Tech Stack Detector - BuiltWith & Wappalyzer Alternative API

This tech stack detector is a bulk website technology lookup and technology detector: paste a list of domains and see what each site is built with, from the CMS, ecommerce platform, frameworks, analytics and ad tools to the CDN, hosting, web server and email provider. It works as an affordable BuiltWith alternative and Wappalyzer alternative, with no subscription or API key, and every technology comes with a confidence score and the evidence that matched.

It checks each site against 7,600+ technology fingerprints (7,695 in the open Wappalyzer rule set as packaged in simple-wappalyzer 1.1.106, released 17 September 2026) plus DNS, email and TLS records. It works over plain HTTP with no headless browser: in a local test on 24 September 2026 45 of 46 domains finished in 25 seconds (a 1,000-site run has not been timed), and 1,000 sites cost $0.20, cheaper than every paid tech stack detector with 2 or more users (checked 9 November 2026).

What you get

• Headline columns, ready for a spreadsheet: cms, ecommerce, javascriptFrameworks, webFrameworks, uiFrameworks, analytics, tagManagers, advertising, marketingAutomation, paymentProcessors, cdn, hosting, webServers, programmingLanguages, databases, security, liveChat, cookieCompliance, abTesting.
• Every technology with proof: name, version (when the site exposes it), confidence 0-100, categories, and the evidence that matched: a response header, a script URL, a cookie, a meta tag, an HTML element or a DNS record. You can check any result yourself.
• Hosting hints: hosting and CDN providers from reverse DNS, CNAME records and response headers (AWS, Google Cloud, Azure, Vercel, Netlify, Shopify, WP Engine, Cloudflare, Fastly, Akamai...), plus IP addresses, Server and X-Powered-By headers.
• Email and DNS: email provider from MX records (Google Workspace, Microsoft 365, Proofpoint, Mimecast...), email senders the domain authorised in SPF (SendGrid, Mailchimp, HubSpot, Salesforce, Klaviyo...), and the DNS provider.
• SaaS tools verified in DNS: many companies verify their domain with tools like Atlassian, OpenAI, Zoom, DocuSign, Adobe or Slack. Those TXT records appear in dnsTechnologies, kept apart from what runs on the website.
• TLS certificate: issuer and expiry date.
• Works behind bot walls: if a site answers with a Cloudflare or Akamai challenge page, you still get what the headers, DNS and TLS reveal, and the row is flagged blocked: true.

Sample output

From that local test run of 24 September 2026 (sample-output.json, one row per website, headline columns):

domain	cms	ecommerce	javascriptFrameworks	cdn	emailProvider
bombas.com	Contentful	Shopify	Next.js, React, styled-components	-	Google Workspace
minimalistbaker.com	WordPress	WooCommerce	-	Cloudflare	Google Workspace
wix.com	Wix	Wix eCommerce	React	Google Cloud CDN	Google Workspace

Use cases

• Lead generation and sales prospecting: find every Shopify, WooCommerce or HubSpot user in a list of domains, then pitch the apps, agencies or integrations that fit their stack.
• Competitor research: see which analytics, A/B testing, CRM and ad tools your competitors run.
• Lead enrichment: add tech stack columns to a CRM export or a scraped company list.
• Market sizing: count the platform share across thousands of sites in a niche.
• Agency and security audits: spot outdated CMS versions, missing HSTS, expiring certificates and forgotten trackers.

Pricing

$0.20 per 1,000 websites (pay per result; failed requests are never charged). Apify platform usage is included. No subscription and no API key. Other detectors on the Store charge, per 1,000 websites: the official BuiltWith actor $2.00; automation-lab's Wappalyzer lookup $0.24 + $0.005 per run and its Tech Stack Detector $2.30 + $0.035 per run; motivational_nickel $1.50 + start; bovi $1.50 + start; rl1987 $1.20; benthepythondev $2.50; datalantern and tugelbay $3.00 + start; apivault_labs $5.00; cerridwen, scrapemint and lergassy's Wappalyzer scraper $10.00; oneary $37.50; lergassy's tech stack detector $50.00; misterkhan and nexgendata $100.00. Cheaper or tied: magicfingers (36 users in 30 days), shahidirfan (6), gocreative.ai (1) and scraper-forge (1) are free; rationalistic_counsel charges $0.01 per row (0 users), jakob_jerich $0.20 (1 user). Some $0.01 actors with 1-2 users add $3-$20 per-site events. Checked in a live Apify Store search on 9 November 2026.

