (0-100) and the evidence: which rule matched (for example: header server matched /^nginx(?:\/(\d+(?:\.\d+){0,3}))?(?:\s|$)/i). The evidence never contains page content or cookie values.
• Response headers (server, x-powered-by, CDN ids, ...), HTML markup (<meta name="generator">, <script src>, <link href>, framework attributes such as ng-version), small inline-script markers, and cookie names set by the site (names only; values are never read).
• Text, headings, HTML comments, <a href> links, code samples and JSON-LD are ignored, so a blog post about WordPress is not reported as WordPress.
• 38 technologies in 18 categories, from our own hand-written ruleset (no third-party fingerprint database).
• It does not execute JavaScript, does not log in, sends no cookies, and does not look at pages other than the one you give unless you ask (below).

Honest limitations

• Heuristic. Results are evidence-based guesses. Expect false negatives (a site that strips its generator tag, or a bundled React app with no visible marker, shows nothing) and occasional false positives (a site's own file named react.js looks like React).
• On our synthetic test set the detector scored precision 1.00 / recall 1.00 on 25 fixtures we wrote the rules against, and precision 0.93 / recall 0.87 on 14 "blind" fixtures written afterwards (first blind run, before one fix: 0.87 / 0.87). Real-world accuracy is not measured yet.
• Only what the server sends without JavaScript is visible. Single-page apps that render everything client-side reveal less.
• Versions are shown only when the page exposes them (generator tag, file name, ?ver=); they can be stale or deliberately faked.
• Sites behind a bot wall, CAPTCHA or rate limit are not analysed (see below), and have no per-site charge.

Input

• urls (required): pages to analyse, e.g. https://example.com/. URLs with a user name or password (user:pass@host) are refused; query strings are never logged.
• minConfidence (0-100, default 50): leave out weaker findings.
• maxPagesPerSite (1-3, default 1): 2-3 also reads up to 2 same-origin pages linked from the first page only (depth 1, GET, never followed further; no query strings, no login, account, cart, checkout, admin, search, profile or upload pages). Still one charge per site.
• probeWellKnownPaths (default off): also requests up to 3 fixed paths that confirm a CMS (/wp-json/, /core/misc/drupal.js, /media/system/js/core.js), only where robots.txt allows (fixed list; no login or admin paths are ever requested).
• includeEvidence (default on), timeoutSecs (default 15), maxConcurrency (default 3, max 5).
• Owner-only kit fields ignoreRobotsTxt / overrideDomainStop require an attestation that you own or control the one domain named; small runs only.

Output

One dataset record per input URL (in url and finalUrl a query string is shown as ?[redacted]): index, url, status, ok, charged, chargedEvents, httpStatus, error, robots, timingMs plus finalUrl, redirects, pagesScanned, requests, technologyCount, technologyNames, categories, technologies: [{name, category, version, confidence, evidence: [{source, name?, pattern}]}], probes (if enabled: per path only confirmed CMS X or not confirmed), truncated. Statuses with no per-site charge: no_technologies_detected, not_html, empty_page, http_error (404 etc.), http_5xx, login_required (401), robots_disallowed, blocked_or_captcha, rate_limited, skipped_blocked, ssrf_blocked, invalid_input, timeout, network_error, budget_reached. RUN_SUMMARY in the key-value store has counts, charged events, stopped domains and request totals.

Pricing

Pricing: $2 per 1,000 site scans; plus a $0.005 start fee per run. Failed scans have no per-result charge; the per-run start fee still applies.

• Pay-per-event site-scan: one event per site on which at least one technology was detected. Sites where nothing is detected, and every failure status above, add no per-result charge. Extra pages and path probes do not add events.
• What you pay even when every URL fails: the $0.005 start fee. Apify charges it through its synthetic apify-actor-start event on every run: "Up to and including 1 GB of RAM, the event is charged once. Then, it's charged once for each extra GB of memory" (Apify docs). This Actor's memory is limited to 512-1024 MB, so the start fee is always exactly $0.005 per run.
• The synthetic apify-default-dataset-item event is not used (the Actor refuses to run if it is priced). A maximum total charge set on the run is respected.

