MikeL

Posted on Feb 18 • Originally published at detectzestack.fly.dev

Detect Any Website's Tech Stack With a Single API Call

#webdev #api #javascript #security

Knowing what technologies a website uses is valuable for competitive intelligence, security audits, lead generation, and vendor evaluation. But manually inspecting HTTP headers, HTML source, and DNS records is tedious and incomplete.

I built DetectZeStack to solve this with a single API call that runs four detection layers simultaneously and returns a comprehensive technology profile.

The Four Detection Layers

1. Wappalyzer Fingerprinting

3,500+ technology signatures matching HTTP headers, HTML patterns, JavaScript variables, cookies, and meta tags.

2. DNS CNAME Analysis

29 DNS signatures identifying CDNs and infrastructure: CloudFront, Fastly, Cloudflare, Akamai, Vercel, Netlify, and more.

3. TLS Certificate Inspection

8 certificate issuer patterns detecting CDN and security providers from their TLS certificates.

4. Custom Header Matching

Server headers, X-Powered-By, and custom response headers identifying frameworks and platforms.

These layers complement each other. Wappalyzer catches front-end frameworks and CMS platforms. DNS and TLS catch infrastructure that's invisible to HTML analysis. Together they paint a complete picture.

Quick Start

Analyze any website with a single GET request:

curl "https://detectzestack.fly.dev/analyze?url=stripe.com" \
  -H "X-Api-Key: YOUR_KEY"

Response:

{
  "domain": "stripe.com",
  "url": "https://stripe.com",
  "technologies": [
    {
      "name": "Cloudflare",
      "categories": ["CDN"],
      "confidence": 100
    },
    {
      "name": "React",
      "categories": ["JavaScript frameworks"],
      "confidence": 100,
      "cpe": "cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*"
    },
    {
      "name": "Next.js",
      "categories": ["Static site generator"],
      "confidence": 100
    },
    {
      "name": "Nginx",
      "categories": ["Web servers"],
      "confidence": 100
    }
  ],
  "meta": {
    "status_code": 200,
    "tech_count": 4
  },
  "cached": false,
  "response_ms": 1240
}

Each technology comes with metadata: description, official website, icon, and CPE identifier (for cross-referencing with vulnerability databases).

Batch Analysis

Need to analyze multiple sites at once? The /analyze/batch endpoint handles up to 10 URLs in a single request with concurrent processing:

curl -X POST "https://detectzestack.fly.dev/analyze/batch" \
  -H "X-Api-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["stripe.com", "shopify.com", "vercel.com"]}'

All URLs are analyzed concurrently, so the total time is roughly the same as analyzing a single slow site.

Comparing Tech Stacks

The /compare endpoint shows shared and unique technologies across multiple sites:

curl -X POST "https://detectzestack.fly.dev/compare" \
  -H "X-Api-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["github.com", "gitlab.com"]}'

The response includes shared technologies (used by both) and unique technologies per domain -- useful for competitive analysis.

Practical Applications

Lead Generation -- Filter prospects by technology. Selling a Shopify app? Find sites running Shopify.

Security Auditing -- Combine tech detection with CPE identifiers to check each technology against the NVD vulnerability database.

Migration Planning -- Document a complete tech stack programmatically before migrating.

Market Research -- Analyze hundreds of sites in a market segment to understand technology adoption trends.

Try It Free

100 requests/month on the free tier. No credit card required. Paid plans from $5/mo.

Live Demo -- try it without signing up
Get an API Key on RapidAPI
OpenAPI Spec

I'd love to hear what use cases you'd find most valuable. Drop a comment below or reach out on X (@DetectZeStack).

DEV Community