> Enrich.chat gives AI agents verified work emails and mobiles. To use it from an agent, read https://enrich.chat/agents.md . This is the Markdown version of https://enrich.chat/blog/what-technology-does-a-website-use/ # What technology does a website use? Four ways to check any site Check a site by hand, with a free tool, in a browser extension or through an API. Here is what each method shows, what it misses and how to run it on a whole list of domains. By Enrich.chat Editorial. Updated October 16, 2026. **Short answer:** To find out what technology a website uses, paste its domain into a free checker such as [BuiltWith](https://builtwith.com/plans) or [W3Techs](https://w3techs.com/sites), or press Ctrl+U in Chrome and read the page source and headers. For a list of domains, call an API in a loop. Every method infers the answer from public clues, so treat a result as a lead, not proof. ## Key takeaways - Page source and response headers show the raw clues. In Chrome, press Ctrl+U (Cmd+Option+U on a Mac) and search for strings such as wp-content, cdn.shopify.com or generator. - BuiltWith and Ful.io say single-site lookups are free, W3Techs Site Info opens without a login, and Wappalyzer gives a free account 50 lookups a month (checked October 16, 2026). - Google now documents smtp.google.com as the Workspace MX value, while older domains use aspmx names, so check both when you read mail records. - Detection is inferred. W3Techs says websites can hide most of their technologies and that it visits a site about once a month, so a miss is not proof of non-use. - For a list, BuiltWith's API takes up to 16 domains per lookup and Wappalyzer's up to 10 URLs per request. Enrich.chat's /v1/company/tech takes one domain and uses 5 credits when a stack is found. ## What is the fastest way to check what technology a website uses? The fastest way is a free checker. Paste the domain into [BuiltWith](https://builtwith.com/plans), [W3Techs](https://w3techs.com/sites) or [Ful.io](https://ful.io/pricing) and read the list. To see the evidence yourself, open the page source and response headers in your browser. To check many domains, call an API in a loop. All of these methods infer the answer from public clues, so none of them is proof. A website's technology has layers. There is the platform or CMS (content management system), the front-end code, add-on services such as analytics, chat and payments, a CDN in front, and the mail provider. Each method below reaches some layers and misses others. *Four ways to check a website's technology* | Method | Best for | What it shows | What it misses | | --- | --- | --- | --- | | Developer tools and view-source | One site, when you want to see the evidence | Scripts, tags, headers and cookies as your browser received them | Anything you do not know to look for. Tools behind a login leave no clue | | Free checker | One site, a quick answer | A named list of technologies with categories | Anything its crawler did not see, and changes since its last visit | | Browser extension | Sites you browse anyway | The same kind of list for the page you have open | Sites you do not visit. It needs access to the pages you read | | API | A list of domains | Structured data you can store and re-run | Cost at scale, and each vendor's limits | **Figure 1: Which method should you use to check a website's technology?** A decision path with three questions. If you have more than a few sites, use an API or batch tool. If not, and you need to see the raw evidence, use browser developer tools. If not, and you browse the sites anyway, use a browser extension. Otherwise, use a free checker. *A decision path for choosing a method. The sections below cover each one in turn.* Our guide to [technographic data](https://enrich.chat/blog/technographic-data/) covers how accurate these detections are in published tests. This page covers the practical side: what to click, what to type and how to read what comes back. If you only need one answer, the [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/) tool takes a domain and returns the list. ## How do you find out what CMS a website uses with browser developer tools? Open the page, view its source, search for a few known strings, then read the response headers and cookies. It takes a few minutes per site and shows you the evidence, not just a verdict. The steps below use Chrome, and other browsers have similar tools. ### Step 1: View the page source Press Ctrl+U on Windows or Linux, or Cmd+Option+U on a Mac, to open the page's HTML in a new tab, as [Chrome's shortcut list](https://support.google.com/chrome/answer/157179) shows. Then press Ctrl+F (Cmd+F on a Mac) and search for the strings in the table. The source is the HTML the server sent. The [Chrome DevTools DOM guide](https://developer.chrome.com/docs/devtools/dom) calls this the initial page content, before scripts change anything. *Strings to search for in the page source* | Technology | Search the source for | What the open fingerprint matches | | --- | --- | --- | | WordPress | `wp-content`, `wp-includes` | Stylesheet and script paths in those folders, and a generator tag reading WordPress ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/w.json)) | | Shopify | `cdn.shopify.com` | Scripts loaded from that host ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json)) | | Wix | `static.parastorage.com` | Scripts from that host, and a generator tag reading Wix.com Website Builder ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/w.json)) | | Webflow | `data-wf-site` | That attribute on the html element, and a generator tag reading Webflow ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/w.json)) | | Drupal | `Drupal`, `/sites/default/` | A generator tag, and theme or module paths under /sites/ ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/d.json)) | | Google Tag Manager | `googletagmanager.com/gtm.js` | The tag manager script ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/g.json)) | | HubSpot | `hs-scripts.com` | The tracking script host ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json)) | | Stripe | `js.stripe.com` | The payments script ([fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json)) | Also search for `generator`. [MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name) lists it as a standard meta name for the software that generated the page, and the fingerprints for WordPress, Wix, Webflow and Drupal read it. A site owner can remove the tag, so finding nothing proves nothing. ### Step 2: Read the response headers Press F12 (Ctrl+Shift+I, or Cmd+Option+I on a Mac) to open [Chrome DevTools](https://developer.chrome.com/docs/devtools/open), choose the Network panel and reload the page. Select the first request, open the Headers tab and scroll to Response Headers, as the [Network reference](https://developer.chrome.com/docs/devtools/network/reference) describes. Four headers are worth reading. - `server` describes the software of the origin server, according to [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server). MDN also warns that fine detail here can make known flaws easier to find, so a site may send little. Behind a CDN, the value can be the CDN's name. The [Cloudflare fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/c.json) matches a server value of cloudflare, and [Cloudflare's docs](https://developers.cloudflare.com/fundamentals/reference/http-request-headers/) say it adds a Cf-Ray header to responses. - `x-powered-by` is a non-standard header that names the application or framework, such as express, says [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By). - `link` with `rel="https://api.w.org/"` is how WordPress announces its REST API, per the [WordPress developer docs](https://developer.wordpress.org/rest-api/using-the-rest-api/discovery/). The API root ends in `/wp-json/`. - `x-generator` is read by the [Drupal fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/d.json). A terminal gives the same data. The command `curl -sI https://acme.com` prints only the headers, because [curl's -I option](https://curl.se/docs/manpage.html) fetches the headers only. It sends a HEAD request, so compare with DevTools if a header you expected is missing. ### Step 3: Check cookies and the live page In DevTools, open Application, then Storage, then Cookies, as [Chrome's cookie guide](https://developer.chrome.com/docs/devtools/application/cookies) describes. Cookie names can name a platform. The [Shopify fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json) lists `_shopify_y`, and the Drupal fingerprint matches cookies that start with SESS. Next, open the Console and type `window.Shopify` or `window._hsq`, then press Enter, as the [Console guide](https://developer.chrome.com/docs/devtools/console/javascript) explains. A value means the page defined that variable, and `undefined` means it did not. The names come from the Shopify and [HubSpot fingerprints](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json). The Console reads the live page, and the Chrome docs note that the live DOM can differ from the HTML source once scripts run. A tag that a script adds can show up in the Console and not in view-source. **Figure 2: Six clues and what each suggests.** Six real clue patterns from the open fingerprints and vendor docs, grouped by where you find them. In the page source: a wp-content path suggests WordPress, js.stripe.com suggests Stripe, and googletagmanager.com/gtm.js suggests Google Tag Manager. In response headers: server cloudflare suggests Cloudflare, and a link header with rel api.w.org suggests the WordPress REST API. In DNS: an MX record of smtp.google.com suggests Google Workspace. One clue is a lead, and two or three that agree are evidence. *Real clue patterns and what they suggest. Sources: the open fingerprints in [enthec/webappanalyzer](https://github.com/enthec/webappanalyzer), the [WordPress developer docs](https://developer.wordpress.org/rest-api/using-the-rest-api/discovery/) and [Google's MX setup page](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace).