# Website Technology Detection & Tech Stack (`steadydata/website-tech-stack`) Actor

Website technology detection for up to 500 sites per run: CMS, ecommerce, analytics, tag managers, frameworks, server, CDN, payments and consent tools, with the evidence for every detection plus the third-party domains. Skips sites their robots.txt forbids, free of charge.

- **URL**: https://apify.com/steadydata/website-tech-stack.md
- **Developed by:** [Steadydata Team](https://apify.com/steadydata) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $35.00 / 1,000 site analyseds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Technology Detection & Tech Stack Scraper

Website technology detection for up to **500 sites per run**: CMS, ecommerce platform,
analytics, tag managers, frameworks, server, CDN, hosting, payment providers, consent
tools, support widgets and more, with **the evidence for every single detection**. Plus
the third-party domains each page talks to. **A site whose own robots.txt forbids
automated access is skipped and never charged.**

### Why this scraper

- **It respects robots.txt, which no other tech detector in this store does.** Before the
  page is fetched, the target's robots.txt is read with the rules search engines actually
  use: most specific rule wins, grouped user-agents share their block. A site that says no
  comes back as a free `ROBOTS_DISALLOWED` record. If you scan domains you do not own, this
  is the difference between a defensible dataset and a liability.
- **Evidence, not claims.** Every detection carries the exact signal behind it: the
  response header, the cookie name, the meta generator, the script URL or the HTML
  pattern. You can verify any row in seconds instead of trusting a black box.
- **Versions where the site reveals them.** `nginx/1.24.0`, `WordPress 6.7.1`,
  `jQuery 3.6.0`: read from the header or the generator tag, never guessed.
- **The third parties too.** Every row lists the external domains the page references,
  from its own URLs and from its Content-Security-Policy. Those are reported as observed
  domains, not as detected technologies, because a whitelisted domain is not proof of use.
- **Flat columns for filtering.** `cms`, `ecommerce`, `server`, plus arrays for analytics,
  frameworks, CDN, payments and consent, so a spreadsheet filter is enough. The full
  detection list with evidence sits in one column next to them.
- **Only delivered sites are charged.** Robots refusals, dead domains, timeouts and bot
  walls come back as free error records. No start fee.

### Who this is for

Sales and partner teams qualifying a domain list ("who runs Shopify", "who still uses
Universal Analytics"). Agencies auditing a client portfolio. Researchers measuring
technology adoption. Security and privacy teams mapping which third parties a set of
sites loads.

### Who this is not for

**Read this before you buy, because this is the honest limit.** This actor reads the HTML,
the response headers, the cookies and the robots.txt of one page. It does not run
JavaScript. On a classic server-rendered site that finds most of the stack; on a
JavaScript-heavy single-page app it finds less, because the scripts that would reveal the
rest are loaded after the page is parsed. In testing on 13-09-2026 real home pages
returned 2 to 7 technologies and 11 to 60 third-party domains. If you need the 20-plus
detections a browser-based scanner produces, this is the wrong tool and a browser-based
actor is worth its higher price.

The signature set is our own work, currently 177 technologies across 22 categories. It is
not a copy of any vendor's database, which is why it is smaller than a commercial one and
why every detection ships with its evidence.

### Input example

```json
{
    "urls": ["apify.com", "hema.nl", "https://www.shopify.com"],
    "language": "en-US,en;q=0.9",
    "includeEvidence": true
}
```

Domains or full URLs, both work. The home page is analysed.

### Output example

```json
{
    "url": "https://hema.nl",
    "finalUrl": "https://www.hema.nl/",
    "statusCode": 200,
    "technologyCount": 6,
    "technologies": [
        {"name": "Salesforce Commerce Cloud", "category": "Ecommerce", "confidence": "high", "version": null, "evidence": "cookie dwsid"},
        {"name": "Amazon CloudFront", "category": "CDN", "confidence": "high", "version": null, "evidence": "header x-cache: from cloudfront"},
        {"name": "Google Tag Manager", "category": "Tag manager", "confidence": "medium", "version": null, "evidence": "page: googletagmanager.com/gtm.js"}
    ],
    "cms": null,
    "ecommerce": "Salesforce Commerce Cloud",
    "analytics": ["Cloudflare Web Analytics"],
    "tagManagers": ["Google Tag Manager"],
    "frameworks": [],
    "server": null,
    "cdn": ["Amazon CloudFront", "Cloudflare"],
    "hosting": [],
    "paymentProviders": [],
    "consentTools": [],
    "thirdPartyDomains": ["cdn.cquotient.com", "www.googletagmanager.com"],
    "title": "HEMA",
    "generator": null,
    "isHttps": true,
    "redirected": true,
    "pageSizeBytes": 486321,
    "responseTimeMs": 812,
    "robotsRule": "allow /",
    "status": "ok"
}
```

