# Website Audit – SEO, Security, SSL & DNS (`sfoln/website-audit`)

Audit any website in one JSON record: SEO tags, security headers grade, SSL certificate, SPF/DMARC e-mail setup, tech stack, speed signals, robots.txt and sitemap, broken links and domain age, with 0–100 scores and a prioritised issue list. $8 per 1,000 websites.

- Family: SEO & search
- Categories: SEO tools, Lead generation, Developer tools
- Availability: on request (private on Apify). Email contact@sfoln.com with subject "Access request: Website Audit – SEO, Security, SSL & DNS (sfoln/website-audit)" before calling; calls fail until it is public.
- JSON: https://www.sfoln.com/actors/website-audit.json
- MCP: https://mcp.apify.com?tools=sfoln/website-audit
- REST (sync): POST https://api.apify.com/v2/actors/sfoln~website-audit/run-sync-get-dataset-items
- REST (async): POST https://api.apify.com/v2/actors/sfoln~website-audit/runs

Audit any website and get one JSON record with 0–100 scores and a prioritised list of issues across eight areas: SEO tags (title and description lengths, H1, canonical, robots meta, Open Graph and Twitter cards, hreflang, structured data), security headers with an A–F grade (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags, mixed content), the SSL certificate (issuer, days left), DNS and e-mail setup (SPF, DMARC, MX, CAA, DNSSEC, MTA-STS, BIMI), domain age (RDAP), the tech stack, speed signals (time to first byte, HTML size, compression, request count) and crawlability (robots.txt, sitemap, broken links on the page). Built for agencies prospecting with audits, web developers, IT and security hygiene checks, due diligence and AI agents.

## Price per delivered record

| Event | Price | Per 1,000 | Charged for |
| --- | --- | --- | --- |
| Website audit (`site-audit`) | $0.008 | $8 / 1,000 | Charged once per audited website: SEO, security headers, SSL certificate, e-mail DNS, registration, performance, crawl files, link check and tech stack with scores and issues. |
| Website safety check (`safety-check`), paid plans only | $0.002 | $2 / 1,000 | Paid add-on (includeSafetyCheck): the audited page looked up in Google Web Risk (malware, social engineering, unwanted software). Paid Apify plans only. |

Pay-per-event, USD, billed by Apify; no platform usage charge. Only records with status `ok` are charged. Cap a run with `maxTotalChargeUsd`. Apify free plan: up to 10 per run.

## Run

```bash
curl -X POST "https://api.apify.com/v2/actors/sfoln~website-audit/run-sync-get-dataset-items" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"urls":["apify.com"],"maxLinksToCheck":10}'
```

MCP client configuration:

```json
{
  "mcpServers": {
    "apify": {
      "type": "http",
      "url": "https://mcp.apify.com?tools=sfoln/website-audit"
    }
  }
}
```

Example prompt: Audit apify.com: give me its SEO, security and performance scores and the five most important issues to fix.

## Input

Enter websites (domains or page URLs). Each website produces one audit record with scores and issues.

| Field | Type | Default | Meaning |
| --- | --- | --- | --- |
| `urls` (required) | array | — | Websites: Domains (apify.com) or page URLs (https://www.apify.com/pricing), one per line. A domain is audited from its homepage (https://, falling back to http://). Duplicates are removed. Accounts on the Apify free plan can process up to 10 websites per run. |
| `maxLinksToCheck` | integer | `50` | Links to check per website: How many links of the audited page are checked for errors (internal links first; 0 turns the check off). Free plan: at most 20. |
| `includeSafetyCheck` | boolean | `false` | Google Web Risk safety check: Also look the page up in Google Web Risk (malware, phishing, unwanted software). Paid add-on: $0.002 per website (safety-check), paid Apify plans only. |
| `maxItems` | integer | `1000` | Max websites: Safety cap on how many websites are processed in this run. |
| `concurrency` | integer | `3` | Concurrency: How many websites are audited in parallel (1–10). Each one makes a few requests at a time to its own site. |
| `includeRaw` | boolean | `false` | Include raw response data: Attach the page's response headers and redirect chain under raw. |

