Tech Stack Detector — Website + DNS

Find out what any list of websites is built with — CMS, ecommerce platform, JavaScript framework, analytics, ad pixels, marketing automation, live chat, consent banner, payments, CDN, hosting, web server — and, from public DNS records, which email provider, email-sending tools and SaaS products the company uses (Google Workspace, Microsoft 365, Mailchimp, SendGrid, HubSpot, Salesforce, Atlassian, Zoom, Stripe…).

A pay-as-you-go alternative to BuiltWith and Wappalyzer lookups: $2 per 1,000 websites, with the evidence for every detection.

Why this one

• Website + DNS. DNS signals (MX, SPF includes, domain-verification records, name servers) reveal back-office tools that never appear in the page, and they still work when a site blocks bots.
• Evidence for each detection — the header, cookie name, meta tag, HTML snippet or DNS record that matched — so you can trust (or filter) the result.
• Polite and lightweight. One request per site (the page you give, usually the home page), no crawling, a clear User-Agent, and robots.txt is respected by default. No browser, so runs are fast and cheap.
• Fair billing. Invalid inputs and unreachable sites with no DNS signal are not charged.

Use cases

• Lead qualification: find Shopify stores using Klaviyo, WordPress sites without a consent banner, companies on Microsoft 365…
• Competitor and market research: which analytics, ad networks and chat tools your market uses.
• Sales and agency prospecting: enrich a list of domains before outreach.
• IT and security reviews of your own portfolio of sites (web server versions, HSTS, CDN).

Input

Field	Description
urls	Domains or URLs, e.g. shopify.com, https://www.example.com/. Required.
includeDns	Analyze public DNS records (default true).
respectRobotsTxt	Skip pages disallowed by robots.txt; DNS is still analyzed (default true).
includeEvidence	Explain each detection (default true).
timeoutSecs	Timeout per site, 5–60 s (default 20).
maxSites	Stop after N sites (0 = no limit).

{ "urls": ["shopify.com", "wordpress.org", "vercel.com"] }

Output

One item per website:

{
  "input": "wordpress.org",
  "url": "https://wordpress.org/",
  "finalUrl": "https://wordpress.org/",
  "domain": "wordpress.org",
  "status": "ok",
  "httpStatus": 200,
  "error": null,
  "title": "Blog Tool, Publishing Platform, and CMS – WordPress.org",
  "language": "en",
  "technologies": [
    { "name": "WordPress", "category": "CMS", "version": "7.2", "evidence": ["meta generator: WordPress 7.2", "html: /wp-content/"] },
    { "name": "Nginx", "category": "Web server", "version": null, "evidence": ["header server: nginx"] },
    { "name": "Google Search Console", "category": "Business tools", "version": null, "evidence": ["dns TXT google-site-verification"] }
  ],
  "categories": { "CMS": ["WordPress"], "Web server": ["Nginx"], "Business tools": ["Google Search Console"] },
  "techNames": ["WordPress", "Nginx", "Google Search Console"],
  "techCount": 3,
  "dns": { "mx": ["..."], "nameservers": ["..."], "spfIncludes": ["..."] },
  "checkedAt": "2026-09-28T12:40:51.000Z"
}

status is one of: ok, http-error (the site answered with 4xx/5xx; headers are still analyzed), robots-disallowed (page not fetched, DNS analyzed), fetch-failed (site unreachable), invalid (not a public domain or URL).

Domain-verification tokens are never copied into the output: only the name of the service is reported.

Pricing

Pay per event: $0.002 per website analyzed ($2 per 1,000) + $0.005 per run start. A website is charged when its page was fetched (even with an HTTP error) or at least one technology was found. Set a maximum cost per run in the run options: the Actor stops before exceeding it.

Detected technologies

About 260 fingerprints written for this Actor across: CMS and site builders (WordPress, Drupal, Webflow, Wix, Squarespace, Framer…), ecommerce (Shopify, WooCommerce, Magento, BigCommerce, PrestaShop, Salesforce Commerce Cloud…), JavaScript frameworks (Next.js, Nuxt, Gatsby, Astro, Angular, React, Vue…), analytics and tag managers, ad pixels (Meta, Google Ads, LinkedIn, TikTok…), marketing automation, live chat and support, consent management, payments, video, reviews, security and bot protection, CDN and hosting, web servers and back-end frameworks; from DNS: email hosting, email security, email delivery, SaaS domain verifications and DNS providers.

Limits

• Only the page you give is analyzed (no crawling); technologies loaded only on other pages or injected after JavaScript runs may be missed. Tag-manager containers hide the tools they load.
• Some sites block automated requests; DNS results are still returned.
• DNS-verification records show that a company set up a tool at some point, not that it still pays for it.
• Detections are heuristics: check the evidence field when it matters.

Responsible use

The Actor only reads what any browser or DNS resolver can see, respects robots.txt and extracts no personal data. You are responsible for how you use the results (e.g. anti-spam rules when prospecting).