Tech Stack Detector: Website Technology Checker

A website technology detector: give it a list of URLs and see the tech stack each site runs, for lead lists, market research or keeping an inventory of your own sites.

Find out what any public website is built with: CMS, e-commerce platform, JavaScript frameworks, analytics and tag managers, CDN, hosting, web server, marketing tools and more. Each result lists the detected technologies with version (where the site exposes it), confidence and the evidence behind each detection. More than 7,600 technologies are covered.

Quick start for AI agents and API users

• What it does: Detect what a website is built with: CMS, e-commerce platform, JS frameworks, analytics, CDN, hosting and 7,600+ technologies (open fingerprints).
• When to use it: To profile sites or lead lists.
• Example input (the form's prefill; it finishes in under a minute):

{
  "urls": [
    "https://wordpress.org/news/",
    "https://www.shopify.com/",
    "https://apify.com/"
  ]
}

• Example output: one real dataset row from run T4LQ0nYx5csIqGTle (2026-10-23), with long fields shortened and empty fields left out. Fields not shown are listed in the output table below.

{
  "url": "https://wordpress.org/news/",
  "finalUrl": "https://wordpress.org/news/",
  "domain": "wordpress.org",
  "httpStatus": 200,
  "title": "WordPress News – The latest news about WordPress and the WordPress community",
  "technologyCount": 12,
  "technologies": [
    {
      "name": "Google Font API",
      "version": null,
      "confidence": 100,
      "categories": [
        "Font scripts"
      ],
      "website": "https://fonts.google.com/",
      "cpe": null,
      "detectedBy": [
        "dom"
      ]
    },
    {
      "name": "Google Tag Manager",
      "version": null,
      "confidence": 100,
      "categories": [
        "Tag managers"
      ],
      "website": "https://www.google.com/tagmanager",
      "cpe": null,
      "detectedBy": [
        "html"
      ]
    },
    "..."
  ],
  "categories": [
    "Blogs",
    "CMS",
    "..."
  ],
  "server": "nginx",
  "htmlTruncated": false,
  "detectedAt": "2026-10-23T13:11:01Z"
}

• Cost (pay per event, Free-plan prices): Actor Start $0.002; result $0.0015. Failed items are not charged.
• From an AI agent: with the Apify MCP server, call call-actor with actor phaux/tech-stack-detector, or load it as its own tool with https://mcp.apify.com?tools=phaux/tech-stack-detector. Read results with get-dataset-items.

What does Tech Stack Detector do?

• Fetches each URL you give it with a plain HTTP request (no browser) and analyzes the response headers, cookies, URL, <meta> tags, script URLs, inline scripts, HTML, visible text and DOM selectors.
• Matches them against the open Wappalyzer-compatible fingerprint database enthec/webappanalyzer (GPL-3.0), pinned to a reviewed commit, and applies its implies, requires and excludes rules (WordPress implies PHP and MySQL, for example).
• Returns one dataset item per analyzed URL.

Why use it?

• Live detection: each URL is fetched at run time, not looked up in an old index.
• Fast and cheap: plain HTTP, no browser.
• Pay only for analyzed URLs: pages that fail, are blocked, or are disallowed by robots.txt cost nothing.
• Explainable: detectedBy shows which signals matched, and minConfidence hides weak guesses.

Use cases: lead generation and lead enrichment by technology (for example, "stores on Shopify"), competitive research, sales prospecting lists, SEO and security audits, and tracking technology changes over time.

How to use it

1. Add website URLs or bare domains to urls (https:// is added if missing).
2. Optionally set minConfidence or keep only some categories (for example ["CMS", "Ecommerce", "Analytics"]).
3. Run the Actor and open the Tech stacks dataset view, or download JSON, CSV or Excel.

Input

{
  "urls": ["https://wordpress.org/news/", "shopify.com", "https://apify.com/"],
  "minConfidence": 50,
  "categories": [],
  "includeDetectedBy": true,
  "maxConcurrency": 5
}

Field	Type	Default	Description
urls	array	required	Public web pages to analyze, e.g. https://www.example.com or example.com (https:// is added). One result per URL. Max 5,000 per run.
minConfidence	integer	50	Only report technologies detected with at least this confidence (0-100).
categories	array	—	Optional. Keep only technologies in these categories, e.g. 'CMS', 'Analytics', 'Ecommerce', 'JavaScript frameworks', 'CDN'. Empty = all.
includeDetectedBy	boolean	true	Add which signals (headers, cookies, scriptSrc, html, meta, dom...) matched each technology.
maxConcurrency	integer	5	How many URLs to process at once (1-10). Requests to the same host are always sequential, at least 1 s apart (or the site's robots.txt Crawl-delay).
requestTimeoutSecs	integer	20	How long to wait for each page (and its robots.txt) to respond, in seconds. Slow pages are reported in FAILED_URLS and not charged.

