Website Tech Stack Detector (Wappalyzer alternative)

Paste a list of websites and get the technologies each one runs: CMS, ecommerce platform, JavaScript frameworks, analytics and marketing tags, payment providers, hosting, CDN, web server and more. You also get versions where they are exposed and the evidence behind every detection.

It uses the open Wappalyzer-format fingerprint database (webappanalyzer, 7,600+ technologies, updated continuously).

Typical uses:

• Lead generation: find every Shopify or WooCommerce store in a list, or every site still on Universal Analytics
• Sales intelligence: see which email, CRM and SaaS tools a prospect uses before you call
• Competitor research and agency audits: see what a site is built with and which tags it loads
• Security inventory: flag outdated WordPress, jQuery or PHP versions across many sites

What makes it different

• Two modes. Fast mode needs one HTTP request per site (about 1 s) and also reads the site's own JS bundles for version banners. Browser mode renders the page in Chrome and checks JavaScript globals, cookies and every request the page makes. That catches tag-manager-loaded pixels (Facebook Pixel, Clarity, Hotjar...) and SPA frameworks that plain HTTP can't see.
• DNS intelligence. Public MX/TXT/NS records show the company's email provider (Google Workspace, Microsoft 365), DNS host and SaaS tools whose domain verification they added: HubSpot, Stripe, Atlassian, Zoom, DocuSign, OpenAI... These come back separately as dnsServices, so they never pollute the website stack.
• Evidence for every hit, e.g. header x-powered-by: Next.js or script: https://cdn.shopify.com/..., so you can trust or dismiss it.
• Spreadsheet-friendly: technologyNames and dnsServiceNames are flat text columns, and byCategory groups names by category.

Input

{ "urls": ["allbirds.com", "https://vercel.com"], "mode": "fast", "checkDns": true }

Output (trimmed, real result)

{
  "domain": "allbirds.com", "status": "ok", "statusCode": 200, "title": "Allbirds | Sustainable Shoes...",
  "technologyCount": 26,
  "technologyNames": "Shopify, Apple Pay, GSAP, PayPal, Shop Pay, Vue.js, Attentive, Cloudflare, Facebook Pixel 2.9.429, Google Analytics GA4, Microsoft Clarity, OneTrust, ...",
  "technologies": [
    { "name": "Shopify", "version": null, "confidence": 100, "categories": ["Ecommerce"], "website": "https://shopify.com",
      "evidence": ["script: https://www.allbirds.com/cdn/shop/t/..."], "source": "website" }
  ],
  "byCategory": { "Ecommerce": ["Shopify"], "Payment processors": ["Apple Pay", "PayPal", "Shop Pay"] },
  "dnsServices": [{ "name": "Microsoft 365", "categories": ["Email"], "evidence": ["DNS MX: ...mail.protection.outlook.com"] }],
  "dnsServiceNames": "Apple iCloud Mail, Microsoft 365, DocuSign, Miro"
}

Reliability

• Sites that answer 4xx/5xx (bot walls, error pages) are returned with status: "blocked" and are not charged. Browser mode gets through more of them.
• Unreachable sites, DNS failures, timeouts and invalid URLs are returned with a clear error and are not charged.
• Detection is passive. The Actor loads the public page like a normal visitor, plus at most 6 same-site scripts in fast mode. It never probes admin paths.

Pricing

Pay per event: site-analyzed, charged once per website that loaded successfully. Failed, blocked and invalid sites are free.

Limitations

Technologies used only behind a login, or only on pages you didn't submit, can't be seen. Submit specific URLs (e.g. /checkout or /blog) for deeper coverage. Fingerprints are community-maintained and GPL-3.0 licensed (see src/data/LICENSE-webappanalyzer.txt).