Example input:

```json
{
  "urls": [
    "apify.com"
  ],
  "maxLinksToCheck": 10
}
```

## Output

One record per input item with `status` (`ok` is charged; `not_found`, `error`, `skipped_*` are free) and `charged`. The run stores an `OUTPUT` summary record.

| Field | Type | Meaning |
| --- | --- | --- |
| `input` | string | object | Input: The website as submitted. |
| `status` | string | Status: ok \| not_found \| error \| skipped_invalid \| skipped_budget \| skipped_free_plan \| skipped_unmetered |
| `charged` | boolean | Charged: Whether this record incurred a pay-per-event charge. |
| `chargedEvent` | string | Charged event: Pay-per-event event charged for this record (present only when charged; the safety-check add-on is charged separately). |
| `chargedCount` | integer | Events charged: Events actually charged when the charge came back short of the requested count (present only then; a warning explains it). |
| `source` | string | Source: website+dns+rdap+tls: the site's own pages, public DNS, RDAP and a TLS handshake. |
| `fetchedAt` | string | Fetched at: ISO timestamp. |
| `error` | object | Error: { code, message, provider?, status? } when status is not ok. Codes: site_blocked (401/403/429/503), page_not_found (404/410), http_error, domain_not_found, invalid_url, network, timeout, tls_error, unexpected_type, too_many_redirects; runtime codes: budget_exhausted, free_plan_limit, unmetered, aborted, charge_failed, record_too_large, invalid_record, dataset_push_failed. |
| `warnings` | array | Warnings: Sections that failed, a link check stopped at its time limit, the free-plan link cap, the safety add-on skipped or failed. |
| `domain` | string | null | Domain: Registrable domain of the website. |
| `url` | string | null | URL: Final URL of the audited page (after redirects). |
| `httpStatus` | integer | HTTP status |
| `score` | integer | null | Score: Overall score 0–100 (weighted: SEO 30%, security 30%, performance 25%, e-mail 15%). |
| `grade` | string | null | Grade: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 45, E ≥ 25, F below. |
| `scores` | object | Scores: { overall, seo, security, email, performance }: 0–100 each, null when the area could not be assessed. |
| `issueCounts` | object | Issue counts: { high, medium, low } |
| `issues` | array | Issues: [{ severity: high \| medium \| low, area: seo \| security \| email \| performance, code, message, points }] sorted by severity, then points. |
| `seo` | object | SEO: title, titleLength, metaDescription, metaDescriptionLength, canonical, canonicalIsSelf, robotsMeta, xRobotsTag, indexable, lang, hasViewport, charset, h1Count, h1, h2Count, openGraph{}, twitterCard{}, hreflang[], structuredData{ jsonLdBlocks, invalidJsonLdBlocks, types[], microdataTypes[] }, images, imagesMissingAlt, wordCount, favicon, robotsTxt{}, sitemap{}. |
| `security` | object | Security: https, httpRedirectsToHttps, headersGrade (A–F), headersScore, headers{ hsts{}, csp{}, xFrameOptions, xContentTypeOptions, referrerPolicy, permissionsPolicy, present[], missing[] }, cookies[{ name, secure, httpOnly, sameSite }], mixedContent{ active[], passive[] }, server, poweredBy. |
| `tls` | object | null | SSL/TLS certificate: issuer, issuerOrganization, validFrom, validTo, daysLeft, expired, trusted, trustError, coversHost, protocol, sanCount. |
| `dns` | object | null | DNS and e-mail: domain, mx[], mailProvider, spf{ record, allQualifier, includes[], multipleRecords }, dmarc{ record, policy, subdomainPolicy, pct, rua[] }, mtaSts, bimi, caa[{ flags, tag, value }], dnssec, nameservers[]. |
| `registration` | object | null | Registration (RDAP): registrar, createdAt, expiresAt, ageDays, daysUntilExpiry, dnssec. |
| `performance` | object | Performance: ttfbMs, totalMs, htmlKb, compressed, compression, redirects, requestEstimate, scripts, inlineScripts, stylesheets, images, iframes, renderBlockingScripts, cacheControl. |
| `links` | object | null | Links: found, internal, external, checked, ok, redirected, brokenCount, broken[{ url, internal, status, error }], unverifiable, notChecked, stoppedEarly; null when maxLinksToCheck is 0. |
| `crawl` | object | Crawl files: robotsTxt{ found, url, disallowsAll, crawlDelay, sitemaps[] }, sitemap{ found, url, source, type, urlCount, truncated }, securityTxt{ found, contact[], expires, expired }. |
| `tech` | object | Tech stack: technologyCount, technologyNames[], byCategory{}, cms, ecommercePlatform, analytics[], tagManagers[], advertising[], marketingAutomation[], crm[], liveChat[], paymentProcessors[], emailProvider, emailSenders[], hosting[], cdn[], webServer, javascriptFrameworks[], programmingLanguages[], saasVerifiedByDns[], technologies[{ name, slug, categories[], version, confidence, evidence[], website }]. |
| `safety` | object | null | Safety (Web Risk): { checked, url, isSafe, threatTypes[] } with the includeSafetyCheck add-on; null otherwise. |
| `sections` | object | Section status: page, tls, dns, registration, links, safety: ok \| not_found \| error \| skipped. |
| `raw` | object | Raw: With includeRaw: { headers, redirects[], httpProbe }. |