You scrape	You pay
100 websites	$0.02
1,000 websites	$0.20
10,000 websites	$2.00
100,000 websites	$20.00

Plus a $0.00005 start fee per run. The Apify free plan's $5 monthly credit covers about 25,000 websites. The prefilled input (4 websites) took about 8 seconds in a cloud test (24 October 2026) and costs under $0.001.

Why this one

• $0.20 per 1,000 websites: a tenth of the official BuiltWith actor and cheaper than every paid detector with 2 or more users on 9 November 2026 (below automation-lab's $0.24 + $0.005 per run at every list size), with only a $0.00005 start fee, so small daily lists stay cheap too.
• Proof for every detection: the header, script URL, cookie, meta tag or DNS record that matched, so you can check any result.
• Website + DNS + email + TLS in one row: MX email provider, SPF email senders, DNS-verified SaaS tools and the certificate issuer, next to the CMS and frameworks.
• Spreadsheet-ready headline columns (cms, ecommerce, analytics, cdn, hosting...) so you can filter a lead list straight away.
• Bot-walled sites still return a row with what headers, DNS and TLS reveal, flagged blocked: true.

FAQ

Is it legal to scrape a website's tech stack? The actor reads only public information: the public homepage, its HTTP headers, public DNS records and the TLS certificate. It doesn't log in and doesn't collect personal data. You are still responsible for using the results in line with each site's terms of service and privacy laws such as GDPR. This is not legal advice.

Does it need a browser, login, API key or proxy? No. It makes plain HTTPS requests and DNS lookups, which is why it's fast and cheap. No proxy is needed for most sites; turn on Apify Proxy (RESIDENTIAL works best) only if many rows come back blocked: true.

How fast is it and can I analyze 10,000 domains? Yes. Put them all in urls. Sites are analyzed in parallel (20 at a time by default, up to 100); in a local test (24 September 2026) 45 of 46 domains finished in 25 seconds, the 46th being a made-up domain. A 10,000-domain run has not been timed.

How accurate is it? Every match comes with its evidence, so you can check any result. In that 46-domain local test, all 9 Shopify stores and all 9 WordPress sites were identified correctly. Detection is weaker for tools that only load through a tag manager (see Limits).

Can I schedule it or use it via API? Yes: Apify Schedules, the REST API and JavaScript / Python clients, Make, Zapier, n8n, Google Sheets, webhooks, or the Apify MCP server for AI agents.

What does blocked: true mean? The site returned a bot-protection page instead of its real homepage. The row still has everything the headers, DNS and TLS certificate reveal, but page-level tools (CMS, analytics) may be missing.

Is there an official BuiltWith or Wappalyzer API? Yes, both sell one: BuiltWith's API comes with its paid plans, and Wappalyzer's lookup API is credit-based on a monthly plan. This actor is a pay-per-use alternative: no subscription, no key, $0.20 per 1,000 websites.

What does a typical run cost? Enriching a 500-company lead list costs $0.10. A weekly check of 2,000 competitor or prospect sites is $0.40 a week, about $1.75 a month. 100,000 domains for market sizing cost $20.

Why is dnsTechnologies separate? A TXT record like atlassian-domain-verification=... shows the company uses Atlassian, but it doesn't mean Atlassian runs on the website. These are useful for sales prospecting, so they're kept, just apart from the website stack.

How to use

1. Enter websites: paste domains or URLs into Websites, one per line (shopify.com, www.example.com or https://example.com/pricing all work).
2. Click Start: every site is analyzed in parallel, usually in seconds.
3. Download the results as JSON, CSV, Excel or HTML from the Output tab, or call the actor through the Apify API and get the dataset back in your own code.

Input

Field	Default	Description
urls	-	Domains or URLs, one per line: shopify.com, www.example.com, https://example.com/pricing
includeDns	true	MX, TXT/SPF, NS, CNAME, A/PTR and TLS lookups (email provider, DNS provider, hosting hints, SaaS verifications). No extra web requests.
includeEvidence	true	Show what matched for every technology. Turn off for smaller output.
minConfidence	0	Drop technologies below this confidence (0-100)
includeFailed	true	Save a free row with the error for sites that could not be loaded
maxConcurrency	20	Sites analyzed in parallel
maxRequestRetries	3	Retries for timeouts, 5xx errors and bot walls
requestTimeoutSecs	30	Per-page timeout
proxyConfiguration	off	Not needed for most sites. Turn on Apify Proxy (RESIDENTIAL works best) if many rows come back blocked: true.