* Figure 2 shows how to weigh what you find. The open fingerprints tag weaker patterns with a [confidence value](https://github.com/enthec/webappanalyzer), and the aim is a combined 100%. The plain Shopify variable carries 25 in the Shopify fingerprint, so it needs a second clue. Treat one clue as a lead. Treat two or three that agree as evidence. Developer tools show only what the public page, its headers and its cookies carry. W3Techs says that [technologies visible only after a login or another user action may stay undetected](https://w3techs.com/disclaimer). If a tool lives behind a login, expect no clue on the public page. ## Can DNS records show the email and SaaS tools a website uses? Yes, for some of them. DNS records are public, and a company's mail provider and some verified services appear as records on its domain. On macOS or Linux, run `dig +short MX acme.com`. On Windows, run `nslookup -type=MX acme.com`. The [dig manual](https://bind9.readthedocs.io/en/latest/manpages.html) and Microsoft's [nslookup page](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup) cover both. ``` $ dig +short MX acme.com 1 smtp.google.com. $ dig +short TXT acme.com "v=spf1 include:_spf.google.com include:servers.mcsv.net ~all" "hubspot-domain-verification=abc123" ``` That output is made up for a fictional domain. In real output, look for four kinds of record. - **MX records** show where mail goes. [Google](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace) says the Google Workspace value is smtp.google.com, and that domains set up before 2023 may have older values that start with aspmx. The open [Google Workspace fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/g.json), as read on October 16, 2026, lists aspmx.l.google.com and googlemail.com but not smtp.google.com, so read newer domains by eye. The [Microsoft 365 fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/m.json) matches outlook.com in the MX record. - **SPF records** are TXT records that list the services allowed to send mail. [Google's SPF guide](https://knowledge.workspace.google.com/admin/security/set-up-spf) shows include:_spf.google.com, plus include:servers.mcsv.net when Mailchimp also sends. [Microsoft's DNS guide](https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider) shows include:spf.protection.outlook.com. - **Verification records** are TXT records a vendor asks a customer to add. The fingerprints match hubspot-domain-verification ([HubSpot](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json)) and stripe-verification= ([Stripe](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json)). - **Name server records** show who runs the domain's DNS. The Cloudflare fingerprint matches name servers that end in cloudflare.com. DNS describes a domain's email and connected services, not the website's code. A missing record proves nothing. Our [tech stack lookup guide](https://enrich.chat/tools/tech-stack-lookup/) explains how fingerprints use each signal type. ## Which free tools show what a website is built with? Several tools show a site's technologies without a paid plan. BuiltWith, Ful.io and W3Techs let you look up one site for free, Wappalyzer gives a free account 50 lookups a month, and WhatCMS and CRFT Lookup are free to try. The table lists each tool's free use and its paid plans, as read on October 16, 2026. *Free website technology checkers and their paid plans (checked October 16, 2026)* | Tool | Free use | What the result shows | Paid plans | | --- | --- | --- | --- | | [BuiltWith](https://builtwith.com/plans) | Individual site lookups | A profile grouped by type, such as analytics, widgets and hosting | Basic $295, Pro $495, Team $995 a month | | [W3Techs Site Info](https://w3techs.com/sites) | Reports open without a login | CMS, programming language, web server and hosting, with versions where known | API only: 100 euros per 1,000 requests | | [Wappalyzer](https://www.wappalyzer.com/pricing/) | Free account, 50 lookups a month | Technologies from its database | Pro $250, Business $450, Enterprise from $850 a month | | [Ful.io](https://ful.io/pricing) | Single-site lookups | The full stack: CMS, frameworks, analytics, hosting, payments | Individual $99, Professional $199, Business $399 a month | | [WhatCMS](https://whatcms.org/API) | Web check, plus a free API plan of 500 detections a month | The CMS and other technologies, such as hosting and languages | From $20 a month for 10,000 detections | | [CRFT Lookup](https://crft.studio/lookup) | Free, with unlimited scans, per its FAQ | Tech stack, plus speed scores, sitemap and meta tags | None. The studio sells design services | The tools differ in how they look. CRFT's FAQ says it loads each site in a headless Chromium browser, so it can read pages that build themselves with JavaScript. W3Techs says it [fetches pages the way a search engine does](https://w3techs.com/faq) and searches them for patterns. ### How do you read a checker's result? Start with the platform or CMS, then read hosting, CDN, analytics, tag manager, payments and email. Then check four things. - **Where it was seen.