Tech Stack & Vendor Risk Scanner

A fast, no-browser scan of the technology stack behind any website -- CMS, ecommerce platform, JS framework, analytics, tag manager, CDN, hosting, payments, and chat/support widget -- plus a letter grade, a severity tag, and a plain-English list of legacy/security and opportunity flags.

What you get, per URL

• A letter grade (A to F) and 0-100 score summarizing stack health at a glance
• A one-line executive summary
• A severity tag -- critical (mixed content or unreachable), warning (legacy jQuery, exposed version string), or `ok
• The full technology list, each tagged with its category (CMS, Analytics, CDN, Payments, Chat, etc.)
• A generator meta tag value when present (often reveals exact CMS version)
• Risk and opportunity flags: legacy jQuery 1.x, mixed HTTP content on an HTTPS page, exposed version strings, missing CDN, missing analytics
• Sites are checked in parallel (configurable), so a batch of 50 domains finishes in a fraction of the time a one-by-one lookup would take

Why this instead of checking manually

	Manual "view source" spot-check	Tech Stack & Vendor Risk Scanner
Coverage	Whatever page you remember to check	Every URL you list, automatically
Speed	View-source, scroll, repeat per page	Seconds, via parallel scanning
Triage	You read raw HTML/headers yourself	Pre-classified severity + letter grade
Output	Notes in a doc	Structured dataset, exportable to CSV/JSON/BI tools

Who this is for

• Sales and SDR teams qualifying leads by what platform a prospect runs (e.g. "still on WordPress with no CDN")
• Agencies doing a quick technical audit before a pitch
• Security-minded developers checking for legacy jQuery or exposed CMS version strings across a portfolio of sites
• Competitive researchers mapping what stack a set of competitors use

How to use it

1. Add one or more URLs to scan.
2. Optionally enable "Fetch linked CSS files" to catch CSS-framework signatures (Bootstrap, Tailwind) at a small speed cost.
3. Run it once for a snapshot, or schedule it to catch a stack change (a competitor switching CMS or adding a new chat widget) over time.

Example output (one item)

{
  "url": "https://example.com/",
  "finalUrl": "https://example.com/",
  "statusCode": 200,
  "responseTimeMs": 210,
  "grade": "B+",
  "score": 90,
  "severity": "warning",
  "summary": "1 item(s) worth a look -- 6 technologies detected.",
  "technologyCount": 6,
  "technologies": [
    { "name": "WordPress", "category": "CMS", "legacy": false },
    { "name": "jQuery (legacy 1.x)", "category": "JS Library", "legacy": true },
    { "name": "Google Analytics (GA4)", "category": "Analytics", "legacy": false },
    { "name": "Cloudflare", "category": "CDN", "legacy": false }
  ],
  "issues": [
    { "severity": "warning", "message": "Legacy jQuery 1.x detected -- unsupported since 2016." }
  ],
  "generator": "WordPress 6.2",
  "checkedAt": "2026-08-25T00:00:00.000Z"
}

Pricing

This Actor uses pay-per-event pricing:

• Site scanned -- charged once per URL successfully scanned.

Failed lookups (unreachable domains, timeouts) are not charged.

FAQ

Does this render JavaScript? No. It reads the raw HTML response and HTTP headers, the same way most crawlers see a page. Technologies that are injected purely client-side after heavy JS execution may not be visible.

How many technologies can it detect? The current signature set covers 60+ common CMS, ecommerce, framework, analytics, CDN, hosting, payment, and chat vendors, chosen for accuracy over sheer signature count.

Is this a security scanner? No. It flags a small set of well-understood legacy/exposure signals (old jQuery, exposed version strings, mixed content) as a bonus, but it is not a vulnerability scanner and doesn't replace one.

Does this send data anywhere besides your own Apify account? No. It only fetches the URLs you provide (and, optionally, up to 2 linked stylesheets per page) and returns what it finds.