# Website Intelligence Scanner — Tech Stack, Security & Contacts (`darknezz/website-intelligence-scanner`) Actor

Detect any website's full technology stack (CMS, JS frameworks, analytics, e-commerce, CDN) plus a security-header grade, contact emails and social profiles — all in one scan. Perfect for lead qualification, competitor research, and SEO audits.

- **URL**: https://apify.com/darknezz/website-intelligence-scanner.md
- **Developed by:** [Oaida Adrian](https://apify.com/darknezz) (community)
- **Categories:** Lead generation, SEO tools, Developer tools
- **Stats:** 2 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 website scanneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Website Intelligence Scanner — Tech Stack, Security & Contacts

Scan any list of websites and get back a complete **intelligence profile** for each one in a single structured JSON item: technology stack, marketing pixels, hosting/CDN, a security grade, and contact details — no login, no API key, no proxy required.

Built for lead-qualification, CRM enrichment, competitor research and security audits. Point it at a list of URLs, get back a decision-ready dataset.

### Why this Actor

- **One pass, everything** — a single scan returns CMS, JS frameworks, analytics, e-commerce platforms, CDN/hosting, security grade *and* emails/social links. No stitching together three separate tools.
- **No JavaScript rendering needed** — fingerprints are read from raw HTML and HTTP headers, which is where the vast majority of stack signals live. That keeps scans fast, cheap and reliable.
- **Bulk by design** — scan 5 sites or 5,000. Websites are processed concurrently (5 at a time) and each produces exactly one dataset item.
- **Security grading included** — an A+ to F grade from 6 key HTTP security headers, so you can triage a whole portfolio in one run.
- **Pay per website** — a small fee per scanned site, no subscription, no minimums.

### Who is this for?

- **Agencies & freelancers** — qualify prospects by stack ("show me WordPress sites with no analytics that would benefit from a redesign pitch").
- **Sales teams** — enrich CRM records with technology and contact data before the first call.
- **Competitive intelligence** — see exactly what your competitors run and how they track visitors.
- **Security & SEO audits** — bulk-grade security headers across a portfolio of client or partner sites.

### Input

```json
{
  "websites": ["https://example.com", "shopify.com", "https://www.wikipedia.org"],
  "extractContacts": true,
  "checkSecurity": true,
  "timeoutSecs": 30
}
```

| Field | Type | Default | Description |
|---|---|---|---|
| `websites` | array of string | — | URLs or bare domains to scan. `https://` is added automatically. **Required.** |
| `extractContacts` | boolean | `true` | Extract emails and social profile links from the homepage. |
| `checkSecurity` | boolean | `true` | Grade HTTP security headers (A+ to F) and list missing ones. |
| `timeoutSecs` | integer | `30` | Per-website fetch timeout in seconds. |

### Output (one item per website)

```json
{
  "url": "https://example-store.com",
  "finalUrl": "https://www.example-store.com/",
  "statusCode": 200,
  "responseTimeMs": 412,
  "title": "Example Store — Handmade Goods",
  "cms": "Shopify",
  "frameworks": ["jQuery", "Tailwind CSS"],
  "analytics": ["Google Analytics 4", "Facebook Pixel", "Hotjar"],
  "ecommerce": ["Shopify", "Stripe"],
  "cdn": "Cloudflare",
  "securityGrade": "B",
  "securityScore": 4,
  "missingSecurityHeaders": ["content-security-policy", "permissions-policy"],
  "emails": ["hello@example-store.com"],
  "socialProfiles": ["https://instagram.com/examplestore", "https://www.linkedin.com/company/example-store"]
}
```

#### Field glossary

| Field | Meaning |
|---|---|
| `cms` / `frameworks` | Site builder (WordPress, Shopify, Wix, Webflow…) and JS frameworks (Next.js, React, Vue, Angular…). Unknown stacks return `null` rather than a guess. |
| `analytics` | Marketing stack: GA4, GTM, Facebook Pixel, Hotjar, Plausible, Intercom and more. |
| `ecommerce` | Storefront + payment platforms detected (Shopify, WooCommerce, Stripe…). |
| `cdn` | CDN/hosting fingerprint (Cloudflare, Vercel, Netlify, CloudFront…) from headers and HTML. |
| `securityGrade` | A+ to F based on 6 key security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. `securityScore` is the raw count (0–6), `missingSecurityHeaders` names the gaps. |
| `emails` / `socialProfiles` | Contact signals found on the homepage (email addresses, LinkedIn/X/Facebook/Instagram/GitHub links…). |