** W3Techs marks a tool it found only on [inner pages, on a subdomain or "until recently"](https://w3techs.com/sites/info/wordpress.org), and its [API docs](https://w3techs.com/apidoc) list inner pages only and subdomains only as locations. - **Live or dead.** [BuiltWith's free API](https://api.builtwith.com/free-api) reports, for each group of technologies, how many it considers live on the domain and how many it considers no longer live. A tool that is gone can still appear in an old list. - **Freshness.** W3Techs says it visits a site [about once a month](https://w3techs.com/faq). Wappalyzer's API [returns results verified in the last two months by default](https://www.wappalyzer.com/docs/api/v2/lookup/). - **Disagreement.** Two checkers can disagree, because each has its own patterns and crawl schedule. W3Techs says it uses several thousand indicators with different priorities. Compare two before you rely on one. For a longer comparison, see our pages on [BuiltWith alternatives](https://enrich.chat/alternatives/builtwith/), [Wappalyzer alternatives](https://enrich.chat/alternatives/wappalyzer/) and [BuiltWith pricing](https://enrich.chat/blog/builtwith-pricing/). ## Should you use a browser extension to check a website's technology? Use one if you look at many sites while you browse. An extension shows the technologies of the page you have open, with no copy and paste. [Wappalyzer lists extensions](https://www.wappalyzer.com/apps/) for Chrome, Firefox, Edge and Safari. [BuiltWith offers extensions](https://builtwith.com/toolbar) for Chrome, Firefox and Edge, plus a bookmarklet. [W3Techs offers](https://w3techs.com/sites) a Chrome extension, a Firefox add-on and a bookmarklet. Weigh the privacy cost first. An extension that reads pages needs access to them. Chrome lets you set an extension's site access to "When you select the extension", so it reads a page only when you click it, as [Chrome Help](https://support.google.com/chrome/answer/187443) explains. Wappalyzer's FAQ says its data combines [limited information collected through its browser extension](https://www.wappalyzer.com/faq/), under its privacy policy. Read the policy of any extension before you install it. A bookmarklet needs no install. W3Techs says you drag it to your bookmarks bar and click it whenever you want the technologies of the site you are on. An extension or bookmarklet reads one page at a time and does nothing for a list. For a list, use the recipe below. ## How far can you trust a result, and what do these methods miss? Treat a result as a lead, not a fact. Every method here infers a technology from public traces, and the vendors say so. For measured error rates, read our guide to [technographic data](https://enrich.chat/blog/technographic-data/), which covers the Web Almanac and the USENIX study. Six limits matter when you check a site. - **Sites can hide things.** W3Techs's FAQ says [websites can choose to hide most of their technologies](https://w3techs.com/faq), and its disclaimer says its results may be incomplete or wrong. - **Login and interaction.** W3Techs's [disclaimer](https://w3techs.com/disclaimer) says it does not mimic user interaction and may miss a tool that is not on every page. - **Implied, not seen.** W3Techs's FAQ says that when it finds WordPress it counts PHP as used too, and that a fair share of its data comes from such dependencies. The open fingerprints have an [implies field](https://github.com/enthec/webappanalyzer) for the same reason. - **One weak clue.** A pattern tagged with low confidence can match by accident. Look for a second clue from a different place, such as a header and a script. - **Old data.** Wappalyzer's API docs say that [older results are more likely to include sites that no longer use the technology](https://www.wappalyzer.com/docs/api/v2/lookup/). - **A CDN in front.** Headers can describe the CDN instead of the server behind it, as the Cloudflare example above shows. Three habits keep you honest. Confirm with a second method, for example a checker plus the page source. Note the date of the check. And write "not found" when nothing comes back, never "does not use". ## How do you check the technology of a whole list of websites? Clean the list, send one domain at a time to an API, save every result with the date, and label the misses. A loop of a few lines does the job. Figure 3 shows the six steps. **Figure 3: Six steps for checking a list of domains.** A six-step recipe in two rows. Step one, clean the list to bare domains without duplicates. Step two, call the API once per domain and retry after a 429. Step three, save each result with the date. Step four, mark the misses as not found. Step five, spot-check ten domains by hand. Step six, run it again on a schedule. *A six-step recipe for checking a list of domains. Only step 2 needs an API.* ### What does each step involve? 1. **Clean the list.