# Website Tech Stack Intelligence (`skootle/website-tech-stack-intelligence`) Actor Explainable website technology fingerprints, confidence evidence, security headers, agent-ready lead qualification, API output, scheduling, and monitoring. - **URL**: https://apify.com/skootle/website-tech-stack-intelligence.md - **Developed by:** [Skootle](https://apify.com/skootle) (community) - **Categories:** Developer tools, Automation, Integrations - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $3.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Website Tech Stack Intelligence ![Website technology intelligence illustration](https://images.unsplash.com/photo-1558494949-ef010cbdcc31?auto=format&fit=crop&w=1200&q=80) ### TL;DR Website Tech Stack Intelligence fingerprints buyer-provided public websites and emits one agent-ready `SUMMARY` row followed by normalized `technology_profile` rows. Each record includes CMS, ecommerce, frontend, analytics, tag-manager, CDN, hosting or server, payment, marketing, consent, and security-header clues where detected. Every technology has confidence and evidence. Detection is explainable and non-exhaustive. Export website technology data, run the Actor via API, schedule and monitor runs, or integrate with other tools. ### What does this website technology detector do? The Actor fetches each supplied public URL within a bounded timeout. It evaluates HTML, script and link URLs, meta tags, cookies when supplied by the response, and optional response headers. It returns stable, normalized rows rather than a black-box label. `technologies` contains category, technology name, confidence, and the matched evidence. `securityHeaders` shows which important browser-security response headers were present, while `missingSecurityHeaders` provides context for review. It is intentionally not an exhaustive inventory. A lack of detection means no supported signal was observed in the fetched response, not proof that a technology is absent. ### Why use website tech-stack intelligence for sales and research? Sales operations can route Shopify, WordPress, Next.js, Stripe, analytics, or consent signals into lead qualification. Agencies can segment prospects by platform. Security teams can use the header context as a review cue without treating it as a security assessment. Agents get source-linked evidence and a confidence level, which makes follow-up decisions reproducible. ### Why choose this Actor? The validated leader shelf had 39 users in 30 days, 506 successful runs, and 32 timeouts. This Actor's buyer-visible wedges are explainable fingerprint evidence, confidence, agent-ready lead qualification, security-header context, and bounded timeout handling. It never claims exhaustive detection, and it fails on a blocked, malformed, or unexpectedly empty source rather than reporting an unexplained empty success. ### Input ```json { "urls": ["https://www.shopify.com", "https://example.com"], "maxUrls": 10, "requestTimeoutSecs": 15, "includeHeaders": true } ```` - `urls`: public buyer-provided website URLs. - `maxUrls`: caps processed inputs from 1 to 100. - `requestTimeoutSecs`: per-URL timeout from 3 to 60 seconds. - `includeHeaders`: includes normalized response headers in the record. Header-derived detection still operates when this field is false. ### How do I identify a website's technology stack? 1. Paste public URLs you are authorized to assess. 2. Start with `maxUrls` equal to the number of prospects you need. 3. Run the Actor and read the first `SUMMARY` row for source status and aggregate signals. 4. Inspect `technologies` for evidence and confidence, not just the technology name. 5. Use `leadQualification` to send a focused follow-up, segment a list, or schedule a verification task. ### Output format Every row includes `schemaVersion`, `recordType`, stable `id`, `sourceUrl`, `retrievedAt`, `fieldCompletenessScore`, and `agentMarkdown`. Timestamps are ISO 8601. Counts are numeric, and enum-like values use lowercase snake case. ```json { "recordType": "summary", "count": 2, "sourceStatus": "success", "technologySignals": 4, "boundedMaxUrls": 10, "domainIntelligence": { "explainableEvidence": true, "nonExhaustiveDetection": true } } ``` ```json { "recordType": "technology_profile", "sourceUrl": "https://www.shopify.com", "statusCode": 200, "technologies": [{ "category": "cms", "name": "shopify", "confidence": 0.9, "evidence": ["cdn.shopify.com"] }], "securityHeaders": { "content-security-policy": true, "x-frame-options": true }, "leadQualification": { "confidence": "medium", "nonExhaustive": true } } ``` ### Worked examples These examples use the actual E2E output shape exercised against `https://www.shopify.com` and `https://example.com`. Technology values can change when a website changes. #### Compare two prospects Input: `{"urls":["https://www.shopify.com","https://example.com"],"maxUrls":2}`. The live E2E run returned three rows: a `summary` and two `technology_profile` records with the two requested source URLs. #### Find ecommerce platform signals Input: `{"urls":["https://www.shopify.com"],"maxUrls":1}`. Inspect `technologies` for entries such as `{category, name, confidence, evidence}` and send the evidence alongside any CRM classification. #### Add security-header context Input: `{"urls":["https://example.com"],"includeHeaders":true}`. Read `securityHeaders`, `missingSecurityHeaders`, and `responseHeaders` as context for a human security review, never as a penetration test. #### Process a bounded prospect batch Input: `{"urls":["https://example.com","https://www.shopify.com","https://example.com"],"maxUrls":2}`. The