Example record:

```json
{
  "input": "apify.com",
  "domain": "apify.com",
  "url": "https://apify.com/",
  "httpStatus": 200,
  "score": 94,
  "grade": "A",
  "scores": {
    "overall": 94,
    "seo": 100,
    "security": 95,
    "email": 100,
    "performance": 84
  },
  "issueCounts": {
    "high": 0,
    "medium": 0,
    "low": 5
  },
  "issues": [
    {
      "severity": "low",
      "area": "performance",
      "code": "many_requests",
      "message": "The page references about 147 files (scripts, stylesheets, images, frames).",
      "points": 7
    },
    {
      "severity": "low",
      "area": "performance",
      "code": "html_large",
      "message": "The HTML document is 522.4 KB; under 400 KB keeps the first render fast.",
      "points": 5
    },
    {
      "severity": "low",
      "area": "performance",
      "code": "render_blocking_scripts",
      "message": "1 script(s) in <head> load without async or defer and block the first render.",
      "points": 4
    },
    {
      "severity": "low",
      "area": "security",
      "code": "referrer_policy_missing",
      "message": "No Referrer-Policy header.",
      "points": 3
    },
    {
      "severity": "low",
      "area": "security",
      "code": "csp_unsafe_eval",
      "message": "The Content-Security-Policy allows 'unsafe-eval'.",
      "points": 2
    }
  ],
  "seo": {
    "title": "Apify: Marketplace of ready-to-run tools for AI",
    "titleLength": 47,
    "metaDescription": "Thousands of tools to automate your business. Get real-time web data, track competitors, generate leads, and integrate your apps and AI agents.",
    "metaDescriptionLength": 143,
    "canonical": "https://apify.com/",
    "canonicalIsSelf": true,
    "robotsMeta": "index,follow",
    "xRobotsTag": null,
    "indexable": true,
    "lang": "en",
    "hasViewport": true,
    "charset": "utf-8",
    "h1Count": 1,
    "h1": "87,717 tools for your AI",
    "h2Count": 11,
    "openGraph": {
      "title": "Apify: Marketplace of ready-to-run tools for AI",
      "description": "Thousands of tools to automate your business.",
      "image": "https://apify.com/og-image",
      "type": "website",
      "url": "https://apify.com",
      "siteName": "Apify"
    },
    "twitterCard": {
      "card": "summary_large_image",
      "title": "Apify: Marketplace of ready-to-run tools for AI",
      "description": "Thousands of tools to automate your business.",
      "image": "https://apify.com/og-image",
      "site": null
    },
    "hreflang": [],
    "structuredData": {
      "jsonLdBlocks": 3,
      "invalidJsonLdBlocks": 0,
      "types": [
        "Organization",
        "WebSite",
        "SoftwareApplication"
      ],
      "microdataTypes": []
    },
    "images": 78,
    "imagesMissingAlt": 0,
    "wordCount": 1577,
    "favicon": "https://apify.com/favicon.ico",
    "robotsTxt": {
      "found": true,
      "disallowsAll": false,