** Reduce each entry to a bare domain: drop https://, paths and www, then remove duplicates. Tools fold subdomains into the main domain. [W3Techs](https://w3techs.com/apidoc) says a request for www.example.com returns the technologies of example.com including its subdomains, and [BuiltWith's free API](https://api.builtwith.com/free-api) returns root-domain results only. A site on its own subdomain, such as a help center, may need its own check. 2. **Call the API once per domain.** Stay under the vendor's rate limit. [Wappalyzer lists 10 requests per second](https://www.wappalyzer.com/docs/api/v2/lookup/), and [WhatCMS's free plan allows one URL every 10 seconds](https://whatcms.org/API). If an API answers 429, which means too many requests, wait and retry. 3. **Save the whole result.** Keep whether it was found, the list of technologies, what the call used and the date. A date column lets you re-check old rows later. 4. **Label the misses.** A domain with no result is "not found". W3Techs's disclaimer lists reasons a technology can go undetected, so a miss says nothing about use. 5. **Spot-check ten.** Open ten domains from the list and check them by hand with the steps above. If the list and your own check often disagree, switch tools or treat the list as hints. 6. **Run it again later.** Stacks change. W3Techs says it visits a site about once a month, so a monthly re-check matches that pace. ### Which tools take a list? Seven options can check a list, some in one request and some in a loop. Prices come from each vendor's own pages, checked October 16, 2026. *Ways to check a list of domains (checked October 16, 2026)* | Option | How it takes a list | Price | Needs | | --- | --- | --- | --- | | [BuiltWith Domain API](https://api.builtwith.com/domain-api) | Up to 16 domains per lookup, plus a bulk jobs endpoint for larger lists | The page states no per-lookup price | A BuiltWith account and API key | | [Wappalyzer lookup API](https://www.wappalyzer.com/docs/api/v2/lookup/) | Up to 10 URLs per request, cached results by default | Business plan, $450 a month, 1 credit per URL | A paid plan | | [Ful.io](https://ful.io/pricing) | A bulk websites lookup in the Individual plan | $99 a month. API and MCP server from the $199 Professional plan | A paid plan | | [WhatCMS batch](https://whatcms.org/API) | Upload a list, download JSON or CSV | The free plan has no batch. From $20 a month for 10,000 detections | An account | | [W3Techs Site Info API](https://w3techs.com/apidoc) | One domain per request | 100 euros per 1,000 requests, excluding VAT | An account and purchased requests | | [httpx](https://github.com/projectdiscovery/httpx) (open source) | Reads a file of hosts and prints technologies with the -td flag | Free under the MIT licence | A command line. It fetches each site from your own network | | Enrich.chat | One domain per request, from a script or an AI agent | 10 free lookups a day, then plans from $29 a month | Nothing for the free tier | The open-source route needs care. The httpx README lists a default rate limit of 150 requests per second and 50 threads, so set a lower rate before you point it at a list, for example `httpx -l domains.txt -td -rl 5 -j -o stacks.jsonl`. Its -td flag reports technologies using the Wappalyzer dataset. It sends real requests to each site, so keep the rate low. ## How do you check a website's technology with Enrich.chat? Send the domain to `GET /v1/company/tech`. Enrich.chat returns the technologies found for that domain, each with a category, or `found: false` and no charge. The free tier needs no key and no signup. Like every source in this guide, its result is a signal to check, not a confirmed fact. ```text Use www.enrich.chat to check the tech stack of every domain in my list. Clean each entry to a bare domain, look up each domain once, and give me a table with the domain, the technologies with their categories, and today's date. Mark any domain with no result as not found, and do not add a technology the API did not return. ``` Behind that prompt, your agent sends one GET request per domain: ``` GET https://enrich.chat/v1/company/tech?domain=acme.com { "found": true, "domain": "acme.com", "company": "Acme Logistics", "technologies": [ {"name": "Google Workspace", "category": "Email"}, {"name": "HubSpot", "category": "CRM"} ], "credits_used": 5, "free_lookups_remaining": 9 } ``` To run a file of domains yourself, save the script below as `check_stacks.py` next to a `domains.txt` file with one domain or URL per line. It needs Python 3.9 or newer and no extra packages. It cleans and de-duplicates the list, retries after a 429, stops if the API returns an error such as the free limit, and writes one row per domain with the date. ``` import csv, json, time, urllib.error, urllib.parse, urllib.request from datetime import date API = "https://enrich.chat/v1/company/tech" def clean(entry): url = entry if "//" in entry else "//" + entry host = urllib.parse.urlparse(url).hostname or "" return host.removeprefix("www.") def lookup(domain): url = API + "?" + urllib.parse.urlencode({"domain": domain}) for attempt in range(3): try: with