Actor processes only the first two URLs and the summary mirrors the applied boundary. ### How much does website tech-stack intelligence cost? Live Store pricing is $0.01 per Actor start plus $0.003 per dataset result, displayed as $3.00 per 1,000 results. Apify platform usage is included rather than billed separately. Use `maxUrls` and your Apify run-charge controls to keep each batch within budget. ### How should I interpret technology confidence and evidence? Confidence expresses the strength of an observed public response signal, not a guarantee about every part of a site's architecture. A Shopify asset URL or a Stripe script URL is stronger evidence than a generic server header. Evidence is retained in the row so an agent can explain why it classified a prospect rather than relying on an opaque vendor label. When an evidence string changes after a website release, compare it with the source URL and retrieval time before changing a CRM field. The Actor uses categories such as `cms`, `frontend_framework`, `analytics`, `tag_manager`, `payment`, `marketing`, `consent`, `cdn`, and `hosting_server_clue`. A category may contain several signals, and a website can use more than one category. A detected frontend framework does not identify every library bundled by the site. A detected CDN does not prove who owns the application's infrastructure. When no technology is detected, the profile remains useful: it preserves the response status, generator metadata when present, security-header context, and a low-confidence lead qualification. Absence of a supported signal is not proof of absence. Many sites hide, proxy, compile, or remove implementation clues. ### What can security-header context tell a buyer? The Actor reports whether common browser-facing headers were visible: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. These fields are useful for qualification and review routing. For example, a sales engineering team may prioritize prospects that have a public security-header gap for a consent or security product discussion. This is not a vulnerability scanner, a penetration test, or a compliance verdict. Header selection can be deliberate, values can be delivered by an intermediary, and a complete assessment needs scope, authorization, browser behavior, and qualified review. The Actor therefore describes missing headers as context, not a finding that a website is insecure. ### What are sensible boundaries for a prospect batch? Use `maxUrls` as a hard cap. For a weekly enrichment list, submit only the leads that need a new observation and set the cap to that batch size. For a proof of concept, use the live E2E shape with two inputs. The summary mirrors the bound and aggregate signal count, so downstream jobs can detect when they intentionally processed a sample rather than a complete imported list. Each URL is fetched once with a bounded timeout. The Actor does not crawl the website, submit forms, authenticate, evade a bot challenge, or query third-party enrichment services. These limits keep the behavior predictable and make a timeout or blocked response visible rather than silently retrying until an unknown outcome. ### Troubleshooting a source failure A non-200 response, network error, malformed response, or empty HTML body fails the run. Confirm that the submitted URL is a public page, has a valid protocol, and can be loaded without an account. If a website temporarily rate-limits public requests, wait for the source to recover and run again with the normal bounded timeout. Do not interpret a failure as a missing technology profile. An empty `urls` list is the only expected zero-count case and yields an `expected_no_match` summary. It is useful for workflow validation. A supplied URL that returns no usable HTML is an error because a successful empty technology row would hide a source contract change. ### Integrations and lead scoring workflows Read the `SUMMARY` record first, then store `technology_profile` rows by stable `id`, `sourceUrl`, and `retrievedAt`. A CRM can map strong ecommerce or marketing signals into a segment, but should retain the evidence and numeric confidence in the activity history. A sales agent can use `agentMarkdown` as a concise research note while linking back to the source page. For repeat enrichment, compare new and old `technologies` arrays instead of overwriting them. A disappearing signal can be a website deployment, a consent banner variation, a cache response, or a detection limitation. Treat it as a lead for verification, not a definitive migration event. This approach also makes it easier to audit downstream decisions. ### Can I use these results with an AI agent? Yes. The rows intentionally include a schema version, record type, stable ID, source URL, retrieval time, completeness score, evidence-bearing technologies, security-header context, and compact Markdown. An agent should quote the evidence and confidence in its conclusion, link the source, and state that detection is non-exhaustive. Avoid allowing an autonomous agent to change a prospect record, send outreach, or make a security claim without its own approval and review boundary. ### Limits and responsible use This is a public-response snapshot, not an inventory of a company's infrastructure. Results may differ by region, device, cache, experiment, CDN edge, and deployment. Preserve `retrievedAt` and rerun before presenting a change as current. The Actor does not access authenticated pages, attempt to identify people, collect credentials, or bypass access controls. Use findings as evidence for an authorized follow-up, not as