# Website Technology Detection & Tech Stack (`steadydata/website-tech-stack`) Actor

Website technology detection for up to 500 sites per run: CMS, ecommerce, analytics, tag managers, frameworks, server, CDN, payments and consent tools, with the evidence for every detection plus the third-party domains. Skips sites their robots.txt forbids, free of charge.

- **URL**: https://apify.com/steadydata/website-tech-stack.md
- **Developed by:** [Steadydata Team](https://apify.com/steadydata) (community)
- **Categories:** Developer tools, SEO tools
- **Features:** Limited permissions
- **Stats:** 3 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $32.50 / 1,000 site analyseds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Technology Detection & Tech Stack Scraper

Website technology detection for up to **500 sites per run**: CMS, ecommerce platform,
analytics, tag managers, frameworks, server, CDN, hosting, payment providers, consent
tools, support widgets and more, with **the evidence for every single detection**. Plus
the third-party domains each page talks to. **A site whose own robots.txt forbids
automated access is skipped and never charged.**

### Why this scraper

- **It respects robots.txt, which no other tech detector in this store does.** Before the
  page is fetched, the target's robots.txt is read with the rules search engines actually
  use: most specific rule wins, grouped user-agents share their block. A site that says no
  comes back as a free `ROBOTS_DISALLOWED` record. If you scan domains you do not own, this
  is the difference between a defensible dataset and a liability.
- **Evidence, not claims.** Every detection carries the exact signal behind it: the
  response header, the cookie name, the meta generator, the script URL or the HTML
  pattern. You can verify any row in seconds instead of trusting a black box.
- **Versions where the site reveals them.** `nginx/1.24.0`, `WordPress 6.7.1`,
  `jQuery 3.6.0`: read from the header or the generator tag, never guessed.
- **The third parties too.** Every row lists the external domains the page references,
  from its own URLs and from its Content-Security-Policy. Those are reported as observed
  domains, not as detected technologies, because a whitelisted domain is not proof of use.
- **Flat columns for filtering.** `cms`, `ecommerce`, `server`, plus arrays for analytics,
  frameworks, CDN, payments and consent, so a spreadsheet filter is enough. The full
  detection list with evidence sits in one column next to them.
- **Only delivered sites are charged.** Robots refusals, dead domains, timeouts and bot
  walls come back as free error records. No start fee.

### Who this is for

Sales and partner teams qualifying a domain list ("who runs Shopify", "who still uses
Universal Analytics"). Agencies auditing a client portfolio. Researchers measuring
technology adoption. Security and privacy teams mapping which third parties a set of
sites loads.

### Who this is not for

**Read this before you buy, because this is the honest limit.** This actor reads the HTML,
the response headers, the cookies and the robots.txt of one page. It does not run
JavaScript. On a classic server-rendered site that finds most of the stack; on a
JavaScript-heavy single-page app it finds less, because the scripts that would reveal the
rest are loaded after the page is parsed. In testing on 13-09-2026 real home pages
returned 2 to 7 technologies and 11 to 60 third-party domains. If you need the 20-plus
detections a browser-based scanner produces, this is the wrong tool and a browser-based
actor is worth its higher price.

The signature set is our own work, currently 177 technologies across 22 categories. It is
not a copy of any vendor's database, which is why it is smaller than a commercial one and
why every detection ships with its evidence.

### Input fields

| Field | Type | Required or default | What it does |
|---|---|---|---|
| `urls` | list of text | required | Domains or URLs, one per row, up to 500 (example: nu.nl or https://www.example.com). The home page is analysed. A site that forbids automated access in its robots.txt is skipped and not charged. |
| `language` | text | en-US,en;q=0.9 | Language header sent with the request, which decides the language of the page you get back. |
| `includeEvidence` | true/false | true | Add the exact signal behind every detection (header, cookie, script URL or HTML pattern). Keep it on if you need to verify or debug a detection; switch it off for a slimmer dataset. |

### Input example

```json
{
    "urls": ["apify.com", "hema.nl", "https://www.shopify.com"],
    "language": "en-US,en;q=0.9",
    "includeEvidence": true
}
```

Domains or full URLs, both work. The home page is analysed.