urllib.request.urlopen(url, timeout=30) as r: return json.load(r) except urllib.error.HTTPError as e: body = json.load(e) if e.code in (429, 503): time.sleep(body.get("retry_after", 5)) continue return body return {"error": "gave_up"} lines = [x.strip() for x in open("domains.txt") if x.strip()] domains = sorted({clean(x) for x in lines}) with open("stacks.csv", "w", newline="") as f: out = csv.writer(f) out.writerow(["domain", "status", "technologies", "credits_used", "checked"]) for d in domains: r = lookup(d) if r.get("error"): print("Stopped at", d, "-", r["error"]) break found = r.get("technologies", []) techs = "; ".join(f'{t["name"]} ({t["category"]})' for t in found) status = "found" if r.get("found") else "not found" out.writerow([d, status, techs, r.get("credits_used", 0), date.today()]) time.sleep(1) ``` Prefer the shell? This loop prints the raw JSON for each domain: ``` while read d; do curl -s "https://enrich.chat/v1/company/tech?domain=$d"; echo; sleep 1 done < domains.txt ``` A stack found uses 5 credits, and a domain with no result uses 0 and does not count against your free lookups. Checking 1,000 domains uses 5,000 credits if every domain matches, which fits the Growth plan at $29 a month. A list of 50,000 domains needs 250,000 credits, which fits the Scale plan at $90 a month. Each IP address gets 10 free lookups a day with no signup, so the free tier covers a short list, and the API answers 402 when the free limit is reached. The [API docs](https://enrich.chat/docs/) list the rate limit, and the script above waits and retries when it is hit. See [pricing](https://enrich.chat/pricing/) for every plan. ### What does the Enrich.chat lookup not do? - It takes one domain per request, so a list needs a loop or an agent. Company search can list companies in its records that use a tool (25 to a page), but it cannot list every site on the web that uses one. For that, use a reverse-lookup vendor such as BuiltWith, or browse the [companies using directory](https://enrich.chat/companies-using/). - It returns a plain list with a category for each technology. It has no first-seen dates, confidence score or history. - It is not a browser extension. For the page you are reading, use one of the extensions above. The same lookup is the `company_tech_stack` tool on the MCP server described on the [install page](https://enrich.chat/install/), and the free [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/) takes one domain in a browser. To go from a stack to the people at the company, pair it with the [company enrichment API](https://enrich.chat/api/company-enrichment/). To run the loop without code, see the guides for [n8n](https://enrich.chat/blog/n8n-lead-enrichment/) and [Google Sheets](https://enrich.chat/integrations/google-sheets/), and the page on [Enrich.chat for AI agents](https://enrich.chat/agents/). ## Frequently asked questions ### How do I find out what a website is built with? Use a free checker such as [BuiltWith](https://builtwith.com/plans), [W3Techs](https://w3techs.com/sites) or [Ful.io](https://ful.io/pricing): paste the domain and read the list. To see the evidence yourself, press Ctrl+U in Chrome and search the source for clues such as wp-content or cdn.shopify.com, then read the response headers in DevTools. Results are inferred from public clues, so confirm anything that matters with a second method. ### How can I tell if a website uses WordPress? View the page source and search for wp-content or wp-includes, which the open [WordPress fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/w.json) matches in stylesheet and script paths. WordPress also announces a link with rel="https://api.w.org/" in the page head and response headers, and its API root is /wp-json/, per the [WordPress developer docs](https://developer.wordpress.org/rest-api/using-the-rest-api/discovery/). A site can hide these, so a missing clue does not prove it is not WordPress. ### Is there a free tool to check what a website is built with? Yes. [BuiltWith](https://builtwith.com/plans) says individual site lookups are free, [Ful.io](https://ful.io/pricing) says single-site lookups are free, and [W3Techs Site Info](https://w3techs.com/sites) opens without a login. [Wappalyzer](https://www.wappalyzer.com/pricing/) gives a free account 50 lookups a month. Limits change, so check each page. Enrich.chat's free [tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/) gives 10 checks with no signup. ### Can you see the backend technology of a website? Only some of it. Response headers such as [server](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server) and [x-powered-by](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By) can name the web server or framework, but MDN warns that detailed values make known flaws easier to find, so a site may send little. A CDN can also show its own name in front. Databases and internal tools behind a login leave no public clue. ### How can I tell which email provider a domain uses? Look up its MX records: run dig +short MX acme.com, or nslookup -type=MX