Website Technology & Tracking Tag Change Monitor

Detect a website's technology stack and tracking tags, save a private baseline, and see what was added or removed on later runs.

Quick start

Snapshot a public page:

{
  "websites": ["https://example.com"],
  "mode": "snapshot"
}

Monitor changes on a schedule:

{
  "websites": ["https://example.com"],
  "mode": "compare",
  "monitorKey": "use-a-private-random-value-at-least-16-characters"
}

The monitor key is encrypted by Apify. Reuse the same value for later scheduled runs. Never put passwords, tokens, or cookies in URLs.

What it detects

The versioned signature registry covers common CMS, ecommerce, website builders, JavaScript frameworks, analytics, tag managers, advertising pixels, CRM/chat, consent tools, payments, monitoring, CDN, and hosting signals. Examples include WordPress, Shopify, Next.js, React, Google Tag Manager, Google Analytics, Meta Pixel, TikTok Pixel, HubSpot, OneTrust, Stripe, Sentry, Cloudflare, and Vercel.

Each technology contains:

• stable ID and name
• category
• confidence
• compact evidence labels when enabled

This HTTP-first beta inspects response headers, returned HTML, declared scripts/resources, and cookie names. It does not claim a declared tracking tag actually fired in a real browser.

Snapshot and compare behavior

In snapshot mode, the Actor returns current detections without persistent monitoring state.

In compare mode:

1. The first successful run creates a baseline.
2. The next run loads that baseline.
3. Output reports technologies and third-party domains added, removed, or changed.
4. The successful current snapshot becomes the next baseline.

State identity includes a cryptographic hash of the secret monitor key, domain, signature version, and representative paths. The secret itself is never stored in output.

Output

One summary row is produced per domain. Successful rows contain:

{
  "recordType": "summary",
  "success": true,
  "domain": "example.com",
  "technologyCount": 1,
  "technologies": [{"id": "cloudflare", "name": "Cloudflare", "category": "CDN and security", "confidence": "medium"}],
  "changes": {
    "added": [],
    "removed": [],
    "changed": [],
    "domainsAdded": [],
    "domainsRemoved": [],
    "counts": {"added": 0, "removed": 0, "changed": 0, "domainsAdded": 0, "domainsRemoved": 0}
  }
}

Failures have fixed error codes and are not charged: INVALID_INPUT, INVALID_URL, MONITOR_KEY_REQUIRED, NETWORK_BLOCKED, UNSUPPORTED_CONTENT, RESPONSE_TOO_LARGE, TOO_MANY_REDIRECTS, REQUEST_TIMEOUT, or SCAN_FAILED.

Pricing

The launch hypothesis is US$0.012 per successfully completed domain scan. Failed domains are not charged. The synthetic Actor-start event uses Apify's recommended default. The run-level maxTotalChargeUsd remains authoritative, and maxUserChargeUsd provides an additional input-side domain cap.

Examples before Store discounts:

• 10 successful domains: about US$0.12 plus the small startup event.
• 100 successful domains: about US$1.20 plus the startup event.
• A failed domain: no completed-domain-scan event.

Limits and safety

• Up to 50 websites per run.
• One to five same-domain pages per website.
• Maximum 10 concurrent domains.
• Response body maximum 5 MB per page; default 2 MB.
• Request timeout 5-60 seconds; default 20.
• Public HTTP(S) ports 80/443 only.
• Private and special networks are blocked and redirects are rechecked.
• Credentials, cookie values, authorization headers, query strings, and response bodies are not written to output.
• HTTP-only detection can miss technologies injected only after JavaScript execution and may report a declared integration that is inactive.

Use cases

• Monitor when a competitor adds or removes analytics or advertising tags.
• Find websites using a technology and export auditable evidence.
• Track weekly SaaS technology-stack changes.
• Audit agency or lead lists for CMS, payment, consent, and marketing tools.

Ready-to-use examples

• examples/01-technology-audit.json scans two domains with evidence.
• examples/02-weekly-change-monitor.json creates and updates a private comparison baseline.
• examples/03-multi-page-stack-scan.json checks a homepage and one representative path.

Support

Include the Actor run ID, a public reproduction URL, mode, and unexpected technology ID. Never post monitor keys, API tokens, cookies, or private-site data.