Website Tech Stack Detector — cheap Wappalyzer alternative

Find out what any website is built with: CMS, e‑commerce platform, analytics and marketing tags, JavaScript frameworks, CDN, hosting, web server, email provider and TLS certificate authority. Paste a list of domains, get a clean JSON/CSV/Excel table back.

• 7,600+ technologies from the open-source WebAppAnalyzer fingerprint database (the community-maintained fork of Wappalyzer's rules)
• $3 per 1,000 websites — you pay only for sites that were successfully analyzed. Failed, unreachable and robots.txt‑blocked sites are free.
• Fast: plain HTTP requests, no headless browser. Thousands of domains per run.
• Extra signals other detectors miss: DNS (MX, TXT, NS) and TLS issuer reveal Google Workspace vs Microsoft 365, Cloudflare/Route 53 DNS, Let's Encrypt and more.
• Company SaaS from DNS: domain-verification TXT records reveal tools the company uses beyond the website (Atlassian, Zendesk, Salesforce, DocuSign, Stripe, OpenAI…) — returned in a separate companySaas list, great for B2B lead qualification.
• Polite by default: fetches only the page you give it (plus robots.txt), respects robots.txt, and makes a few public DNS queries and one TLS handshake per domain (can be switched off).

Use cases

• Lead generation & sales prospecting: filter a list of domains to the ones running Shopify, WooCommerce, HubSpot, Salesforce, Klaviyo…
• Competitor research: see which analytics, A/B testing, chat and payment tools competitors use.
• Market sizing: count technology adoption across thousands of sites.
• Agencies & security audits: spot outdated CMS or library versions (version is reported when detectable).
• Data enrichment: add a "tech stack" column to your CRM or spreadsheet via the Apify API, Zapier or Make.

Input

Field	Description	Default
urls	Domains or URLs (example.com, https://example.com/shop)	—
checkDnsAndTls	Look up MX/TXT/NS records and TLS certificate issuer	true
minConfidence	Hide detections below this confidence (0–100)	50
respectRobotsTxt	Skip pages disallowed by robots.txt (not charged)	true
maxConcurrency	Sites analyzed in parallel	10
timeoutSecs	Per-request timeout	20

{
  "urls": ["shopify.com", "wordpress.org", "apify.com"],
  "checkDnsAndTls": true
}

Output

One dataset item per website:

{
  "url": "https://wordpress.org",
  "finalUrl": "https://wordpress.org/",
  "statusCode": 200,
  "technologyCount": 13,
  "technologies": [
    {"name": "WordPress", "version": "7.2", "confidence": 100,
     "categories": ["CMS", "Blogs"], "website": "https://wordpress.org", "implied": false,
     "detectedVia": ["dom", "headers", "html", "meta", "scripts"]},
    {"name": "Nginx", "version": null, "confidence": 100,
     "categories": ["Web servers", "Reverse proxies"], "website": "http://nginx.org/en", "implied": false, "detectedVia": ["headers"]},
    {"name": "PHP", "version": null, "confidence": 100,
     "categories": ["Programming languages"], "website": "http://php.net", "implied": true, "detectedVia": ["implied"]}
  ],
  "companySaas": [
    {"name": "Atlassian Cloud", "categories": ["..."], "website": "https://www.atlassian.com"}
  ],
  "categories": {"CMS": ["WordPress"], "Web servers": ["Nginx"]},
  "dns": {"mx": ["..."], "ns": ["..."]},
  "tlsIssuer": "Let's Encrypt",
  "error": null,
  "durationMs": 1361
}

Download as JSON, CSV, Excel or HTML table, or fetch via API.

Pricing

Pay-per-event: $0.003 per successfully analyzed website ($3 per 1,000). No monthly rental. Sites that fail to load, return an HTTP error, show a bot-protection challenge page or are blocked by robots.txt are not charged. Invalid input lines are reported as free error items. Set Maximum cost per run in run options to cap spending — the Actor stops cleanly at the limit.

How it works and limitations

The Actor downloads the HTML of the given page and matches headers, cookies, meta tags, script URLs, inline scripts, HTML/DOM patterns, DNS records and the TLS certificate against the fingerprint database, then applies implies/excludes rules (e.g. WooCommerce ⇒ WordPress ⇒ PHP).

Because no browser is used, technologies that are only visible after JavaScript runs (some single-page-app frameworks, tags injected by a tag manager) may be missed. Sites behind aggressive bot protection may return an error or a challenge page — those are detected and free. robots.txt is parsed with Python's standard parser (no */$ wildcards). companySaas, dns and tlsIssuer are present only when Check DNS and TLS is on. Duplicate URLs (example.com, EXAMPLE.com/) are analyzed once. Only the URL you provide is fetched; the Actor does not crawl or collect personal data.

FAQ

Is it legal? The Actor reads publicly served page source and public DNS records — the same thing your browser does — and honours robots.txt. You are responsible for how you use the results.

How accurate is it? Detection quality equals the open WebAppAnalyzer rules used by many security and SEO tools. Each match has a confidence score; raise minConfidence for stricter results.

Can I integrate it? Yes — call it from the Apify API, Python/JS clients, Zapier, Make, n8n or schedule it to monitor a list of sites.

Fingerprints: enthec/webappanalyzer, GPL‑3.0.