### Run it from the API

```bash
curl -X POST "https://api.apify.com/v2/acts/darknezz~website-intelligence-scanner/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"websites":["example.com","shopify.com","stripe.com"]}'
```

**Scheduling:** attach an Apify Schedule to re-scan a fixed prospect list weekly — technology and security posture change, and a fresh dataset keeps your outreach accurate.

### Use cases

- 🎯 **Lead qualification** — filter a scraped prospect list by stack ("has no analytics", "runs WooCommerce", "no security headers") before you send the first email.
- 🗂️ **CRM enrichment** — append tech stack, security grade and contacts to every company record.
- 🕵️ **Competitor teardown** — map what the market leader runs: CMS, analytics, CDN, checkout stack.
- 🛡️ **Security triage** — grade every site in your portfolio for the six headers security teams and buyers check first.
- 🔁 **Prospecting refreshes** — scheduled re-scans keep your lead data from going stale.

### Pricing

Pay per event: you are charged a small fee **per website scanned**, plus Apify's standard platform events (actor start + dataset item). No subscriptions, no minimums — scan 5 sites or 5,000.

### FAQ

**Does it render JavaScript?** No — it analyzes the raw HTML and HTTP headers, which is where the vast majority of fingerprints live. That's what keeps it fast and cheap. For JS-rendered stacks, combine with an Apify browser crawler.

**How accurate is the CMS detection?** Fingerprints cover the 12 most popular CMS/site builders plus the `generator` meta tag as a fallback. Unknown stacks return `null` rather than a guess.

**Can I scan thousands of sites?** Yes — websites are scanned concurrently (5 at a time) and each one produces exactly one dataset item. Rate yourself against Apify's dataset-item limits.

**What does the security grade really mean?** It's a transparent score: 6 security headers checked, each worth 1 point. A+ = all 6 present, F = none. The `missingSecurityHeaders` array tells you exactly what to fix.

**Do bare domains work?** Yes — `https://` is prepended automatically. `example.com` and `https://example.com` behave identically.

**Is scanning these sites allowed?** You should only scan sites you own or have permission to probe, and comply with each site's terms of service and applicable law.

# Actor input Schema

## `websites` (type: `array`):

List of website URLs to scan (e.g. https://example.com). Bare domains work too.

## `extractContacts` (type: `boolean`):

Extract contact emails and social profile links found on the homepage.

## `checkSecurity` (type: `boolean`):

Grade the site's HTTP security headers (HSTS, CSP, X-Frame-Options, ...) from A+ to F.

## `timeoutSecs` (type: `integer`):

Per-website request timeout in seconds.

## Actor input object example

```json
{
  "websites": [
    "https://www.wordpress.org",
    "https://vercel.com"
  ],
  "extractContacts": true,
  "checkSecurity": true,
  "timeoutSecs": 30
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `url` (type: `string`):

No description

## `finalUrl` (type: `string`):

No description

## `statusCode` (type: `string`):

No description

## `responseTimeMs` (type: `string`):

No description

## `title` (type: `string`):

No description

## `cms` (type: `string`):

No description

## `frameworks` (type: `string`):

No description

## `analytics` (type: `string`):

No description

## `ecommerce` (type: `string`):

No description

## `cdn` (type: `string`):

No description

## `server` (type: `string`):

No description

## `securityGrade` (type: `string`):

No description

## `securityScore` (type: `string`):

No description

## `emails` (type: `string`):

No description

## `error` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "websites": [
        "https://www.wordpress.org",
        "https://vercel.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("darknezz/website-intelligence-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "websites": [
        "https://www.wordpress.org",
        "https://vercel.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("darknezz/website-intelligence-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "websites": [
    "https://www.wordpress.org",
    "https://vercel.com"
  ]
}' |
apify call darknezz/website-intelligence-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=darknezz/website-intelligence-scanner",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/1fxPIZlHS2zhxzAs1/builds/z48v7JfGbvdfFDeyS/openapi.json