Website Technology Detection & Tech Stack Scraper

Website technology detection for up to 500 sites per run: CMS, ecommerce platform, analytics, tag managers, frameworks, server, CDN, hosting, payment providers, consent tools, support widgets and more, with the evidence for every single detection. Plus the third-party domains each page talks to. A site whose own robots.txt forbids automated access is skipped and never charged.

Why this scraper

• It respects robots.txt, which no other tech detector in this store does. Before the page is fetched, the target's robots.txt is read with the rules search engines actually use: most specific rule wins, grouped user-agents share their block. A site that says no comes back as a free ROBOTS_DISALLOWED record. If you scan domains you do not own, this is the difference between a defensible dataset and a liability.
• Evidence, not claims. Every detection carries the exact signal behind it: the response header, the cookie name, the meta generator, the script URL or the HTML pattern. You can verify any row in seconds instead of trusting a black box.
• Versions where the site reveals them. nginx/1.24.0, WordPress 6.7.1, jQuery 3.6.0: read from the header or the generator tag, never guessed.
• The third parties too. Every row lists the external domains the page references, from its own URLs and from its Content-Security-Policy. Those are reported as observed domains, not as detected technologies, because a whitelisted domain is not proof of use.
• Flat columns for filtering. cms, ecommerce, server, plus arrays for analytics, frameworks, CDN, payments and consent, so a spreadsheet filter is enough. The full detection list with evidence sits in one column next to them.
• Only delivered sites are charged. Robots refusals, dead domains, timeouts and bot walls come back as free error records. No start fee.

Who this is for

Sales and partner teams qualifying a domain list ("who runs Shopify", "who still uses Universal Analytics"). Agencies auditing a client portfolio. Researchers measuring technology adoption. Security and privacy teams mapping which third parties a set of sites loads.

Who this is not for

Read this before you buy, because this is the honest limit. This actor reads the HTML, the response headers, the cookies and the robots.txt of one page. It does not run JavaScript. On a classic server-rendered site that finds most of the stack; on a JavaScript-heavy single-page app it finds less, because the scripts that would reveal the rest are loaded after the page is parsed. In testing on 13-09-2026 real home pages returned 2 to 7 technologies and 11 to 60 third-party domains. If you need the 20-plus detections a browser-based scanner produces, this is the wrong tool and a browser-based actor is worth its higher price.

The signature set is our own work, currently 177 technologies across 22 categories. It is not a copy of any vendor's database, which is why it is smaller than a commercial one and why every detection ships with its evidence.

Input fields

Field	Type	Required or default	What it does
urls	list of text	required	Domains or URLs, one per row, up to 500 (example: nu.nl or https://www.example.com). The home page is analysed. A site that forbids automated access in its robots.txt is skipped and not charged.
language	text	en-US,en;q=0.9	Language header sent with the request, which decides the language of the page you get back.
includeEvidence	true/false	true	Add the exact signal behind every detection (header, cookie, script URL or HTML pattern). Keep it on if you need to verify or debug a detection; switch it off for a slimmer dataset.

Input example

{
    "urls": ["apify.com", "hema.nl", "https://www.shopify.com"],
    "language": "en-US,en;q=0.9",
    "includeEvidence": true
}

Domains or full URLs, both work. The home page is analysed.

Output example

Field	Type	What it holds	Example
url	text	The site that was examined.	https://apify.com
finalUrl	text	The page that was really read, after every redirect.	https://apify.com/
statusCode	number	The HTTP status the page answered with; anything but 200 means a visitor sees something else.	200
technologyCount	number	How many techniques were found on the page; zero points at a page that blocks reading.	7
technologies	list	Every detection with its category, and with the exact signal behind it when includeEvidence is on.	[{"name": "Amazon CloudFront", "category": "CDN", "confid...
cms	text	Filled when a technology of this kind was detected; empty when the site uses none we recognise.
ecommerce	text	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	Shopify
analytics	list	Filled when the page loads an analytics script directly; a site that loads it through a tag manager shows only the tag manager here.	["Adobe Analytics"]
tagManagers	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["Google Tag Manager"]
frameworks	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["Next.js"]
jsLibraries	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["Bootstrap"]
server	text	Filled when the server names itself in its headers; many sites hide this.
cdn	list	Filled when a content delivery network was detected in the headers or the page.	["Amazon CloudFront"]
hosting	list	Filled when the hosting provider was detected; most sites give no signal for this.
paymentProviders	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["Shop Pay"]
consentTools	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["OneTrust"]
marketingTools	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["HubSpot"]
supportTools	list	Filled when a technology of this kind was detected; empty when the site uses none we recognise.	["Intercom"]
otherTechnologies	list	Filled only when a second technology turns up in a category that holds one name (a second CMS or shop platform); empty for most pages.
title	text	Filled when the page has a title tag.	Apify: Marketplace of ready-to-run tools for AI
metaDescription	text	Filled when the page has a meta description.	Thousands of tools to automate your business. Get real-ti...
generator	text	The meta generator tag, the strongest single signal for a CMS; many sites remove it.
isHttps	true/false	True when the page is served over https.	True
redirected	true/false	True when the final URL differs from the one submitted.	False
pageSizeBytes	number	The size of the page in bytes; a heavy page is slow on a phone.	492175
responseTimeMs	number	How long the server took to answer, in milliseconds.	423
robotsRule	text	The robots.txt rule that decided whether this URL could be fetched, so the choice can be checked.	allow /
thirdPartyDomains	list	Other domains the page loads from; empty for a page that loads everything from itself.	["a.quora.com", "agi.apify.com"]

