Website Tech Stack & Domain Intelligence (DNS, WHOIS, SSL)

Paste a list of domains and get, for each one, a clean lead-qualification report:

• 🧩 Technologies – CMS, e-commerce platform, analytics, tag managers, CDN, frameworks, payment and marketing tools (7,600+ fingerprints)
• ✉️ Email & DNS – MX records, email provider (Google Workspace, Microsoft 365, Proofpoint…), SPF and DMARC policy, SaaS verification records (TXT)
• 📅 WHOIS via RDAP – registrar, registration date, expiry date, domain age
• 🔒 SSL/TLS certificate – issuer, validity, days until expiry
• 🛡️ Security headers – HSTS, CSP, X-Frame-Options… with an A–F grade
• 🔗 Page title, description, language and official social profiles

One row per domain, ready for CSV/Excel, CRM import or API use.

Keywords: website technology lookup, tech stack checker, what CMS is this site using, detect Shopify / WordPress / WooCommerce sites, technographic data, bulk domain lookup, email provider lookup (MX), SPF and DMARC checker, WHOIS / RDAP domain age and expiry, SSL certificate expiry checker, security headers scanner, lead enrichment, low-cost alternative to BuiltWith-style or Wappalyzer-style technology lookups (pay per domain, no subscription).

Who is it for?

• Sales & lead generation – find shops running Shopify or WooCommerce, companies on HubSpot, sites using a competitor's product.
• Agencies – qualify prospects: outdated CMS, poor security headers, SSL about to expire, no DMARC.
• Security & IT – quick external posture check of your own or your clients' domains.
• Domain investors / brand protection – registration and expiry dates in bulk.

Example workflows

• Upload 5,000 e-commerce domains, keep rows where ecommerce contains Shopify, export to CSV for outreach.
• Enrich a CRM export with emailProviders (Google Workspace vs Microsoft 365) to tailor messaging.
• Weekly scheduled run on your clients' domains: alert when ssl.daysUntilExpiry < 21 or dns.dmarcPolicy is missing.

How it works (and what it does not do)

• Only the homepage of each host is fetched (plus a few internal pages in Deep check mode).
• robots.txt is respected (RFC 9309). If a site disallows crawling, the page is not fetched; DNS, RDAP and certificate checks still run because they do not crawl the site.
• No JavaScript execution, no proxies, no CAPTCHA or anti-bot bypass. Sites that present a bot challenge are reported as blocked.
• Polite defaults: identified user agent, request timeouts, limited concurrency, sequential requests per site.

Input

Field	Default	Description
domains	–	Domains or URLs. Paths are ignored; duplicates are removed and never charged twice.
deepCheck	false	Analyse up to deepCheckMaxPages internal pages (about, pricing, contact…) and check security.txt, sitemap, ads.txt, llms.txt.
deepCheckMaxPages	3	1–10 extra pages per domain.
includeTechnologies / includeDns / includeWhois / includeSsl	true	Turn individual checks off if you don't need them.
maxConcurrency	10	Domains processed in parallel (1–50).
requestTimeoutSecs	15	Timeout per request.

{ "domains": ["apify.com", "shopify.com", "wordpress.org"], "deepCheck": false }

Output example (abbreviated)

{
  "domain": "wordpress.org",
  "status": "ok",
  "httpStatus": 200,
  "title": "Blog Tool, Publishing Platform, and CMS – WordPress.org",
  "cms": ["WordPress"],
  "technologyCount": 13,
  "websiteTechnologies": "Google Font API, Google Tag Manager, Gutenberg, HSTS, MySQL, Nginx, Open Graph, PHP, ...",
  "technologies": [{"name": "WordPress", "version": null, "categories": ["CMS", "Blogs"], "confidence": 100, "detectedBy": ["dom", "html", "meta"]}],
  "dns": {"mx": ["10 smtp1-dca.wordpress.org"], "hasSpf": true, "hasDmarc": true, "dmarcPolicy": "reject", "emailProviders": []},
  "whois": {"registrar": "MarkMonitor Inc.", "createdDate": "2003-03-28", "expiryDate": "2035-03-28", "domainAgeDays": 8584},
  "ssl": {"valid": true, "issuer": "Let's Encrypt", "validTo": "2026-12-22", "daysUntilExpiry": 86},
  "securityHeaders": {"grade": "D", "score": 2, "server": "nginx"},
  "socialProfiles": {"x": "https://twitter.com/WordPress", "linkedin": "https://www.linkedin.com/company/wordpress"}
}

status values: ok, httpError (site answered 4xx/5xx), blocked (bot challenge – not bypassed), robotsDisallowed, robotsUnreachable (robots.txt returned 5xx/429 – page not fetched, per RFC 9309), unreachable, invalid, error.

websiteTechnologies are seen on the website itself; dnsInferredServices are SaaS tools inferred only from DNS records (e.g. TXT domain-verification entries) or the certificate issuer.

Pricing

Pay per event: a small start fee per run, one domain-checked event per domain in the dataset, and an extra deep-check event per domain when Deep check is enabled. Invalid inputs and duplicates are not charged. Example: 1,000 domains without deep check = 0.005 + 1,000 x 0.003 = about USD 3.01. Set a maximum cost per run and the Actor stops when it is reached.

FAQ

How is this different from browser-extension tech detectors? It runs in bulk (thousands of domains per run), adds DNS/email, WHOIS/RDAP, SSL and security-header data in the same row, and exports to CSV/Excel/JSON or your CRM via the Apify API.

Does it bypass Cloudflare or bot protection? No. Blocked sites are reported as blocked and still get DNS, WHOIS and SSL data.

Can I schedule it? Yes - use Apify schedules and integrations (Google Sheets, Slack, webhooks, Zapier/Make).

Limitations

• Technologies that only appear after JavaScript runs may be missed (no browser is used).
• RDAP is not offered by every country-code TLD (e.g. .de, .jp); those rows carry whois.available = false with the reason.
• Results reflect what the site served to an identified bot at check time.

Credits and licences

• Technology fingerprints come from the community project enthec/webappanalyzer, licensed under the GNU General Public License v3.0. This Actor contains its own matching engine; the fingerprint data is downloaded unmodified (unused fields removed) at build time together with its licence. Each record carries a rulesAttribution field.
• WHOIS data comes from the registries' public RDAP services located through the IANA bootstrap registry.
• This Actor is not affiliated with BuiltWith, Wappalyzer or any of the detected vendors. All product names are trademarks of their respective owners.