Politeness and safety (kit defaults; may only be tightened)

• robots.txt honoured for every request (input URL, every redirect hop, extra pages and path probes).
• A robots.txt that returns 4xx (except 429) means no restrictions; a 429 is treated as a rate limit and stops the domain; 5xx or an unreachable robots.txt means nothing is fetched.
• At most ~1 request per second per registered domain; fixed honest User-Agent TechStackActor/0.1.0 (+https://apify.com/luxe_tasks/tech-stack-detector; honours robots.txt); no proxy rotation, no evasion.
• A 403, 429 (Retry-After over 60 s, or still 429 after one retry), or CAPTCHA/bot-wall page on any request for a site stops the whole registered domain for the rest of the run (and after a restart); later items are skipped, with no per-site charge. 404 and 5xx skip only that URL (5xx is not retried).
• Private, loopback, link-local and cloud-metadata addresses are refused, re-checked after DNS and on every redirect.
• No logins, cookies, headers, proxies or session tokens can be supplied (the run refuses such input). Response bodies are read up to 768 KB.

Acceptable use

Acceptable use. This Actor processes publicly accessible web pages that you choose. By running it you confirm that:

1. You will submit only public URLs that you have the right or permission to process, and you will use the output lawfully.
2. You will not submit pages behind a login, paywall, or other access control, and the Actor does not accept passwords, cookies or session tokens.
3. You will not use it to get around CAPTCHAs, rate limits, IP blocks, or any other technical measure a site uses to restrict access.
4. You will comply with the target site's terms of use and robots.txt, and with all applicable law, including copyright and data-protection law (GDPR, CCPA and similar). You are the controller of any personal data in your results.
5. You will not process, store or distribute illegal content, or use the Actor to harass, stalk, or profile individuals.
6. You will not use the Actor for vulnerability scanning, attack reconnaissance or security testing of sites you do not own or have written permission to test. The Actor reports technologies, not vulnerabilities.
7. You will keep request volumes reasonable. The Actor enforces per-domain rate limits and identifies itself in its User-Agent. The Actor may refuse or skip URLs that violate these rules. Report problems through the Actor's Issues tab.

Privacy

This Actor stores no page content; records hold technology names, rule patterns and URLs you supplied.

"Results are written only to your run's default Apify storage. The developer does not copy, view or retain them. If your results contain personal data, you are the controller and the developer acts only as your processor under Apify's Standard Actor Contract. Apify's retention settings apply."

Third-party software

The detection rules are our own; no fingerprint database is used. Runtime dependencies (apify, robots-parser, tldts) are listed in NOTICE with their licences. Technology names are trademarks of their respective owners and are used only to identify detected technologies; no affiliation or endorsement is implied.

Runtime

Node 24 (engines, .nvmrc, Dockerfile apify/actor-node:24). Memory: default 1024 MB, allowed 512-1024 MB (the work is network-bound and rate-limited to about 1 request per second per domain, so more memory does not make a run faster). Tests: npm test. Local reliability run: python3 test/reliability/tech_runs.py; benchmark: python3 bench/tech_bench.py (fixture servers on 127.0.0.1 only).

FAQ

How do I find what CMS a website uses? Add the site's URL to the input and run Tech Stack Detector. Records with a technology in the CMS or Site builder category name it, with the evidence that matched.

How much does a tech stack scan cost? From $2 per 1,000 site scans plus a $0.005 start fee per run, so 1,000 sites with at least one detected technology, scanned in one run, cost $2.005 in total.

How accurate is it? Tech Stack Detector is heuristic: it reports what the site exposes without running JavaScript, so expect some false negatives and occasional false positives. Accuracy on real websites has not been measured yet. See "Honest limitations".

Does it run JavaScript or log in? No. Tech Stack Detector reads the HTML and headers the server sends, sends no cookies and never logs in.

Does it scan for vulnerabilities? No. It reports technologies, not vulnerabilities. Security testing of sites you don't own is not allowed (Acceptable use, item 6).

More tools from Luxe Tasks

Want a picture of each site you scanned? Website Screenshot & URL to PDF Converter takes the same URL list.

Tool	What it does
Website Screenshot & URL to PDF Converter	PNG/JPEG screenshots (viewport or full page) and PDFs of public web pages you choose.
OCR Text Extractor	Extracts English text from scanned PDFs, PNG and JPEG images with Tesseract OCR that runs inside the Actor.
HTTP API Request Runner	Calls APIs you are authorized to use, with your own key kept in an encrypted secret input field.

Each tool is priced per result plus a per-run start fee; see that tool's Pricing section.

Developer: Luxe_tasks.

Contact: https://apify.com/luxe_tasks · Issues tab on the actor page.