Website Tech Stack Detector - Wappalyzer & BuiltWith Alternative

Website tech stack detector, a Wappalyzer and BuiltWith alternative (not affiliated with either): find out what any website runs on, such as WordPress, Shopify, Magento, Next.js, Cloudflare, Google Analytics and about 60 more. One plain HTTP request per site, no browser, and every detection lists its evidence (header, meta tag, script URL or cookie name). Failed URLs are not charged.

Free to try: a new Apify account includes free monthly platform credit, enough to validate the output on a few dozen sites before you pay anything. This Actor has no hidden minimums: failed items are never billed.

How to use Website Tech Stack Detector

1. Paste public URLs or bare domains into urls.
2. Leave respectRobotsTxt on unless you are entitled to switch it off.
3. Click Start.
4. Use technologyNames for quick filtering or technologies for category and evidence.

Pricing

Pay per event, no subscription and no compute fees on top. Price: $5.00 per 1,000 sites.

Event	When it is charged	Price
url-analyzed	One website URL fetched successfully (HTTP below 400) and analyzed for technologies.	$0.005

Failed, blocked or unknown items are not billed. Set a maximum cost per run in the run options to cap spend.

Example input

{
  "urls": [
    {
      "url": "https://nextjs.org"
    }
  ],
  "respectRobotsTxt": true
}

Example output

Sample output item (from the Actor README).

{
  "input": "https://nextjs.org",
  "finalUrl": "https://nextjs.org/",
  "httpStatus": 200,
  "technologyNames": [
    "Vercel",
    "Next.js"
  ],
  "technologies": [
    {
      "name": "Vercel",
      "category": "Hosting",
      "evidence": "header x-vercel-id"
    }
  ]
}

Details and limits

Give it a list of public website URLs and get back the technologies each site appears to use: CMS, ecommerce platform, analytics and tag managers, CDN and hosting, web server, JS frameworks and libraries, payments, cookie-consent tools. It makes one plain HTTP request per site (no browser), so runs are fast and cheap.

What it does

• Input: a list of public http(s) URLs (bare domains such as example.com are accepted and fetched over https).
• For each URL it fetches the page once (following up to 5 redirects) and inspects only:
  • response headers (server, x-powered-by, cf-ray, x-vercel-id, ...),
  • HTML meta tags (<meta name="generator">),
  • script src URLs and well-known HTML markers (for example __NEXT_DATA__, /wp-content/),
  • cookie names from Set-Cookie (names only; cookie values are never read or stored).
• Output per URL: input, finalUrl, httpStatus, technologyNames (flat list) and technologies (name, category, and the evidence that triggered it), capturedAt.
• About 60 technologies are recognised, e.g. WordPress, Shopify, WooCommerce, Magento, Wix, Squarespace, Webflow, Drupal, Next.js, Nuxt, React, Vue.js, Angular, Cloudflare, CloudFront, Fastly, Vercel, Netlify, Google Analytics, Google Tag Manager, Meta Pixel, Hotjar, Stripe.

Limits and honesty notes

• Detection is based on one HTTP request to the URL you give, with no JavaScript execution. Technologies that only show up after client-side rendering, or on other pages of the site, can be missed. A site with no visible signals returns an empty list; that does not prove nothing is used.
• Detection is signature-based and can produce false positives or negatives (for example a CDN header that only reflects a proxy in front of the site, or a site that hides its headers). Treat results as strong hints, not an audit. No version numbers are reported.
• Only the first 1 MB of each page is inspected.
• robots.txt is respected by default (the wildcard * group; switch off with respectRobotsTxt: false only for sites you are entitled to analyze). The actor identifies itself with the user agent TechStackDetectorBot.
• Only public http(s) URLs: localhost, private and link-local IP ranges, and non-http schemes are rejected, and every redirect hop is re-checked.
• Sites behind bot walls, logins or captchas may return an error page or a block status; no proxies, no captcha solving and no evasion are used.
• You are responsible for having the right to analyze the URLs you submit. The actor collects no personal data: only technology signals are extracted, and cookie values are discarded.

More from PennyData

• Website Screenshot & URL to PDF: Full-page screenshots and URL/HTML to PDF with headless Chromium.
• Bulk Email Validator (No SMTP): Syntax, MX, disposable, role and typo checks for email lists.
• App Store Reviews Scraper: Apple app reviews by app ID and country from the public RSS feed.
• Bulk Domain WHOIS & DNS Lookup: Availability, registrar, expiry, nameservers, MX and TXT via RDAP.

FAQ

How accurate is it?
Signature-based on one HTTP request without JavaScript execution, so client-rendered or hidden technologies can be missed. Treat results as strong hints, not an audit.

Is it legal?
It requests only the URL you provide, respects robots.txt by default, stores no cookie values and no personal data.

Need a custom field, a higher volume or a different source?
Open an issue on the Actor page and describe what you need; custom variants are possible.

Is it maintained?
Yes. Reports of breakage are answered through the Issues tab, and runs that fail are not billed.

Built with AI assistance (Claude); maintained by the publisher.