Bare domains are tried over https:// first, then http://. If a domain doesn't resolve, the actor also tries it with or without www. before giving up.

Input example

{
    "urls": ["allbirds.com", "minimalistbaker.com", "nextjs.org", "https://www.hubspot.com"],
    "includeDns": true,
    "includeEvidence": true,
    "minConfidence": 50
}

Example inputs for common jobs

• Find Shopify and WooCommerce stores in a lead list (10,000 domains about $3.00): paste the domains as urls, "includeEvidence": false, then filter the ecommerce column.
• Agency prospecting, WordPress sites with no analytics: "minConfidence": 50, then filter cms = WordPress with an empty analytics column.
• Email provider and SaaS stack for sales intel: keep "includeDns": true; emailProvider (Google Workspace, Microsoft 365) and DNS-verified tools come from MX / TXT records with no extra page loads.
• Bot-walled enterprise sites: turn on Apify Proxy (RESIDENTIAL) only if many rows come back blocked: true.

Output example

One dataset item per website. This one is from a real run on minimalistbaker.com (the technologies array is shortened to 3 of 26 entries):

{
    "inputUrl": "minimalistbaker.com",
    "url": "https://minimalistbaker.com/",
    "domain": "minimalistbaker.com",
    "statusCode": 200,
    "blocked": false,
    "pageTitle": "Minimalist Baker - Simple Recipes That Make You Feel Good",
    "technologyCount": 26,
    "technologyNames": ["Adobe Fonts", "Amazon Advertising", "Cloudflare", "Font Awesome", "Genesis theme", "Google Analytics", "Google Tag Manager", "HSTS", "Instagram Feed for WordPress", "jQuery", "MySQL", "Open Graph", "PHP", "Popup Maker", "RSS", "WooCommerce", "WordPress", "Yoast SEO", "..."],
    "dnsTechnologies": ["Google Workspace"],
    "cms": ["WordPress"],
    "pageBuilders": ["WordPress Block Editor"],
    "ecommerce": ["WooCommerce"],
    "javascriptFrameworks": [],
    "javascriptLibraries": ["jQuery", "Mailcheck", "mobile-detect.js", "punycode"],
    "analytics": ["Google Analytics"],
    "tagManagers": ["Google Tag Manager"],
    "advertising": ["Amazon Advertising"],
    "cdn": ["Cloudflare"],
    "programmingLanguages": ["PHP"],
    "databases": ["MySQL"],
    "security": ["HSTS"],
    "hostingProviders": ["Cloudflare"],
    "server": "cloudflare",
    "poweredBy": null,
    "tlsIssuer": "Google Trust Services / WE1",
    "tlsExpires": "2026-12-04T21:16:49.000Z",
    "emailProvider": "Google Workspace",
    "emailSenders": [],
    "dnsProvider": null,
    "ipAddresses": ["172.66.168.11", "104.20.42.232"],
    "ipv6": true,
    "reverseDns": [],
    "nameservers": ["b.minimalistbaker.com", "m.minimalistbaker.com"],
    "mxRecords": ["aspmx.l.google.com", "alt1.aspmx.l.google.com", "..."],
    "technologies": [
        {
            "name": "Cloudflare",
            "version": null,
            "confidence": 100,
            "categories": ["CDN"],
            "website": "https://www.cloudflare.com",
            "source": "website",
            "evidence": [
                { "type": "headers", "key": "server", "match": "cloudflare" },
                { "type": "headers", "key": "cf-ray", "match": "a3ff5b60c8d35414-IAD" },
                { "type": "dns", "key": "soa", "match": ".cloudflare.com" }
            ]
        },
        {
            "name": "Amazon Advertising",
            "version": null,
            "confidence": 100,
            "categories": ["Advertising"],
            "website": "https://advertising.amazon.com",
            "source": "website",
            "evidence": [{ "type": "scriptSrc", "match": ".amazon-adsystem.com" }]
        },
        {
            "name": "Adobe Fonts",
            "version": null,
            "confidence": 100,
            "categories": ["Font scripts"],
            "website": "https://fonts.adobe.com",
            "source": "website",
            "evidence": [{ "type": "dom", "key": "link[href*='use.typekit.net'], link[href*='use.typekit.com']", "match": "element present" }]
        }
    ],
    "responseTimeMs": 1639,
    "redirected": false,
    "error": null,
    "scrapedAt": "2026-09-24T05:23:24.827Z"
}

The dataset has three ready-made views: Overview (the headline stack per site), Marketing stack (analytics, ads, CRM, payments, SaaS tools) and Infrastructure (server, CDN, hosting, DNS, IP, TLS).

source tells you where a technology was seen: website (the page, its headers or cookies) or dns (DNS records only, for example a TXT verification record). The summary columns only use website matches, so a company that merely verified its domain with a tool doesn't show up as running it on the site.

