Tech Stack Detector: CMS, Ecommerce, Analytics, Payments

Find out what any website is built with. Give it a list of domains and get back, for each one, the CMS, ecommerce platform, analytics and tag managers, payment providers, live chat widgets, JavaScript and web frameworks, CDN, hosting and web server, with versions where the site exposes them.

Built for sales teams and lead generation agencies that qualify prospects by technology ("all Shopify stores using Klaviyo", "WordPress sites without a chat widget"), and for anyone auditing a list of sites.

What it does

• Fetches each domain's public home page and response headers, plus its robots.txt, and matches them against about 3,600 technology fingerprints (headers, cookie names, meta tags, script sources, inline scripts, HTML and page structure).
• Returns handy summary columns (cms, ecommerce, analytics, payments, liveChat and more) and the full list of detections with version, confidence and category.
• Fast and cheap: no browser is started, so thousands of domains run in minutes.
• Polite: normally one home page request plus robots.txt per domain, honest user agent, robots.txt respected by default. Extra requests happen only when needed: retries with backoff on rate limits, server errors and timeouts, a fallback from https to http when https cannot be reached, and one retry with a second honest user agent after a 403.
• No login, no cookies sent, no personal data collected.

Input example

{
    "domains": ["allbirds.com", "wordpress.org", "https://www.squarespace.com/"],
    "respectRobotsTxt": true,
    "minConfidence": 50,
    "includeAllTechnologies": true,
    "maxConcurrency": 5,
    "requestTimeoutSecs": 20
}

Field	What it means
domains	Domains or URLs, one per line. Only the home page is checked. Duplicates are removed.
respectRobotsTxt	Skip a domain whose robots.txt forbids crawlers from the home page. Skipped domains are not charged.
minConfidence	Only report detections at or above this confidence (0 to 100).
includeAllTechnologies	Include the full detection list. Turn off for a compact table.
maxConcurrency	Domains checked in parallel (1 to 20).
requestTimeoutSecs	Give up on a slow site after this many seconds.

Output example

One row per domain (shortened here).

{
    "domain": "allbirds.com",
    "finalUrl": "https://www.allbirds.com/",
    "statusCode": 200,
    "title": "Allbirds: Comfortable, Sustainable Shoes & Apparel",
    "technologyCount": 9,
    "cms": [],
    "ecommerce": ["Shopify"],
    "analytics": [],
    "tagManagers": ["Google Tag Manager"],
    "payments": ["PayPal", "Apple Pay"],
    "liveChat": [],
    "cdn": ["Cloudflare"],
    "security": ["HSTS"],
    "technologies": [
        { "name": "Shopify", "version": null, "confidence": 100, "categories": ["Ecommerce"], "website": "http://shopify.com" },
        { "name": "PayPal", "version": null, "confidence": 100, "categories": ["Payment processors"], "website": "https://paypal.com" }
    ],
    "possiblyBlocked": false,
    "error": null,
    "checkedAt": "2026-09-27T05:45:12.000Z"
}

Summary columns in every row: cms, ecommerce, analytics, tagManagers, payments, liveChat, marketingAutomation, crm, advertising, jsFrameworks, webFrameworks, uiFrameworks, jsLibraries, cdn, hosting, webServers, programmingLanguages, security, cookieCompliance, abTesting, reviews.

Pricing

Pay per result: $2 per 1,000 domains analyzed ($0.002 each), plus Apify's standard start event at $0.00005 per run. You are charged only when the site actually served its home page. Domains that do not resolve, time out, answer with an HTTP status of 400 or above (most blocks do), or are skipped because of robots.txt are free. A bot check page served with status 200 counts as a served page and is charged.

Limits

• Static analysis only. Tools that are injected later by a tag manager (for example Google Analytics loaded through Google Tag Manager, or a chat widget loaded on scroll) do not appear in the page source and may be missed. The tag manager itself is detected.
• Only the home page is checked. A shop that lives on a subdomain (shop.example.com) should be entered separately.
• Some large sites put bot walls in front of every automated visitor. When the wall answers with a status of 400 or above, the row comes back with the HTTP status, whatever could be read from the headers, and no charge; it is flagged possiblyBlocked: true for a 403 or 503, or when the page mentions a captcha, challenge or access denied. A wall that serves its challenge page with status 200 is not detected: that row is charged, is not flagged, and usually lists few technologies.
• The fingerprint set is a fixed snapshot of the open source Wappalyzer database (version 6.10.54, MIT license). Technologies launched since early 2023 may be missing or named differently.

FAQ

How is this different from BuiltWith or Wappalyzer? Same idea, pay as you go, no subscription, and bulk friendly. You pay a fraction of a cent per domain.

Can I check thousands of domains? Yes. Raise maxConcurrency to 10 or 20 for large lists.

Why is a technology I know the site uses missing? Most often it is loaded by JavaScript after the page opens. See Limits.

Does it store anything about people? No. It reads public pages and headers and returns technology names only.

Something looks wrong. Open an issue on the Issues tab with the domain and what you expected.

Credits and license

Technology fingerprints and the matching engine come from Wappalyzer 6.10.54, the last release published under the MIT license (Copyright Elbert Alias and Wappalyzer contributors). The license text ships with the actor in vendor/wappalyzer/LICENSE.txt. This actor is not affiliated with Wappalyzer, BuiltWith or any vendor it detects. All product names are trademarks of their owners.