### Output example

| Field | Type | What it holds | Example |
|---|---|---|---|
| `url` | text | The site that was examined. | `https://apify.com` |
| `finalUrl` | text | The page that was really read, after every redirect. | `https://apify.com/` |
| `statusCode` | number | The HTTP status the page answered with; anything but 200 means a visitor sees something else. | `200` |
| `technologyCount` | number | How many techniques were found on the page; zero points at a page that blocks reading. | `7` |
| `technologies` | list | Every detection with its category, and with the exact signal behind it when includeEvidence is on. | `[{"name": "Amazon CloudFront", "category": "CDN", "confid...` |
| `cms` | text | Filled when a technology of this kind was detected; empty when the site uses none we recognise. |  |
| `ecommerce` | text | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `Shopify` |
| `analytics` | list | Filled when the page loads an analytics script directly; a site that loads it through a tag manager shows only the tag manager here. | `["Adobe Analytics"]` |
| `tagManagers` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["Google Tag Manager"]` |
| `frameworks` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["Next.js"]` |
| `jsLibraries` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["Bootstrap"]` |
| `server` | text | Filled when the server names itself in its headers; many sites hide this. |  |
| `cdn` | list | Filled when a content delivery network was detected in the headers or the page. | `["Amazon CloudFront"]` |
| `hosting` | list | Filled when the hosting provider was detected; most sites give no signal for this. |  |
| `paymentProviders` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["Shop Pay"]` |
| `consentTools` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["OneTrust"]` |
| `marketingTools` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["HubSpot"]` |
| `supportTools` | list | Filled when a technology of this kind was detected; empty when the site uses none we recognise. | `["Intercom"]` |
| `otherTechnologies` | list | Filled only when a second technology turns up in a category that holds one name (a second CMS or shop platform); empty for most pages. |  |
| `title` | text | Filled when the page has a title tag. | `Apify: Marketplace of ready-to-run tools for AI` |
| `metaDescription` | text | Filled when the page has a meta description. | `Thousands of tools to automate your business. Get real-ti...` |
| `generator` | text | The meta generator tag, the strongest single signal for a CMS; many sites remove it. |  |
| `isHttps` | true/false | True when the page is served over https. | `True` |
| `redirected` | true/false | True when the final URL differs from the one submitted. | `False` |
| `pageSizeBytes` | number | The size of the page in bytes; a heavy page is slow on a phone. | `492175` |
| `responseTimeMs` | number | How long the server took to answer, in milliseconds. | `423` |
| `robotsRule` | text | The robots.txt rule that decided whether this URL could be fetched, so the choice can be checked. | `allow /` |
| `thirdPartyDomains` | list | Other domains the page loads from; empty for a page that loads everything from itself. | `["a.quora.com", "agi.apify.com"]` |

```json
{
    "url": "https://hema.nl",
    "finalUrl": "https://www.hema.nl/",
    "statusCode": 200,
    "technologyCount": 6,
    "technologies": [
        {"name": "Salesforce Commerce Cloud", "category": "Ecommerce", "confidence": "high", "version": null, "evidence": "cookie dwsid"},
        {"name": "Amazon CloudFront", "category": "CDN", "confidence": "high", "version": null, "evidence": "header x-cache: from cloudfront"},
        {"name": "Google Tag Manager", "category": "Tag manager", "confidence": "medium", "version": null, "evidence": "page: googletagmanager.com/gtm.js"}
    ],
    "cms": null,
    "ecommerce": "Salesforce Commerce Cloud",
    "analytics": ["Cloudflare Web Analytics"],
    "tagManagers": ["Google Tag Manager"],
    "frameworks": [],
    "server": null,
    "cdn": ["Amazon CloudFront", "Cloudflare"],
    "hosting": [],
    "paymentProviders": [],
    "consentTools": [],
    "thirdPartyDomains": ["cdn.cquotient.com", "www.googletagmanager.com"],
    "title": "HEMA",
    "generator": null,
    "isHttps": true,
    "redirected": true,
    "pageSizeBytes": 486321,
    "responseTimeMs": 812,
    "robotsRule": "allow /",
    "status": "ok"
}
```

A site that forbids automated access produces an error record instead, and is **not**
charged:

```json
{
    "input": "example-that-says-no.com",
    "status": "error",
    "errorCode": "ROBOTS_DISALLOWED",
    "error": "https://example-that-says-no.com forbids automated access to its home page (disallow /); skipped and not charged"
}
```

Error codes: `INVALID_URL`, `ROBOTS_DISALLOWED`, `FETCH_FAILED`, `BLOCKED`. `INPUT_TRUNCATED` appears once when your input is longer than this actor accepts.

