- How do I install madeitbelgium/wappalyzer in a Laravel app?
- Install it with Composer using the package name madeitbelgium/wappalyzer, then call the detector from a queued job or service class rather than directly in a controller. The package is described as a single call per URL, so most integration work is around storing results and controlling outbound requests. Check the repository for the exact class names and configuration options before wiring it in.
- Is madeitbelgium/wappalyzer compatible with Laravel 9, 10 and 11?
- The technical evaluation targets Laravel 9–11 and PHP 8.1+ as the likely stack fit, but you should confirm the actual support matrix in composer.json. Because it is primarily a PHP library with a Laravel wrapper, framework coupling may be limited. Test against your exact Laravel and PHP versions before committing.
- Can madeitbelgium/wappalyzer detect JavaScript-rendered technologies like SPAs and client-side analytics?
- No. It is server-side only: it fetches the URL, parses the HTTP response, and matches headers, HTML, cookies, and other static signals. It does not run a headless browser or execute JavaScript, so SPA frameworks, tag managers, and dynamically injected libraries can be false negatives. Use a browser-based tool or headless integration if JS-rendered detection matters.
- What license does madeitbelgium/wappalyzer use, and can I use it in a commercial SaaS?
- The package is GPL-3.0, which is copyleft and a significant licensing risk. If you run it as part of a hosted SaaS that is not distributed to customers, GPL obligations are generally not triggered for mere use, but you must confirm this with legal counsel. It is a hard blocker for anything shipped as an on-prem binary, SDK, or embedded appliance.
- Can I supply my own Wappalyzer ruleset or JSON fingerprint corpus?
- The package ships with a bundled technology-detection ruleset, but the evaluation does not confirm a supported path for pointing it at your own JSON corpus. Treat custom corpus support as something to verify in the source code or plan to fork. Ruleset provenance and update cadence directly determine detection quality and staleness.
- Does madeitbelgium/wappalyzer protect against SSRF when scanning user-supplied URLs?
- Assume no meaningful protection exists out of the box. Scanning user-supplied URLs creates SSRF risk including internal IPs, cloud metadata endpoints such as 169.254.169.254, DNS rebinding, redirect chains, and unbounded response bodies. Wrap the package behind validation, DNS/IP allowlisting, redirect and timeout limits, response-size caps, and rate limiting, or run it in an isolated detection service.
- Does the package return confidence scores and technology categories, or only raw technology names?
- The evaluation describes it as returning detected technologies such as CMSs, frameworks, analytics, and servers, but it does not confirm whether confidence scores or category metadata are exposed. Fingerprinting is probabilistic, so false positives can propagate into CRM fields, scoring, or routing logic. Persist raw names plus ruleset version and add your own confidence thresholds or review where precision matters.
- How do I test madeitbelgium/wappalyzer without hitting live websites?
- Because it parses static HTTP signals, you can test it with saved fixture responses containing headers, HTML, and cookies. Mock your outbound HTTP client so unit tests never touch the network, and keep a small set of live integration tests in staging. Store the ruleset version alongside fixtures so results remain reproducible when the corpus changes.
- Is madeitbelgium/wappalyzer actively maintained, and what are the alternatives?
- Maintenance risk is medium to high: the evaluation notes 16 stars, a single vendor, and one release in April 2024. Assume you will own the code and ruleset, and expect staleness as new technologies appear. Alternatives include browser-based Wappalyzer, commercial technology-detection APIs, or an in-house fingerprinting ruleset you control.
- Should I run madeitbelgium/wappalyzer inline in my Laravel app or in a separate service?
- The recommended pattern is a boundary: run it in a dedicated internal detection worker or sidecar and call it over HTTP or a queue from your main application. This keeps GPL code out of the core proprietary codebase graph and centralizes SSRF controls, rate limits, caching, and timeouts. It also makes it easier to swap in a commercial API or in-house ruleset later.