proof of ownership, a security conclusion, or an invitation to contact someone without review. ### Is it legal to identify a public website's tech stack? Use the Actor only on public pages you are authorized to assess. Respect applicable laws, website terms, rate limits, copyright, and privacy obligations. Do not attempt to evade access controls, authentication, paywalls, or bot protections. This Actor is not affiliated with, endorsed by, or sponsored by the websites, platforms, or technologies it may detect. ### FAQ #### Does it identify every technology on a site? No. Detection is non-exhaustive and based on observable response signals. #### What makes a detection explainable? Each result includes a category, name, numeric confidence, and matched evidence. #### Is a missing security header a vulnerability finding? No. It is response-header context that may warrant a qualified review. #### What happens on an HTTP error, blocked response, or malformed HTML? The run fails closed. It does not convert a source failure into an empty successful result. #### What does an expected empty result mean? An empty `urls` list yields a zero-count `expected_no_match` summary. Unexpected empty source content is an error. #### Can I use this in a CRM or lead scoring workflow? Yes. The normalized `leadQualification` and stable row IDs are designed for API and workflow use. #### Does it detect cookies? It reports cookie names when the runtime exposes them in the response. It does not collect credential data. ### Other Skootle actors you might like - [Website SEO Audit Intelligence](https://apify.com/skootle/website-seo-audit-intelligence) for same-origin on-page SEO audits and prioritized fixes. - [Clinical Trials Intelligence](https://apify.com/skootle/clinical-trials-intel) for source-linked research records. ### Support and feedback Use the Actor support channel or an issue with the public input URL, timestamp, run ID, and the observed evidence. Never submit passwords, tokens, or private data. Reviews and requests for evidence-based fingerprints help prioritize additions. # Actor input Schema ## `urls` (type: `array`): Public HTTP or HTTPS website URLs to profile. Private and local network targets are rejected. ## `maxUrls` (type: `integer`): Maximum number of input URLs to profile in one run. ## `requestTimeoutSecs` (type: `integer`): Maximum seconds allowed for each public website request. ## `includeHeaders` (type: `boolean`): Include observed public response headers in each technology profile. ## Actor input object example ```json { "urls": [ "https://example.com", "https://www.shopify.com" ], "maxUrls": 10, "requestTimeoutSecs": 15, "includeHeaders": true } ``` # Actor output Schema ## `results` (type: `string`): Default dataset. The first row is a summary, followed by one technology\_profile row for each profiled URL. ## `agentBriefing` (type: `string`): Markdown briefing derived from the summary row. # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "urls": [ "https://example.com", "https://www.shopify.com" ], "maxUrls": 10, "requestTimeoutSecs": 15, "includeHeaders": true }; // Run the Actor and wait for it to finish const run = await client.actor("skootle/website-tech-stack-intelligence").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "urls": [ "https://example.com", "https://www.shopify.com", ], "maxUrls": 10, "requestTimeoutSecs": 15, "includeHeaders": True, } # Run the Actor and wait for it to finish run = client.actor("skootle/website-tech-stack-intelligence").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "urls": [ "https://example.com", "https://www.shopify.com" ], "maxUrls": 10, "requestTimeoutSecs": 15, "includeHeaders": true }' | apify call skootle/website-tech-stack-intelligence --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=skootle/website-tech-stack-intelligence", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Website Tech Stack Intelligence", "description": "Explainable website technology fingerprints, confidence evidence, security headers, agent-ready lead qualification, API output, scheduling, and monitoring.", "version": "0.0", "x-build-id": "cwwH1hJeAquoDidQe" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/skootle~website-tech-stack-intelligence/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-skootle-website-tech-stack-intelligence", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/skootle~website-tech-stack-intelligence/runs": { "post": { "operationId": "runs-sync-skootle-website-tech-stack-intelligence", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/skootle~website-tech-stack-intelligence/run-sync": { "post": { "operationId": "run-sync-skootle-website-tech-stack-intelligence", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "urls" ], "properties": { "urls": { "title": "Public website URLs", "minItems": 1, "type": "array", "description": "Public HTTP or HTTPS website URLs to profile. Private and local network targets are rejected.", "items": { "type": "string" } }, "maxUrls": { "title": "Maximum URLs", "minimum": 1, "maximum": 100, "type": "integer", "description": "Maximum number of input URLs to profile in one run.", "default": 10 }, "requestTimeoutSecs": { "title": "Request timeout seconds", "minimum": 3, "maximum": 60, "type": "integer", "description": "Maximum seconds allowed for each public website request.", "default": 15 }, "includeHeaders": { "title": "Include response headers", "type": "boolean", "description": "Include observed public response headers in each technology profile.", "default": true } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```