DetectZeStack vs WhatRuns: API Access vs Browser Extension

If you've searched for "WhatRuns API key," you've already discovered the problem: WhatRuns doesn't have an API. It's a browser extension—great for quick manual lookups, but impossible to integrate into automated workflows, CI/CD pipelines, or lead enrichment systems.

DetectZeStack is a REST API built for exactly this gap. You get programmatic access to technology detection with DNS and TLS analysis layers that browser extensions can't provide.

The Core Difference

WhatRuns detects technologies by running JavaScript in your browser. It analyzes the page you're viewing and shows the results in a popup. It works well for what it does, but it's inherently limited to manual, one-at-a-time lookups from a desktop browser.

DetectZeStack is a server-side API. You send an HTTP request, you get structured JSON back. It can be called from scripts, cron jobs, backend services, or any language with an HTTP client. Plus, it sees things browsers can't—DNS records and TLS certificates.

Feature Comparison

There Is No WhatRuns API Key

This is the most common misconception. People search for "WhatRuns API," "WhatRuns API key," or "WhatRuns API documentation" expecting to find programmatic access. It doesn't exist. WhatRuns is exclusively a Chrome/Firefox extension with no REST API, no webhooks, and no way to integrate with external systems.

If you need to detect website technologies programmatically—whether for lead enrichment, security auditing, competitive analysis, or monitoring—you need an API. DetectZeStack provides exactly that.

What DetectZeStack Catches That WhatRuns Misses

Browser extensions can only see what's in the rendered page: HTML meta tags, JavaScript globals, CSS classes, and HTTP headers visible to the browser. DetectZeStack adds two detection layers that are invisible to extensions:

DNS-based detection

By resolving CNAME records, DetectZeStack identifies CDN providers (Cloudflare, Fastly, CloudFront), hosting platforms (Netlify, Vercel, GitHub Pages), and email services—all without touching the website itself. WhatRuns sees none of this because browser extensions don't have access to DNS resolution.

TLS certificate analysis

DetectZeStack inspects the TLS certificate chain to identify certificate authorities (Let's Encrypt, DigiCert, Sectigo) and extract organizational details. This reveals infrastructure decisions that don't appear anywhere in the HTML.

Quick Start

Get your API key from RapidAPI (free, no credit card) and make your first request:

curl -s "https://detectzestack.p.rapidapi.com/analyze?url=example.com" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" | jq '.'

The response includes every detected technology with categories, confidence scores, and CPE identifiers when available.

Batch analysis

Analyze up to 10 sites in a single request:

curl -X POST "https://detectzestack.p.rapidapi.com/analyze/batch" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["stripe.com", "shopify.com", "github.com"]}'

Track changes over time

Every scan creates a snapshot. The /changes endpoint gives you a queryable feed of every technology addition, removal, and version change—with tier-gated history from 7 days (free) to 365 days (Mega plan).

When to Use Which

See how DetectZeStack compares to other tools: BuiltWith vs Wappalyzer vs DetectZeStack | Wappalyzer vs WhatRuns