Website Technology Detection & Tech Stack Scraper

Website technology detection for up to 500 sites per run: CMS, ecommerce platform, analytics, tag managers, frameworks, server, CDN, hosting, payment providers, consent tools, support widgets and more, with the evidence for every single detection. Plus the third-party domains each page talks to. A site whose own robots.txt forbids automated access is skipped and never charged.

Why this scraper

• It respects robots.txt, which no other tech detector in this store does. Before the page is fetched, the target's robots.txt is read with the rules search engines actually use: most specific rule wins, grouped user-agents share their block. A site that says no comes back as a free ROBOTS_DISALLOWED record. If you scan domains you do not own, this is the difference between a defensible dataset and a liability.
• Evidence, not claims. Every detection carries the exact signal behind it: the response header, the cookie name, the meta generator, the script URL or the HTML pattern. You can verify any row in seconds instead of trusting a black box.
• Versions where the site reveals them. nginx/1.24.0, WordPress 6.7.1, jQuery 3.6.0: read from the header or the generator tag, never guessed.
• The third parties too. Every row lists the external domains the page references, from its own URLs and from its Content-Security-Policy. Those are reported as observed domains, not as detected technologies, because a whitelisted domain is not proof of use.
• Flat columns for filtering. cms, ecommerce, server, plus arrays for analytics, frameworks, CDN, payments and consent, so a spreadsheet filter is enough. The full detection list with evidence sits in one column next to them.
• Only delivered sites are charged. Robots refusals, dead domains, timeouts and bot walls come back as free error records. No start fee.

Who this is for

Sales and partner teams qualifying a domain list ("who runs Shopify", "who still uses Universal Analytics"). Agencies auditing a client portfolio. Researchers measuring technology adoption. Security and privacy teams mapping which third parties a set of sites loads.

Who this is not for

Read this before you buy, because this is the honest limit. This actor reads the HTML, the response headers, the cookies and the robots.txt of one page. It does not run JavaScript. On a classic server-rendered site that finds most of the stack; on a JavaScript-heavy single-page app it finds less, because the scripts that would reveal the rest are loaded after the page is parsed. In testing on 13-09-2026 real home pages returned 2 to 7 technologies and 11 to 60 third-party domains. If you need the 20-plus detections a browser-based scanner produces, this is the wrong tool and a browser-based actor is worth its higher price.

The signature set is our own work, currently 177 technologies across 22 categories. It is not a copy of any vendor's database, which is why it is smaller than a commercial one and why every detection ships with its evidence.

Input example

{
    "urls": ["apify.com", "hema.nl", "https://www.shopify.com"],
    "language": "en-US,en;q=0.9",
    "includeEvidence": true
}

Domains or full URLs, both work. The home page is analysed.

Output example

{
    "url": "https://hema.nl",
    "finalUrl": "https://www.hema.nl/",
    "statusCode": 200,
    "technologyCount": 6,
    "technologies": [
        {"name": "Salesforce Commerce Cloud", "category": "Ecommerce", "confidence": "high", "version": null, "evidence": "cookie dwsid"},
        {"name": "Amazon CloudFront", "category": "CDN", "confidence": "high", "version": null, "evidence": "header x-cache: from cloudfront"},
        {"name": "Google Tag Manager", "category": "Tag manager", "confidence": "medium", "version": null, "evidence": "page: googletagmanager.com/gtm.js"}
    ],
    "cms": null,
    "ecommerce": "Salesforce Commerce Cloud",
    "analytics": ["Cloudflare Web Analytics"],
    "tagManagers": ["Google Tag Manager"],
    "frameworks": [],
    "server": null,
    "cdn": ["Amazon CloudFront", "Cloudflare"],
    "hosting": [],
    "paymentProviders": [],
    "consentTools": [],
    "thirdPartyDomains": ["cdn.cquotient.com", "www.googletagmanager.com"],
    "title": "HEMA",
    "generator": null,
    "isHttps": true,
    "redirected": true,
    "pageSizeBytes": 486321,
    "responseTimeMs": 812,
    "robotsRule": "allow /",
    "status": "ok"
}

A site that forbids automated access produces an error record instead, and is not charged:

{
    "input": "example-that-says-no.com",
    "status": "error",
    "errorCode": "ROBOTS_DISALLOWED",
    "error": "https://example-that-says-no.com forbids automated access to its home page (disallow /); skipped and not charged"
}

Error codes: INVALID_URL, ROBOTS_DISALLOWED, FETCH_FAILED, BLOCKED. INPUT_TRUNCATED appears once when your input is longer than this actor accepts.

Related actors from steadydata

• technical-seo-audit: the SEO side of the same pages
• domain-dns-ssl-report: domain, DNS and certificate health
• email-deliverability-report: SPF, DKIM, DMARC and MTA-STS for the same domain

Pricing

Pay per event: one site-analysed event per delivered site. No charge for robots refusals, dead domains, timeouts or bot walls, and no start fee.

Free Apify plan: this actor delivers up to 25 rows per run for accounts on the Apify free plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full size, billed per delivered row, with failed rows never charged.

FAQ

Why would I want it to respect robots.txt? Because a dataset built against a site's stated wishes is a problem you inherit, and because a refusal costs you nothing here. robotsRule records the deciding rule for every row, so your dataset carries the proof that you checked.

Why is server often empty? Because a CDN answers instead of the origin, or the header is stripped. When Cloudflare or CloudFront answers, you see that under cdn.

Why did it not find Google Analytics on a site that clearly has it? Because it is loaded through a tag manager after the page is parsed. This actor reports what the page itself reveals; tagManagers tells you the manager is there.

Can I get the pages behind the home page? Not in this actor: one row is one site's home page. Feed it a list of specific URLs if you need particular pages; each URL is analysed on its own.

Is personal data collected? No. Technologies, headers and domains are properties of a website, not of a person.

What happens when a detection is wrong? Check the evidence field first: it names the exact signal. If a signature is genuinely wrong, it gets fixed, because a false positive costs a buyer more than a miss.