Website Tech Stack & Email Finder — a BuiltWith / Wappalyzer alternative that also finds contacts

You have a list of company domains and you need to know what each company runs and how to reach them. This Actor takes the domains and returns one clean row per company: the website's tech stack, email addresses, phone numbers, social profiles, page metadata — and, uniquely, which applicant tracking system the company recruits with and its board token.

It reads only public pages and it obeys robots.txt by default.

apify.com      ─┐                    ┌─ techStack: ["Next.js", "React", "Sentry", …]
stripe.com     ─┼──►  one row each ──┼─ emails / phones / linkedin / twitter / github
ashbyhq.com    ─┘                    └─ atsProvider / atsToken / atsBoardUrl

What problem this solves

Tech-stack lookup and contact discovery are normally two separate tools and two separate bills — a BuiltWith or Wappalyzer-style detector on one side, an email finder on the other. Both read the same HTML. This Actor fetches each page once and extracts both, so a domain list becomes a usable prospect list in a single run at a single per-domain price.

Website tech stack detection (BuiltWith / Wappalyzer alternative)

40+ signatures, read out of the page's own markup and script tags:

WordPress · Shopify · Wix · Squarespace · Webflow · Next.js · Nuxt · React · Vue · Angular · Svelte · HubSpot · Segment · Intercom · Drift · Zendesk · Stripe · PayPal · Cloudflare · Google Analytics 4 · Google Tag Manager · Meta Pixel · LinkedIn Insight · Hotjar · Plausible · Matomo · Sentry · Algolia · Contentful · Sanity · Mailchimp · Klaviyo · Calendly · Typeform · Bootstrap · Tailwind · jQuery and more.

In a measured 25-domain test, 22 of 25 domains returned a tech stack — the highest-coverage field of all.

Email finder and contact extraction

emails holds addresses on the company's own domain. Anything else found on the page — an agency address, a documentation example, a Gmail in a footer — goes to otherEmails, so your outreach list is not polluted by someone else's inbox. excludeGenericEmails drops info@ / noreply@ style role addresses when you only want something specific.

Also extracted: phones, and linkedin, twitter, facebook, instagram, youtube, github, tiktok.

ATS and hiring-signal detection

This is the part no other enrichment Actor does. From the careers link on the site, it identifies the applicant tracking system and extracts the board token:

Greenhouse · Lever · Ashby · Workable · Personio · Recruitee · Teamtailor · SmartRecruiters · BambooHR · Workday · Breezy · Join · Jobvite

You get atsProvider, atsToken and atsBoardUrl. Those are exactly the input that Greenhouse, Lever, Ashby, Workable — Career Site Jobs API takes, so a domain list becomes a live job-listings feed in two runs.

Use cases

• Lead enrichment — turn a CRM export of domains into contactable rows with firmographic and technographic context.
• Sales qualification by tech stack — find every prospect running Shopify, HubSpot or Next.js, then sort your outreach by what they already use.
• Recruiting-tech mapping — which of these 500 companies recruit on Greenhouse? atsProvider answers it directly.
• Hiring-intent signals — companies with a live ATS board are hiring; chain into the jobs API to see for what.
• Data hygiene — check whether the contact details on a list of company sites are still live, and which domains have died.

Input

{
  "domains": ["apify.com", "https://ashbyhq.com", "stripe.com"],
  "maxPagesPerDomain": 4,
  "extract": ["emails", "phones", "socials", "techStack", "atsBoard", "meta"],
  "respectRobotsTxt": true,
  "requestDelaySeconds": 1,
  "concurrency": 5,
  "excludeGenericEmails": true
}

maxPagesPerDomain: 1 is homepage-only — the fastest and cheapest setting, and usually enough for tech stack and socials. Contact details normally need 3–5 pages, because they live on /contact, /about, /imprint or /careers. Pages are ranked, not crawled blindly.

