Website Tech Stack Detector – CMS, Frameworks, Analytics & SaaS

Find out what any website is built with. For each URL you get the detected technologies with category, version (when visible) and confidence, grouped by category:

• CMS and ecommerce: WordPress, Shopify, Drupal, Wix, Webflow, Magento, WooCommerce...
• Frameworks: React, Next.js, Vue, Nuxt, Angular, Astro, Svelte, Tailwind, Bootstrap...
• Analytics, tag managers and marketing tools: Google Analytics, GTM, HubSpot, Hotjar, Meta Pixel, LinkedIn Insight...
• CDN, hosting and web servers: Cloudflare, Fastly, CloudFront, Vercel, Netlify, Nginx, Apache...
• Payments, chat, A/B testing, consent managers, fonts, security headers and more.
• With DNS checks on: email provider (Google Workspace, Microsoft 365...), DNS provider, and SaaS tools the company verified its domain with (Atlassian, DocuSign, Miro...).

Uses for this data:

• Lead generation: find every prospect running Shopify plus Klaviyo.
• Sales qualification: see a prospect's stack before the call.
• Competitor research and market sizing.
• Security inventories: spot outdated library versions.
• AI agents that need structured facts about a company's website.

Why this one

• $1.20 per 1,000 websites. That's cheaper than the popular alternatives ($1.50–$100 per 1,000).
• 7,600+ technology fingerprints from the open-source webappanalyzer project, a maintained fork of the Wappalyzer database. It matches headers, cookies, HTML, script URLs, inline scripts, meta tags, DOM selectors and DNS records.
• Fast and light. One HTTP request per site (plus DNS) with no headless browser, so large lists finish quickly.
• Polite by default. It respects robots.txt and fetches only the page you list (no crawling). It identifies itself in the User-Agent and uses timeouts.
• Clean errors. Blocked or unreachable sites (HTTP_403, DNS_NOT_FOUND, TIMEOUT, BLOCKED_BY_ROBOTS_TXT) are reported and not charged.

Input

Field	Default	Description
urls	–	Website URLs or domains (required). Up to 10,000 per run.
checkDns	true	Also detect from MX/TXT/NS/CNAME records.
minConfidence	50	Hide lower-confidence detections.
includeEvidence	false	Show where each technology was found.
respectRobotsTxt	true	Skip pages disallowed by robots.txt.
maxConcurrency	5	Websites analysed in parallel.
timeoutSecs	20	Per website.

{ "urls": ["https://wordpress.org/news/", "getbootstrap.com", "apify.com"] }

Output

One dataset row per website (shortened):

{
  "input": "wordpress.org/news/",
  "finalUrl": "https://wordpress.org/news/",
  "domain": "wordpress.org",
  "statusCode": 200,
  "title": "WordPress News – The latest news about WordPress and the WordPress community",
  "technologyCount": 12,
  "technologies": [
    { "name": "WordPress", "categories": ["CMS", "Blogs"], "version": "7.2", "confidence": 100, "website": "https://wordpress.org", "saas": true, "openSource": true, "pricing": ["low", "recurring", "freemium"] },
    { "name": "Google Tag Manager", "categories": ["Tag managers"], "version": null, "confidence": 100, "website": "https://www.google.com/tagmanager", "saas": true },
    { "name": "Nginx", "categories": ["Web servers", "Reverse proxies"], "version": null, "confidence": 100, "website": "https://nginx.org/en" }
  ],
  "byCategory": { "CMS": ["WordPress"], "Tag managers": ["Google Tag Manager"], "Web servers": ["Nginx"], "Programming languages": ["PHP"] },
  "server": "nginx",
  "status": "ok"
}

Errors and summary:

• Failed sites get "status": "error" with errorCode and error. Technologies visible in an error response (e.g. a Cloudflare block page) are still listed.
• A run summary is saved as OUTPUT.

Pricing

Pay per event, plus a tiny Actor start fee ($0.00005 per GB of memory):

• Website analyzed: $0.0012 per website ($1.20 per 1,000 websites), DNS checks included.

Platform usage is included in the price. Invalid URLs, duplicates, unreachable sites, HTTP errors (4xx/5xx) and robots.txt-blocked pages are not charged. If you set a maximum cost per run, the Actor stops when it is reached.

Limitations (honest)

• No browser. JavaScript is not executed, so tools injected only at runtime (some tag-manager payloads, client-side A/B tests) and JS-global fingerprints can be missed. Server-side and static signals, which are most of them, are covered.
• One page per site. Analyse the homepage or the page you care about; technologies used only on other pages (e.g. checkout) may not appear.
• Confidence is pattern-based. DNS verification records show a company uses a SaaS tool, not that the website does.
• Sites behind aggressive bot protection may answer 403/503. These are reported and not charged.
• Fingerprint licence. The data comes from webappanalyzer (GPL-3.0). This Actor is distributed under GPL-3.0-or-later.

FAQ

How fresh are the fingerprints? They are bundled from the webappanalyzer repository and refreshed with Actor updates (current snapshot: September 2026).

Can I check many pages of the same site? Yes. List each URL separately; each is one event.