Output example

One dataset item per analyzed URL:

{
  "url": "https://wordpress.org/news/",
  "finalUrl": "https://wordpress.org/news/",
  "domain": "wordpress.org",
  "httpStatus": 200,
  "title": "WordPress News – The latest news about WordPress and the WordPress community",
  "technologyCount": 12,
  "technologies": [
    {"name": "WordPress", "version": "7.2", "confidence": 100, "categories": ["CMS", "Blogs"],
     "website": "https://wordpress.org", "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
     "detectedBy": ["html", "meta", "scriptSrc"]},
    {"name": "PHP", "version": null, "confidence": 100, "categories": ["Programming languages"], "detectedBy": ["implied by WordPress"]}
  ],
  "categories": ["Blogs", "CMS", "Databases", "Font scripts", "Programming languages", "Tag managers", "Web servers"],
  "server": "nginx",
  "redirects": [],
  "htmlTruncated": false,
  "fingerprints": "enthec/webappanalyzer@d91f7e5",
  "detectedAt": "2026-10-20T13:30:00Z"
}

Output fields

Field	Type	Description
url	string	URL as given (normalized).
finalUrl	string or null	URL after redirects.
domain	string or null	Host name of the final URL.
httpStatus	integer or null	HTTP status of the final response.
title	string or null	Page title (emails and phone numbers removed).
technologyCount	integer	Number of technologies reported.
technologies	array	Detected technologies: name, version, confidence, categories, website, cpe, detectedBy.
categories	array	Distinct categories of the detected technologies.
server	string or null	Server response header.
redirects	array	Redirect chain before the final URL.
htmlTruncated	boolean	True if the page was larger than 3 MB and only the first 3 MB was analyzed.
fingerprints	string	Fingerprint database and commit used.
detectedAt	string	When the page was analyzed (ISO 8601, UTC).

Each entry in technologies has name, version (or null), confidence (0–100), categories, website, cpe (when known) and, if includeDetectedBy is on, detectedBy.

The run also saves FAILED_URLS (every URL that wasn't analyzed, with a reason code: robots_disallowed, http_error, rate_limited, network_error, dns_error, blocked_host, invalid_url, not_html) and RUN_STATS in the key-value store.

How much does it cost?

Pay per event. Apify platform usage is included.

Event	Price
Actor start	$0.002 per run (one event per GB of memory; the default 512 MB counts as one)
Analyzed URL (one dataset item)	$0.0015 ($1.50 per 1,000 URLs)

Example: 100 URLs in one run cost $0.002 + $0.15 = $0.152. Failed, blocked and disallowed URLs are not charged.

Use with AI agents, MCP and the API

• MCP: add https://mcp.apify.com?tools=phaux/tech-stack-detector to any MCP client and ask, for example, "what CMS does example.com use?".
• API: POST https://api.apify.com/v2/acts/phaux~tech-stack-detector/run-sync-get-dataset-items with {"urls": ["example.com"]} returns the result directly.
• Output field names and types are documented in the dataset schema.

Data source and compliance

• The Actor reads only the public page you give it, plus that site's /robots.txt. It never logs in, never sends cookies or forms, and needs no API key.
• It obeys robots.txt (RFC 9309) for its user agent PhauxTechStackBot and honours Crawl-delay. Disallowed URLs are skipped and reported as robots_disallowed (not charged).
• It identifies itself honestly (Mozilla/5.0 (compatible; PhauxTechStackBot/0.1; +https://apify.com/phaux/tech-stack-detector)), uses no proxies and no IP rotation, and does nothing to get around bot protection. After an HTTP 429 it doesn't contact that site again during the run.
• Polite pacing: one request at a time per host, at least 1 second apart.
• Only http(s) URLs on public IP addresses are fetched, and redirects are checked at every hop.
• No personal data is collected. Email addresses and phone numbers are removed from page titles.

Limits

• Signals that need JavaScript execution or DNS lookups (js, xhr, dns fingerprints) aren't used, so some client-side-only tools can be missed.
• Only the first 3 MB of HTML is analyzed (htmlTruncated tells you when that happened).
• Up to 5,000 URLs per run. Sites that refuse automated clients (HTTP 403) aren't analyzed and aren't charged.
• License: the fingerprints are © their contributors under GPL-3.0 and are used unmodified. The detection code is independent.

FAQ

• Why did a site fail with HTTP 403? Some sites refuse automated clients. The Actor respects that and doesn't try to evade it, and you aren't charged.
• Can it detect a technology behind a login? No. Only public pages are analyzed.
• Something isn't working? Open an issue on the Issues tab with the run ID.