Output — one row per domain

{
  "domain": "ashbyhq.com",
  "finalUrl": "https://www.ashbyhq.com/",
  "companyName": "Ashby",
  "title": "Ashby | All-in-one recruiting software",
  "description": "Ashby helps ambitious teams...",
  "language": "en",
  "generator": null,
  "emails": ["support@ashbyhq.com"],
  "otherEmails": [],
  "phones": [],
  "linkedin": "https://www.linkedin.com/company/ashbyhq",
  "twitter": "https://twitter.com/ashbyhq",
  "facebook": null,
  "instagram": null,
  "youtube": null,
  "github": null,
  "tiktok": null,
  "techStack": ["Google Fonts", "Next.js", "React", "Sentry"],
  "atsProvider": "ashby",
  "atsToken": "ashby",
  "atsBoardUrl": "https://jobs.ashbyhq.com/ashby",
  "pagesCrawled": ["https://www.ashbyhq.com/", "https://www.ashbyhq.com/about"],
  "pagesSkippedByRobots": [],
  "status": "ok",
  "error": null,
  "scrapedAt": "2026-09-10T10:44:12.001000+00:00"
}

The dataset ships with four views: overview, contacts (emails and socials), hiring (atsProvider / atsToken / atsBoardUrl) and full.

status is one of:

Status	Meaning
ok	Pages loaded and something was extracted
no_data	Pages loaded but nothing matched (common on JS-only or markdown-served sites)
blocked_by_robots	Every candidate URL is disallowed by the site's robots.txt — nothing was fetched
failed	Site unreachable; the reason is in error

By default every input domain produces exactly one row, so the output lines up 1:1 with your input list — and dead domains are billed like any other result. Turn Include unreachable domains in the output off and only domains that actually loaded are pushed, so you do not pay for dead ones. RUN_SUMMARY reports the full status counts either way.

Honest limitations

• No JavaScript rendering. Pages are fetched as HTML. A site that renders its contact details entirely client-side returns fewer emails — tech-stack and ATS detection still work, because those come from the script tags. If you need rendered DOM, use a browser-based crawler instead.
• Tech-stack detection is signature-based. It finds what is visible in the HTML. It will miss server-side technology, and a stale script tag can produce a false positive. This is the same fundamental limit every client-side detector has, BuiltWith and Wappalyzer included.
• Contact details on the public web are usually role addresses (info@, sales@). This Actor does not guess or pattern-generate personal addresses, and it does not verify that an address is deliverable.
• robots.txt is respected by default. On sites that disallow the paths where contacts live, this Actor returns less than a scraper that ignores robots.txt. Skipped URLs are listed in pagesSkippedByRobots so you can see exactly what happened. You can turn the check off, but then it is on you.
• Personal data. Email addresses and phone numbers can be personal data under the GDPR and similar laws. You are the controller of anything you collect here; have a lawful basis, and honour deletion requests.
• Cloudflare-protected sites return 403 to datacenter IPs. In the 25-domain test, three large consumer sites (doordash.com, kickstarter.com, coinbase.com) returned HTTP 403. Enable Apify Proxy for those, or accept the gap.
• Measured coverage on that same 25-domain test: 22/25 loaded, 22 gave a tech stack, 20 a LinkedIn page, 13 an email address, 9 an ATS board, 2 a phone number. Most B2B sites route contact through a form rather than publishing an address — this Actor reports what is there, it does not invent it.

Politeness

Requests to any single site are serialised with your delay, and the delay is raised automatically if the site's robots.txt sets a longer Crawl-delay. Parallelism happens across different domains, never within one. robots.txt is fetched once per host per run.

FAQ

Is this a BuiltWith or Wappalyzer alternative? For the "what technology does this website use" question, yes — same signature-based approach, over your own domain list, priced per domain, with the contact and ATS fields included in the same row. It is not a historical technology database: it tells you what the site runs today, not what it ran in 2019.

How do I find a company's email address from its domain? Give the domain to this Actor with maxPagesPerDomain: 4. It checks the homepage plus the highest-ranked contact/about/imprint pages. Realistically about half of B2B sites publish an address at all — see the measured coverage above, and note that this Actor will not invent firstname.lastname@ guesses.

Can I find out which companies use Shopify / HubSpot / Next.js? Yes. Run your domain list, then filter the dataset on techStack. The overview view keeps techStack visible for quick scanning.

Which ATS does a company use? atsProvider tells you, across 13 platforms, and atsToken gives you the board identifier so you can pull their live openings.

Does it work on any website, or only company sites? Any site that serves HTML. It is tuned for company websites — the page-ranking heuristics look for contact, about, imprint and careers pages.

Do I need a proxy? Not usually. proxyConfiguration is off by default and most B2B sites answer a plain datacenter request. Turn Apify Proxy on for the Cloudflare-protected consumer sites.

What does it cost? Per domain enriched — a flat, predictable price whether the domain returns two fields or twenty.

Changelog

See CHANGELOG.md.

Support

Found a bug, or need a field this Actor does not return yet? Open an issue on the Actor's Issues tab, or email pablodevigoalertas@gmail.com. Issues are read first.