Tech Stack Detector: BuiltWith & Wappalyzer alternative (bulk domains)

Paste in a list of domains and get each site's technology stack back as clean JSON: CMS, ecommerce platform, analytics, tag managers, marketing automation, chat, payments, consent tools, frameworks, CDN, hosting, DNS host and email provider. It is built for lead lists, competitor research, agency prospecting and CRM enrichment, where you need thousands of domains checked cheaply rather than one site at a time in a browser extension.

How it works

1. HTTP first. Each domain is fetched once with a normal browser user agent. We match response headers, cookie names, <meta> tags, <script src> URLs and HTML patterns against about 290 hand-written fingerprints.
2. DNS. MX, TXT (SPF and verification records), NS and the CNAME of www reveal the email provider (Google Workspace, Microsoft 365, Zoho...), email security gateways (Proofpoint, Mimecast), sending services (SendGrid, Mailchimp, SES), DNS host and CDN. This also works when the website itself blocks bots.
3. Optional browser fallback. Turn on browserFallback and domains that return 403/429/503, a bot challenge, or an empty JavaScript shell are re-tried in headless Chrome. The fallback also checks JavaScript globals.

Each technology has a confidence value. Header, cookie, script, meta and DNS matches score 100. HTML-pattern matches score 80, implied technologies score at most 90 (WooCommerce implies WordPress, which implies PHP), and weak heuristics score 50–60. Use minConfidence to filter. A version is returned when the page exposes one, for example a WordPress generator tag.

Input

{ "domains": ["shopify.com", "allbirds.com", "hubspot.com"], "browserFallback": false, "includeDns": true, "minConfidence": 50 }

Output sample (real cloud run, trimmed)

{
  "domain": "allbirds.com",
  "finalUrl": "https://www.allbirds.com/",
  "httpStatus": 200,
  "technologies": [
    {
      "name": "Cloudflare",
      "categories": [
        "CDN",
        "Security / WAF"
      ],
      "version": null,
      "confidence": 100
    },
    {
      "name": "Microsoft 365",
      "categories": [
        "Email provider"
      ],
      "version": null,
      "confidence": 100
    },
    {
      "name": "Shopify",
      "categories": [
        "Ecommerce"
      ],
      "version": null,
      "confidence": 100
    },
    {
      "name": "Shopify hosting",
      "categories": [
        "Hosting / PaaS"
      ],
      "version": null,
      "confidence": 100
    },
    {
      "...": "7 more"
    }
  ],
  "technologyCount": 11,
  "categoriesSummary": {
    "CDN": [
      "Cloudflare"
    ],
    "Security / WAF": [
      "Cloudflare"
    ],
    "Email provider": [
      "Microsoft 365"
    ],
    "Ecommerce": [
      "Shopify"
    ]
  },
  "emailProvider": "Microsoft 365",
  "emailSecurityGateway": null,
  "cdn": [
    "Cloudflare"
  ],
  "cms": null,
  "ecommerce": "Shopify",
  "analytics": [
    "Microsoft Clarity"
  ],
  "hosting": [
    "Shopify hosting"
  ],
  "method": "http",
  "analyzedAt": "2026-10-29T22:55:19.948Z",
  "error": null
}

The Overview dataset view shows one row per domain. The All technologies view shows one row per detected technology.

Pricing (pay per event)

Event	Price
domain-analyzed: domain fetched over HTTP and analyzed	$0.002
domain-analyzed-browser: domain needed the browser fallback	$0.004 (instead of, not on top of, the HTTP event)

Failures are never charged. Unreachable domains, DNS errors and sites that block us (also in the browser) are still returned with their DNS-based findings and an error message, but they cost you nothing. Cost example: 10,000 domains, of which about 5% need the browser = 9,500 × $0.002 + 500 × $0.004 = $21. In our test, 20 diverse domains took 5 seconds at 512 MB.

Accuracy & limitations

• Detection only sees what the homepage and DNS expose. Tools loaded later through Google Tag Manager (such as Google Analytics behind GTM) may only appear with the browser fallback, or not at all.
• Some large sites block datacenter IPs. In our test, nytimes.com returned 403 even in the browser. Those rows are free and still include the DNS findings.
• TXT verification records (Verified SaaS (DNS)) show that a company verified a domain with a vendor. They do not prove active use.

Fingerprint data & license

The fingerprint set is an original, clean-room dataset by Steadyline Data. It was written from vendor documentation and markup we observed on public sites. It is not copied or derived from Wappalyzer or its GPL-3.0 forks (e.g. webappanalyzer), and it does not use BuiltWith data. Product names are trademarks of their owners and are used here only to identify them.

Acceptable use

Use this Actor only on public websites and for legitimate purposes such as market research, sales and security inventory. It makes one ordinary page request per domain plus public DNS queries. Do not use it to bypass access controls, to attack or overload sites, or in ways that break a site's terms or applicable law (including GDPR/CCPA when you combine results with personal data). You are responsible for how you use the output.

Support

Found a missed or wrong detection? Open an issue with the domain and the expected technology. Fingerprint additions ship regularly. Made by Steadyline Data.