Test results (real run: 46 domains, mixed Shopify stores, WordPress blogs, SaaS, news and big retail sites)

• 45 of 46 analyzed in 25 seconds on a laptop. The one failure was a domain that doesn't exist, returned as a free error row.
• 1 site (g2.com) sat behind a bot wall and was still analyzed from headers, DNS and TLS (22 technologies).
• All 9 Shopify stores and all 9 WordPress sites in the test were identified correctly.
• Median 11 website technologies per site (max 25).

Field	Fill rate
technologyNames, ipAddresses	100%
tlsIssuer	98%
emailProvider	96%
server	84%
dnsProvider	84%
hostingProviders	73%
emailSenders (SPF)	64%
cdn	58%
javascriptFrameworks	42%
tagManagers	42%
cms	40% (many big sites run custom code with no CMS)
ecommerce	27% (only the stores)
analytics	27% (see Limits)

API example

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("rel8ble/website-tech-stack-detector").call(run_input={"urls": ["allbirds.com", "techcrunch.com", "nextjs.org"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["domain"], item["cms"], item["ecommerce"], item["analytics"])

One HTTP call that runs the actor and returns the rows (curl):

curl -X POST "https://api.apify.com/v2/acts/rel8ble~website-tech-stack-detector/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["allbirds.com", "techcrunch.com", "nextjs.org"]}'

Integrations

• Make, Zapier and n8n: run the actor from your workflows and pass the tech stack columns to your CRM or outreach tools.
• Google Sheets: export the dataset straight to a sheet, or schedule runs that keep a sheet up to date.
• Apify API: start runs and fetch results over REST, or with the JavaScript and Python API clients.
• Webhooks: get notified (or trigger your own endpoint) when a run finishes.
• MCP for AI agents: the Apify MCP server at https://mcp.apify.com lets Claude, ChatGPT, Cursor and other AI agents call this actor as a tool, for example "what CMS and analytics does this list of sites use?".

Limits (read before large runs)

• Homepage only. The actor analyzes the page you give it (after redirects). A tool that only loads on the checkout or blog page won't be seen unless you pass that URL too.
• No JavaScript execution. Technologies that only appear after scripts run in a browser can be missed. The biggest case is analytics tags loaded through Google Tag Manager: the actor sees GTM, but not always the Google Analytics, Hotjar or Meta Pixel tags inside the container. Tags written directly into the page (the usual gtag, fbq, Clarity, Hotjar, TikTok and Pinterest snippets) are detected.
• Bot walls. Some large sites (G2, Indeed, some banks) answer automated requests with a challenge page. You still get headers, DNS and TLS data with blocked: true. A RESIDENTIAL proxy lets more of them through.
• Fingerprints are signatures, not certainty. Each technology has a confidence score and evidence. A few generic rules (for example "Cart Functionality", which only means "has a checkout link") are kept in technologies but left out of the summary columns. Use minConfidence: 50 for the strictest list.
• Hosting hints are hints. When a site sits behind a CDN like Cloudflare, the origin host is hidden, and the actor reports the CDN.

How it works (for developers)

Each site gets one HTTP request, with browser-like headers and retries, plus DNS lookups (MX, TXT, NS, SOA, CNAME, A, PTR) and one TLS handshake. The response headers, cookies, meta tags, script URLs, inline scripts, CSS, page text and DNS records are matched against the Wappalyzer fingerprint rules. DOM rules are evaluated with cheerio instead of a browser, and a one-pass Aho-Corasick prefilter skips selectors that can't match, so analysis takes about 0.3 seconds per page. Excludes, implies (WordPress implies PHP and MySQL, for example) and parent-dependent technologies are resolved the same way Wappalyzer does.

Run it locally:

npm install
npm test                                              # detection tests
APIFY_LOCAL_STORAGE_DIR=./storage node src/main.js    # input in storage/key_value_stores/default/INPUT.json

Fingerprint data: the open Wappalyzer rule set (GPL-3.0) via the simple-wappalyzer package.

Python and Node examples

Step-by-step tutorial with runnable Python code (MIT): https://github.com/Rel8ble/website-tech-stack-detector-python

Need a custom scraper or a ready dataset? Hire me on Fiverr: https://www.fiverr.com/rel8ble