{
    "url": "https://hema.nl",
    "finalUrl": "https://www.hema.nl/",
    "statusCode": 200,
    "technologyCount": 6,
    "technologies": [
        {"name": "Salesforce Commerce Cloud", "category": "Ecommerce", "confidence": "high", "version": null, "evidence": "cookie dwsid"},
        {"name": "Amazon CloudFront", "category": "CDN", "confidence": "high", "version": null, "evidence": "header x-cache: from cloudfront"},
        {"name": "Google Tag Manager", "category": "Tag manager", "confidence": "medium", "version": null, "evidence": "page: googletagmanager.com/gtm.js"}
    ],
    "cms": null,
    "ecommerce": "Salesforce Commerce Cloud",
    "analytics": ["Cloudflare Web Analytics"],
    "tagManagers": ["Google Tag Manager"],
    "frameworks": [],
    "server": null,
    "cdn": ["Amazon CloudFront", "Cloudflare"],
    "hosting": [],
    "paymentProviders": [],
    "consentTools": [],
    "thirdPartyDomains": ["cdn.cquotient.com", "www.googletagmanager.com"],
    "title": "HEMA",
    "generator": null,
    "isHttps": true,
    "redirected": true,
    "pageSizeBytes": 486321,
    "responseTimeMs": 812,
    "robotsRule": "allow /",
    "status": "ok"
}

A site that forbids automated access produces an error record instead, and is not charged:

{
    "input": "example-that-says-no.com",
    "status": "error",
    "errorCode": "ROBOTS_DISALLOWED",
    "error": "https://example-that-says-no.com forbids automated access to its home page (disallow /); skipped and not charged"
}

Error codes: INVALID_URL, ROBOTS_DISALLOWED, FETCH_FAILED, BLOCKED. INPUT_TRUNCATED appears once when your input is longer than this actor accepts.

Related actors from steadydata

• technical-seo-audit: the SEO side of the same pages
• domain-dns-ssl-report: domain, DNS and certificate health
• email-deliverability-report: SPF, DKIM, DMARC and MTA-STS for the same domain
• Used together with company-career-site-jobs and technical-seo-audit in a recipe: Find companies that are hiring, and see what they run.

Pricing

Pay per event: one site-analysed event per delivered site. No charge for robots refusals, dead domains, timeouts or bot walls, and no start fee.

Free Apify plan: this actor delivers up to 25 rows per run for accounts on the Apify free plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full size, billed per delivered row, with failed rows never charged.

Reviews: if this actor saves you time, a short review on this page is the one thing that helps most. Ratings are what other buyers look at first, and we have no other way to ask.

FAQ

Why would I want it to respect robots.txt? Because a dataset built against a site's stated wishes is a problem you inherit, and because a refusal costs you nothing here. robotsRule records the deciding rule for every row, so your dataset carries the proof that you checked.

Why is server often empty? Because a CDN answers instead of the origin, or the header is stripped. When Cloudflare or CloudFront answers, you see that under cdn.

Why did it not find Google Analytics on a site that clearly has it? Because it is loaded through a tag manager after the page is parsed. This actor reports what the page itself reveals; tagManagers tells you the manager is there.

Can I get the pages behind the home page? Not in this actor: one row is one site's home page. Feed it a list of specific URLs if you need particular pages; each URL is analysed on its own.

Is personal data collected? No. Technologies, headers and domains are properties of a website, not of a person.

What happens when a detection is wrong? Check the evidence field first: it names the exact signal. If a signature is genuinely wrong, it gets fixed, because a false positive costs a buyer more than a miss.

Can I call it from my own code, like an API? Yes. Every run is available through the Apify API: start it with one HTTP request, then read the results as JSON, CSV or Excel from the dataset endpoint, or use the official Python and JavaScript clients. The input is the same JSON as in the input example above, so a scheduled script, a Make or Zapier step or an AI agent can call it without any changes.