Website Technology Detector: tech stack lookup for any website

Find out what any website is built with, for $5 per 1,000 websites. Paste domains and get back the CMS, ecommerce platform, analytics and tag managers, CDN and hosting, JavaScript frameworks, marketing and consent tools, and even the email provider and SaaS tools a company uses (from public DNS records).

• 7,600+ technologies from the GPL-3.0 webappanalyzer fingerprint ruleset (Wappalyzer format)
• Fast and cheap: plain HTTP, no browser, about 1 second per site
• Versions and confidence where the site reveals them (e.g. WordPress 6.6.2, nginx 1.25.3)
• DNS intelligence: MX, SPF/TXT verification records and NS reveal Google Workspace vs Microsoft 365, Cloudflare, HubSpot, Slack, Zoom, Atlassian, Stripe and many more
• Polite by design: fetches only the public page you give, respects robots.txt (RFC 9309), and identifies itself as TechStackDetector. No logins, no bypassing bot protection.
• You only pay for real results: sites that block us, error out or forbid crawling in robots.txt are listed for free

Who it's for

• Sales and lead generation: find every prospect on Shopify, HubSpot or Microsoft 365; prioritise accounts by stack
• Agencies and freelancers: spot outdated CMS versions and missing analytics before a pitch
• Market research: measure technology adoption across a list of domains
• Investors and M&A: a quick technical due-diligence snapshot

Input

{
  "urls": ["pleo.io", "https://www.hubspot.com", "wordpress.org"],
  "dnsLookups": true,
  "includeDnsVerifiedSaas": true,
  "includeImplied": true,
  "minConfidence": 0,
  "maxConcurrency": 5
}

Output

One item per website:

{
  "input": "https://wordpress.org/",
  "status": "ok",
  "domain": "wordpress.org",
  "finalUrl": "https://wordpress.org/",
  "httpStatus": 200,
  "title": "Blog Tool, Publishing Platform, and CMS - WordPress.org",
  "technologyCount": 13,
  "technologyNames": ["Google Tag Manager", "Nginx", "PHP", "WordPress", "MySQL", "..."],
  "websiteTechnologies": ["..."],
  "dnsDetectedServices": ["..."],
  "byCategory": { "CMS": ["WordPress"], "Web servers": ["Nginx"], "Tag managers": ["Google Tag Manager"] },
  "technologies": [
    { "name": "WordPress", "version": null, "confidence": 100, "categories": ["CMS", "Blogs"],
      "website": "https://wordpress.org", "cpe": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
      "saas": true, "openSource": true, "pricing": ["low", "recurring", "freemium"],
      "implied": false, "detectedVia": ["html", "scripts"] }
  ],
  "rulesetVersion": "enthec/webappanalyzer <commit> <date>"
}

status is one of ok (charged), blocked-by-robots-txt, http-error, unreachable, invalid-url (all free). detectedVia shows the evidence: url, headers, cookies, meta, html, scripts, dns or implied. See sample_output.json.

Pricing

$0.005 per successfully analyzed website ($5 per 1,000), plus the tiny standard Actor start fee. Failed, blocked and invalid inputs are free.

Limitations

• The Actor reads HTML, headers, cookies, meta tags, scripts and DNS. It does not run a browser, so technologies that can only be seen in JavaScript at runtime may be missed. On the other hand, it's far cheaper and faster than browser-based tools.
• Sites behind aggressive bot protection may answer with 403. They are reported as http-error and not charged.
• dnsDetectedServices come from public DNS verification records. They mean the company signed up for or verified the service at some point, not necessarily that it uses it today.

Licence

Source available on request (GPL-3.0 components; licence and NOTICE included). This Actor is licensed under GPL-3.0 and bundles the GPL-3.0 webappanalyzer ruleset (https://github.com/enthec/webappanalyzer); the licence texts and NOTICE.md ship with every build. To receive the complete source, contact us via the Actor's Issues tab.

Privacy: personal contact data is removed

Every output item is passed through a sanitiser before it is saved. Email addresses and phone numbers anywhere in any text field (title, description, HTML, location, URLs, errors…) are replaced with [redacted], and contact-person, recruiter and hiring-manager fields are dropped. Names introduced as a contact ("Your contact: …", "Ansprechpartnerin: …") are also redacted. The output contains organisation-level data only and is not meant for contacting individuals.