Check which technologies a list of websites uses

Two different questions

“Which companies use Shopify?” and “Which of these companies use Shopify?” sound alike but need different tools.

Our Tech Enricher is the second kind. It is not a database of every Shopify store: it checks the domains you give it, at run time, and tells you what it finds on each.

Competitor prices are from their public pricing pages, checked 27 September 2026: BuiltWith plans, Wappalyzer pricing.

Check a site by hand

For a handful of domains you don’t need a tool. Everything below is public: it’s what every browser and mail server already sees.

1. View the page source

Open the homepage, press Ctrl+U (Cmd+Option+U on a Mac) and search for these strings:

A caveat: many marketing tags are loaded later by a tag manager, so they never appear in the source. The browser’s developer tools (Network tab) show everything that loads, at the cost of a few minutes per site.

2. Read the response headers

curl -sI https://www.allbirds.com/

Headers name the CDN or host and sometimes the platform. On 27 September 2026 that request returned server: cloudflare, a cf-ray header (Cloudflare again) and powered-by: Shopify. Also look for x-vercel-id (Vercel), x-amz-cf-id (CloudFront) and the content-security-policy header, which lists the outside domains a page is allowed to load scripts from, tag-manager tags included.

3. Look up DNS for the email provider

dig +short MX allbirds.com
dig +short NS allbirds.com
dig +short TXT allbirds.com

The website can’t tell you whether a company is on Google Workspace or Microsoft 365, but its MX records can. The MX with the lowest number is where mail is delivered: aspmx.l.google.com or smtp.google.com means Google Workspace; a host ending in mail.protection.outlook.com means Microsoft 365 (allbirds.com’s only MX is allbirds-com.mail.protection.outlook.com). A host at pphosted.com or mimecast.com is a security gateway in front of the mailbox, so the mailbox provider behind it stays hidden.

The TXT record starting v=spf1 lists the services allowed to send mail as the domain. Its include: entries often name tools the homepage doesn’t show: a hubspotemail.net include means HubSpot is set up to send email for that domain; mail.zendesk.com means Zendesk.

Check a whole list in one run

Tech Enricher does the three checks above for every domain in your list and returns one row per input. Paste domains, URLs or email addresses into Domains on the Apify Store page, or send JSON through the API:

{
  "domains": ["allbirds.com", "gymshark.com", "hubspot.com",
              "https://www.zapier.com/pricing", "jane@stripe.com"],
  "maxConcurrency": 5
}

Each input is reduced to its domain, so https://www.zapier.com/pricing becomes zapier.com and jane@stripe.com becomes stripe.com. Every row keeps your original string in input, so results join back to your sheet.

What that run returned (27 September 2026)

Three things worth noticing:

• The homepage isn’t the whole story. zapier.com’s homepage shows no HubSpot script, but its SPF record includes a hubspotemail.net host. If you sell to HubSpot users, check spfSenders as well as technologies.
• Security gateways hide the mailbox. gymshark.com’s mail goes through Proofpoint, so whether the mailboxes are Google or Microsoft can’t be read from DNS.
• Redirects are followed. gymshark.com redirected our request to us.checkout.gymshark.com; finalUrl shows where the page that was checked actually lives.

Export as CSV, Excel or JSON. To pull out the Shopify stores, filter the technologies column for “Shopify”; for “on WooCommerce, not Shopify”, filter on both. technologiesByCategory groups the same names (Ecommerce, CMS, Analytics, Marketing, CRM, Support, Hosting and so on) if you’d rather have one column per category.

What it detects, and how

• 84 technologies from the homepage: CMS and site builders (WordPress, Webflow, Squarespace, Wix, Drupal, HubSpot CMS, Contentful and more), ecommerce (Shopify, WooCommerce, Magento, BigCommerce), payments (Stripe, PayPal, Braintree), analytics (Google Analytics, Segment, Mixpanel, Amplitude, Hotjar, Meta Pixel and more), marketing (HubSpot, Marketo, Pardot, Klaviyo, Mailchimp and more), CRM (Salesforce, HubSpot CRM, Pipedrive, Zoho SalesIQ, Freshsales), support chat (Intercom, Drift, Zendesk and more), recruiting (Greenhouse, Lever, Ashby, Workable), frontend frameworks, hosting/CDN, fonts, A/B testing and video.
• Where it looks: the homepage HTML, its <script src> URLs, its response headers and its Content-Security-Policy. The CSP catches some tags that a tag manager loads later.
• CRM matches are strict. A CRM counts only when the page loads its script (or the CSP allows it), not when the page merely links to a login page or mentions the name.
• DNS: MX records give emailProvider (lowest MX number first), NS records give dnsProvider, and SPF include:/redirect= targets give spfSenders (up to 10; the domain’s own SPF hosts are followed one level and not listed themselves).
• It respects robots.txt. A domain whose robots.txt disallows the homepage to all crawlers is skipped.

Limits, plainly: 84 technologies is a small fraction of what BuiltWith and Wappalyzer recognise. Only the homepage is checked, so a tool used only on checkout or docs pages won’t show. Pages are fetched, not rendered, so a tag injected by a tag manager is missed unless the CSP names it. Fingerprints favour precision over recall: an empty technologies list means none of the 84 left a visible trace, not that the site uses nothing. No company size, revenue or contacts are included.

What it costs

A domain is charged when its homepage answers with a non-error status and a profile row (found: true) is returned, even if none of the 84 technologies are detected on it. These come back as free rows:

• Sites unreachable over both https and http (DNS failure, TLS error, timeout)
• Homepages that answer HTTP 400 or above, usually a bot wall or error page
• Domains whose robots.txt disallows the homepage
• Inputs that can’t be parsed, bare IP addresses, and localhost or private-network names
• Duplicates: stripe.com, www.stripe.com and jane@stripe.com are one domain, profiled and charged once

Set a max charge per run and the run stops at that amount; every input left over still gets a row with skipped: true, uncharged.

FAQ

How do I find which of my target accounts use Shopify?

Put the account domains into one run and filter technologies for Shopify. Shopify is detected from cdn.shopify.com in the page or a Shopify response header. In our example allbirds.com and gymshark.com matched.

How do I find which accounts use HubSpot?

Look in three places in the output: HubSpot (tracking script), HubSpot CRM (forms or tracking script) and HubSpot CMS (site hosted on HubSpot) in technologies, plus any hubspotemail.net host in spfSenders.

Can I get a list of all websites using a technology?

Not from us. We only check domains you supply. For discovery, BuiltWith and Wappalyzer sell lists built from their crawls; you can then run our check on the list you end up with to confirm what’s live today.

Can I check sites I don’t own?

Yes. The check reads the same public homepage and DNS records any visitor or mail server sees, with no login, and skips sites whose robots.txt asks crawlers to stay off the homepage.

Can I run it from Clay or a spreadsheet?

Yes: through Apify’s integrations (Clay, Make, Zapier) or the API. Using our tools in Clay has the steps.