acme.com on Windows. [Google](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace) says the Workspace value is smtp.google.com, and domains set up before 2023 may use older aspmx names. A value containing outlook.com points to Microsoft 365, per the open [fingerprint](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/m.json). SPF TXT records list other services that send mail. ### Can I check the technology of many websites at once? Yes, with an API or a batch tool. [BuiltWith's Domain API](https://api.builtwith.com/domain-api) takes up to 16 domains per lookup, [Wappalyzer's lookup API](https://www.wappalyzer.com/docs/api/v2/lookup/) takes up to 10 URLs per request on its Business plan, and [WhatCMS](https://whatcms.org/API) offers batch processing from $20 a month (checked October 16, 2026). Enrich.chat's /v1/company/tech takes one domain per request, so a script or an AI agent loops over your list. ## Sources 1. [Chrome keyboard shortcuts](https://support.google.com/chrome/answer/157179) 2. [Open Chrome DevTools](https://developer.chrome.com/docs/devtools/open) 3. [Network features reference](https://developer.chrome.com/docs/devtools/network/reference) 4. [View and change the DOM](https://developer.chrome.com/docs/devtools/dom) 5. [View, edit and delete cookies](https://developer.chrome.com/docs/devtools/application/cookies) 6. [Run JavaScript in the Console](https://developer.chrome.com/docs/devtools/console/javascript) 7. [Manage extensions and site access in Chrome](https://support.google.com/chrome/answer/187443) 8. [HTML meta name attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name) 9. [Server header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server) 10. [X-Powered-By header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Powered-By) 11. [REST API discovery](https://developer.wordpress.org/rest-api/using-the-rest-api/discovery/) 12. [Cloudflare HTTP request headers](https://developers.cloudflare.com/fundamentals/reference/http-request-headers/) 13. [webappanalyzer: open Wappalyzer-format fingerprints (README)](https://github.com/enthec/webappanalyzer) 14. [WordPress, Wix and Webflow fingerprints, src/technologies/w.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/w.json) 15. [Shopify and Stripe fingerprints, src/technologies/s.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/s.json) 16. [Drupal fingerprint, src/technologies/d.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/d.json) 17. [Google Tag Manager and Google Workspace fingerprints, src/technologies/g.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/g.json) 18. [HubSpot fingerprint, src/technologies/h.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/h.json) 19. [Cloudflare fingerprint, src/technologies/c.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/c.json) 20. [Microsoft 365 fingerprint, src/technologies/m.json](https://github.com/enthec/webappanalyzer/blob/main/src/technologies/m.json) 21. [Set up MX records for Google Workspace](https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace) 22. [Set up SPF for Google Workspace](https://knowledge.workspace.google.com/admin/security/set-up-spf) 23. [Connect your domain by adding DNS records](https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-with-domains/create-dns-records-at-any-dns-hosting-provider) 24. [dig manual (BIND 9)](https://bind9.readthedocs.io/en/latest/manpages.html) 25. [nslookup](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup) 26. [curl manual](https://curl.se/docs/manpage.html) 27. [BuiltWith plans and pricing](https://builtwith.com/plans) 28. [BuiltWith browser extensions](https://builtwith.com/toolbar) 29. [BuiltWith Domain API documentation](https://api.builtwith.com/domain-api) 30. [BuiltWith Free API documentation](https://api.builtwith.com/free-api) 31. [W3Techs Site Info](https://w3techs.com/sites) 32. [W3Techs site info report for wordpress.org](https://w3techs.com/sites/info/wordpress.org) 33. [W3Techs FAQ](https://w3techs.com/faq) 34. [W3Techs disclaimer](https://w3techs.com/disclaimer) 35. [W3Techs Site Info API](https://w3techs.com/apidoc) 36. [Wappalyzer plans and pricing](https://www.wappalyzer.com/pricing/) 37. [Wappalyzer technology lookup API](https://www.wappalyzer.com/docs/api/v2/lookup/) 38. [Wappalyzer apps and browser extensions](https://www.wappalyzer.com/apps/) 39. [Wappalyzer FAQ](https://www.wappalyzer.com/faq/) 40. [Ful.io plans and pricing](https://ful.io/pricing) 41. [WhatCMS API and batch plans](https://whatcms.org/API) 42. [CRFT Lookup](https://crft.studio/lookup) 43. [httpx README](https://github.com/projectdiscovery/httpx) ## Try this prompt Check one site's tech stack ```text Use www.enrich.chat to look up the tech stack of acme.com. List each technology with its category, and say so if nothing was found. ``` ## Related - [Tech stack lookup](https://enrich.chat/tools/tech-stack-lookup/) - [What is technographic data?](https://enrich.chat/blog/technographic-data/) - [Companies using a technology](https://enrich.chat/companies-using/)