### Related actors from steadydata

- [technical-seo-audit](https://apify.com/steadydata/technical-seo-audit): the SEO side of the same pages
- [domain-dns-ssl-report](https://apify.com/steadydata/domain-dns-ssl-report): domain, DNS and certificate health
- [email-deliverability-report](https://apify.com/steadydata/email-deliverability-report): SPF, DKIM, DMARC and MTA-STS for the same domain
- Used together with company-career-site-jobs and technical-seo-audit in a recipe: Find companies that are hiring, and see what they run.

### Pricing

Pay per event: one `site-analysed` event per delivered site. No charge for robots
refusals, dead domains, timeouts or bot walls, and no start fee.

**Free Apify plan:** this actor delivers up to 25 rows per run for accounts on the Apify free
plan, and then stops with a message. That limit is set by us, not by Apify. It exists so the
actor keeps paying for itself for the people who do pay. Any paid Apify plan runs it at full
size, billed per delivered row, with failed rows never charged.

**Reviews:** if this actor saves you time, a short review on this page is the one thing that
helps most. Ratings are what other buyers look at first, and we have no other way to ask.

### Use with AI agents

AI assistants such as Claude, ChatGPT or Cursor can run this actor through Apify's own MCP server. Ask for the actor `steadydata/website-tech-stack` by its full name, so the assistant does not pick a different one, and start from this minimal input:

```json
{
  "urls": [
    "apify.com",
    "theguardian.com",
    "shopify.com"
  ]
}
```

The assistant can read the price per event from the Pricing section above before the first paid run. Failed input comes back as an error row, as described above.

### FAQ

**Why would I want it to respect robots.txt?**
Because a dataset built against a site's stated wishes is a problem you inherit, and
because a refusal costs you nothing here. `robotsRule` records the deciding rule for every
row, so your dataset carries the proof that you checked.

**Why is `server` often empty?**
Because a CDN answers instead of the origin, or the header is stripped. When Cloudflare or
CloudFront answers, you see that under `cdn`.

**Why did it not find Google Analytics on a site that clearly has it?**
Because it is loaded through a tag manager after the page is parsed. This actor reports
what the page itself reveals; `tagManagers` tells you the manager is there.

**Can I get the pages behind the home page?**
Not in this actor: one row is one site's home page. Feed it a list of specific URLs if you
need particular pages; each URL is analysed on its own.

**Is personal data collected?**
No. Technologies, headers and domains are properties of a website, not of a person.

**What happens when a detection is wrong?**
Check the `evidence` field first: it names the exact signal. If a signature is genuinely
wrong, it gets fixed, because a false positive costs a buyer more than a miss.

**Can I call it from my own code, like an API?**
Yes. Every run is available through the Apify API: start it with one HTTP request, then read
the results as JSON, CSV or Excel from the dataset endpoint, or use the official Python and
JavaScript clients. The input is the same JSON as in the input example above, so a scheduled
script, a Make or Zapier step or an AI agent can call it without any changes.

# Changelog

This Actor's version history is a separate document: https://apify.com/steadydata/website-tech-stack/changelog.md

# Actor input Schema

## `urls` (type: `array`):

Domains or URLs, one per row, up to 500 (example: nu.nl or https://www.example.com). The home page is analysed. A site that forbids automated access in its robots.txt is skipped and not charged.

## `language` (type: `string`):

Language header sent with the request, which decides the language of the page you get back.

## `includeEvidence` (type: `boolean`):

Add the exact signal behind every detection (header, cookie, script URL or HTML pattern). Keep it on if you need to verify or debug a detection; switch it off for a slimmer dataset.

## Actor input object example

```json
{
  "urls": [
    "apify.com",
    "theguardian.com",
    "shopify.com"
  ],
  "language": "en-US,en;q=0.9",
  "includeEvidence": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "apify.com",
        "theguardian.com",
        "shopify.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("steadydata/website-tech-stack").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "apify.com",
        "theguardian.com",
        "shopify.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("steadydata/website-tech-stack").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "apify.com",
    "theguardian.com",
    "shopify.com"
  ]
}' |
apify call steadydata/website-tech-stack --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,steadydata/website-tech-stack"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/Nc2FNNZO6JfdeOUcQ/builds/dVd7hgW7gOrEUVM8I/openapi.json