Wappalyzer alternative for developers: detect tech stacks by API

Option 1: Wappalyzer's paid service

The browser extension is still the quickest way to check a single site by hand, and Wappalyzer sells API access. That's a good fit if you want a managed service and the pricing works for your volume.

Option 2: the open-source fingerprints plus your own engine

The community fork webappanalyzer (GPL-3.0) keeps the technology fingerprints up to date and is actively maintained. It's data only, so you write the engine: fetch the page, match each technology's patterns against the HTML, script URLs, headers, cookies and meta tags, apply the implies, requires and excludes rules, pull versions out of the regex groups, and add up confidence. A basic matcher is a weekend project. Getting versions, implied technologies and false positives right takes longer.

Option 3: a hosted API built on those fingerprints

Our Tech Stack Detector on Apify runs that engine for you, against a list of any size. It also reads public DNS, which a browser extension can't see. MX and SPF records show the email provider and sending services, and TXT verification records reveal connected SaaS tools such as Atlassian, DocuSign or Zoom. From Node.js (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('rimulabs/tech-stack-detector').call({
    domains: ['basecamp.com', 'allbirds.com'],
    includeDns: true,
});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
for (const site of items) console.log(site.domain, '->', site.techStack);

Real output from 18 October 2026:

basecamp.com -> Atlassian Cloud, Bootstrap, Cloudflare, Cloudflare DNS, Google Search Console, MailChimp, Microsoft 365, Open Graph, Priority Hints, Stimulus, Zoom
allbirds.com -> Apple Pay, Cloudflare, Cursor, DocuSign, Google Search Console, Google Tag Manager, HSTS, HTTP/3, Microsoft 365, Miro, Open Graph, PayPal, Priority Hints, Shopify, Swiper

Each site also has a technologies array shaped much like the old package's output, plus foundIn, the evidence behind each detection:

[
  { "name": "Shopify", "version": null, "confidence": 100, "categories": ["Ecommerce"], "foundIn": ["meta", "scripts"] },
  { "name": "PayPal", "version": null, "confidence": 100, "categories": ["Payment processors"], "foundIn": ["html"] },
  { "name": "Microsoft 365", "version": null, "confidence": 100, "categories": ["Webmail", "Email"], "foundIn": ["dns:mx", "dns:txt"] },
  { "name": "DocuSign", "version": null, "confidence": 100, "categories": ["Miscellaneous"], "foundIn": ["dns:txt"] }
]

It also has ready-made columns such as cms, ecommerce, analytics, email, hosting and cdn for spreadsheets, a filter that returns only sites using the technologies you name, and a monitor mode that reports what was added or removed since the last run.

Differences from the old npm package

• No headless browser. The old package could drive Chrome and see tools that load only after JavaScript runs. The Actor reads the page as served, which is faster and cheaper, but some tag-manager-loaded pixels can be missed. DNS checks make up for part of that.
• Polite by design. It fetches each home page once, respects robots.txt, and reports sites behind a bot check as blocked rather than trying to get around it.
• Nothing to host. No Chrome binaries or fingerprint updates to manage. Results come back as JSON, CSV or Excel.

Cost: $3.00 per 1,000 sites checked. Sites that are unreachable, blocked or closed to crawlers are free. A weekly check of 50 competitors costs about $0.60 a month.