Website Tech Stack Detector: CMS, Ecommerce, Analytics, CDN

Website Tech Stack Detector: CMS, Ecommerce, Analytics, CDN (BuiltWith and Wappalyzer alternative)

Give it a list of websites. For each one it tells you what the site is built with: CMS, ecommerce platform, analytics and ad pixels, tag manager, CDN, web server, hosting, JavaScript frameworks, payment widgets, cookie banners, marketing tools and more, with the version when the site shows it.

It reads each site with one plain HTTP request (plus its robots.txt) and matches the HTML, response headers, cookies, script URLs and meta tags against more than 7,600 open technology fingerprints. No browser, no login, no proxy. That keeps it fast to start and cheap: $1 per 1,000 websites, and you pay only for sites where something was found.

What you can use it for

• Lead lists: find which of your prospects run Shopify, WooCommerce, Magento, HubSpot or Klaviyo.
• Competitor research: see the analytics, A/B testing, personalisation and payment tools a rival uses.
• AI agents and MCP tools: one small JSON answer per site, grouped by category, cheap enough to call for a single URL.
• Audits and migrations: check CMS and library versions across a portfolio of sites.

Input

Field	What to put
urls	Websites, one per line. A full address (https://example.com/shop) or just a domain (example.com). Up to 10,000 per run. Duplicates are checked and billed once.

{ "urls": ["https://wordpress.org/news/", "python.org", "allbirds.com"] }

Output

One item per website. Real output for wordpress.org (2026-10-31, list shortened to 3 of the 13 technologies found):

{
  "url": "wordpress.org",
  "finalUrl": "https://wordpress.org/",
  "status": "ok",
  "statusCode": 200,
  "error": null,
  "technologyCount": 13,
  "technologies": [
    { "name": "Nginx", "version": null, "confidence": 100, "categories": ["Web servers", "Reverse proxies"], "website": "https://nginx.org/en", "evidence": ["headers:server"] },
    { "name": "WordPress", "version": "7.2", "confidence": 100, "categories": ["CMS", "Blogs"], "website": "https://wordpress.org", "evidence": ["html", "scriptSrc", "meta:generator", "headers:link", "dom"] },
    { "name": "MySQL", "version": null, "confidence": 100, "categories": ["Databases"], "website": "https://mysql.com", "evidence": ["implied by WordPress"] }
  ],
  "byCategory": {
    "Font scripts": ["Google Font API"], "Tag managers": ["Google Tag Manager"], "WordPress plugins": ["Gutenberg"],
    "Editors": ["Gutenberg"], "Security": ["HSTS"], "Databases": ["MySQL"], "Web servers": ["Nginx"],
    "Reverse proxies": ["Nginx"], "Miscellaneous": ["Open Graph", "RSS"], "Programming languages": ["PHP"],
    "Performance": ["Priority Hints"], "CMS": ["WordPress"], "Blogs": ["WordPress"],
    "Page builders": ["WordPress Block Editor", "WordPress Site Editor"]
  },
  "fetchedAt": "2026-10-31T18:50:36.829Z"
}

• confidence is 0 to 100. Most signals count 100; weaker hints (for example one CSP header entry) count less.
• evidence says where each technology was seen: headers:<name>, cookies:<name>, meta:<name>, scriptSrc, scripts (inline script), html, dom, url, robots, or implied by <technology> (WordPress implies PHP and MySQL).
• byCategory is the same list grouped by category, handy when you only want "which CMS" or "which CDN".

Status values

status	Meaning	Billed
ok with technologyCount > 0	Site read and technologies found	Yes
ok with technologyCount 0	Site read, nothing recognised	No
blocked-by-robots	The site's robots.txt disallows this page for crawlers, so it was not read	No
http-error	The site answered 4xx or 5xx (403 and 429 often mean it blocks automated requests)	No
not-html	The address is a file (PDF, image, text), not a web page	No
too-many-redirects	More than 5 redirects	No
fetch-failed	No answer (unknown host, timeout, refused)	No
invalid-url	Not a public http(s) address	No

Pricing

Pay per event:

• $0.001 per website analyzed ($1 per 1,000), charged only when the site answered with a web page and at least one technology was found.
• $0.00005 per run start (Apify's standard start event).

Example: 2,500 websites of which 2,100 show technologies cost 2,100 x $0.001 + $0.00005 = $2.10005.

Set a maximum charge per run in Apify and the actor stops before it goes over: it reads only as many sites as your limit pays for.

Limits (read before you buy)

• No JavaScript rendering. Technologies that only show up as JavaScript variables after the page runs (some single-page apps, some trackers loaded by a tag manager) can be missed. Anything in the HTML, headers, cookies, script URLs or meta tags is caught.
• Sites with strong bot protection answer 403 or 429 to plain requests. In our test of 100 well-known sites, 16 did (news and retail giants mostly). Those rows are free and say so.
• robots.txt is obeyed. If a site disallows crawlers for a page, that page is skipped (free row). Our robots token is TechStackDetectorBot.
• Speed: about 1 to 3 seconds of processing per site at the default 1 GB memory (heavy ecommerce pages are the slow ones). Give the run more memory to go faster; the cost per site stays about the same.
• One page per site: the address you give. To check a store's checkout or a blog's article template, list that URL too.
• Versions appear only when the site exposes them.

FAQ

Where do the fingerprints come from? From the open-source webappanalyzer project, which continues the open Wappalyzer fingerprint set, licensed GPL-3.0. The detection engine that runs them is our own. This actor is not affiliated with Wappalyzer or BuiltWith.

Does it collect personal data? No. It returns technology names, versions, categories and evidence only. It reads no logins and sends no forms.

Can I call it from an AI agent? Yes. Call it through the Apify API or Apify's MCP server with one or more URLs; each site comes back as one compact JSON item.

Why is a site I know runs Shopify missing Shopify? Most likely the site blocked the request (check status) or the storefront is headless and hides it. Look at evidence on the rows that do match to see what the detector relies on.