A site that forbids automated access produces an error record instead, and is **not**
charged:

```json
{
    "input": "example-that-says-no.com",
    "status": "error",
    "errorCode": "ROBOTS_DISALLOWED",
    "error": "https://example-that-says-no.com forbids automated access to its home page (disallow /); skipped and not charged"
}
```

Error codes: `INVALID_URL`, `ROBOTS_DISALLOWED`, `FETCH_FAILED`, `BLOCKED`. `INPUT_TRUNCATED` appears once when your input is longer than this actor accepts.

### Related actors from steadydata

- [technical-seo-audit](https://apify.com/steadydata/technical-seo-audit): the SEO side of the same pages
- [domain-dns-ssl-report](https://apify.com/steadydata/domain-dns-ssl-report): domain, DNS and certificate health
- [email-deliverability-report](https://apify.com/steadydata/email-deliverability-report): SPF, DKIM, DMARC and MTA-STS for the same domain

### Pricing

Pay per event: one `site-analysed` event per delivered site. No charge for robots
refusals, dead domains, timeouts or bot walls, and no start fee.

**Free Apify plan:** this actor delivers up to 25 rows per run for accounts on the Apify free
plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the
actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full
size, billed per delivered row, with failed rows never charged.

**Reviews:** if this actor saves you time, a short review on this page is the one thing that
helps most. Ratings are what other buyers look at first, and we have no other way to ask.

### FAQ

**Why would I want it to respect robots.txt?**
Because a dataset built against a site's stated wishes is a problem you inherit, and
because a refusal costs you nothing here. `robotsRule` records the deciding rule for every
row, so your dataset carries the proof that you checked.

**Why is `server` often empty?**
Because a CDN answers instead of the origin, or the header is stripped. When Cloudflare or
CloudFront answers, you see that under `cdn`.

**Why did it not find Google Analytics on a site that clearly has it?**
Because it is loaded through a tag manager after the page is parsed. This actor reports
what the page itself reveals; `tagManagers` tells you the manager is there.

**Can I get the pages behind the home page?**
Not in this actor: one row is one site's home page. Feed it a list of specific URLs if you
need particular pages; each URL is analysed on its own.

**Is personal data collected?**
No. Technologies, headers and domains are properties of a website, not of a person.

**What happens when a detection is wrong?**
Check the `evidence` field first: it names the exact signal. If a signature is genuinely
wrong, it gets fixed, because a false positive costs a buyer more than a miss.

# Changelog

This Actor's version history is a separate document: https://apify.com/steadydata/website-tech-stack/changelog.md

# Actor input Schema

## `urls` (type: `array`):

Domains or URLs, one per row, up to 500 (example: nu.nl or https://www.example.com). The home page is analysed. A site that forbids automated access in its robots.txt is skipped and not charged.

## `language` (type: `string`):

Language header sent with the request, which decides the language of the page you get back.

## `includeEvidence` (type: `boolean`):

Add the exact signal behind every detection (header, cookie, script URL or HTML pattern). Keep it on if you need to verify or debug a detection; switch it off for a slimmer dataset.

## Actor input object example

```json
{
  "urls": [
    "apify.com",
    "nu.nl",
    "shopify.com"
  ],
  "language": "en-US,en;q=0.9",
  "includeEvidence": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "apify.com",
        "nu.nl",
        "shopify.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("steadydata/website-tech-stack").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "apify.com",
        "nu.nl",
        "shopify.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("steadydata/website-tech-stack").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "apify.com",
    "nu.nl",
    "shopify.com"
  ]
}' |
apify call steadydata/website-tech-stack --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,steadydata/website-tech-stack"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Nc2FNNZO6JfdeOUcQ/builds/DIKrWcBhaiAErN7iq/openapi.json