      "sitemaps": 1
    },
    "sitemap": {
      "found": true,
      "url": "https://apify.com/sitemap.xml",
      "type": "sitemapindex",
      "urlCount": 17
    }
  },
  "security": {
    "https": true,
    "httpRedirectsToHttps": true,
    "headersGrade": "B",
    "headersScore": 85,
    "headers": {
      "hsts": {
        "present": true,
        "maxAgeSecs": 15768000,
        "includeSubDomains": false,
        "preload": false
      },
      "csp": {
        "present": true,
        "reportOnly": false,
        "unsafeInline": false,
        "unsafeEval": true,
        "frameAncestors": true
      },
      "xFrameOptions": "SAMEORIGIN",
      "xContentTypeOptions": "nosniff",
      "referrerPolicy": null,
      "permissionsPolicy": true,
      "present": [
        "Strict-Transport-Security",
        "Content-Security-Policy",
        "X-Frame-Options",
        "X-Content-Type-Options",
        "Permissions-Policy"
      ],
      "missing": [
        "Referrer-Policy"
      ]
    },
    "cookies": [],
    "mixedContent": {
      "active": [],
      "passive": []
    },
    "server": null,
    "poweredBy": null
  },
  "tls": {
    "issuer": "Amazon RSA 2048 M03",
    "issuerOrganization": "Amazon",
    "validFrom": "2026-04-20T00:00:00.000Z",
    "validTo": "2027-05-19T23:59:59.000Z",
    "daysLeft": 217,
    "expired": false,
    "trusted": true,
    "trustError": null,
    "coversHost": true,
    "protocol": "TLSv1.3",
    "sanCount": 2
  },
  "dns": {
    "domain": "apify.com",
    "mx": [
      "aspmx.l.google.com",
      "alt1.aspmx.l.google.com"
    ],
    "mailProvider": "google",
    "spf": {
      "record": "v=spf1 a mx include:_spf.google.com include:mailgun.org -all",
      "multipleRecords": false,
      "allQualifier": "-all",
      "includes": [
        "_spf.google.com",
        "mailgun.org"
      ]
    },
    "dmarc": {
      "record": "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc-reports@apify.com",
      "policy": "reject",
      "subdomainPolicy": "reject",
      "pct": 100,
      "rua": [
        "mailto:dmarc-reports@apify.com"
      ]
    },
    "mtaSts": true,
    "bimi": true,
    "caa": [
      {
        "flags": 0,
        "tag": "issue",
        "value": "letsencrypt.org"
      }
    ],
    "dnssec": true,
    "nameservers": [
      "ns-449.awsdns-56.com",
      "ns-839.awsdns-40.net"
    ]
  },
  "registration": {
    "registrar": "Amazon Registrar, Inc.",
    "createdAt": "2009-06-02T17:14:10Z",
    "expiresAt": "2035-06-02T17:14:10Z",
    "ageDays": 6343,
    "daysUntilExpiry": 3152,
    "dnssec": true
  },
  "performance": {
    "ttfbMs": 367,
    "totalMs": 406,
    "htmlKb": 522.4,
    "compressed": true,
    "compression": "gzip",
    "redirects": 0,
    "requestEstimate": 147,
    "scripts": 50,
    "inlineScripts": 2,
    "stylesheets": 3,
    "images": 78,
    "iframes": 1,
    "renderBlockingScripts": 1,
    "cacheControl": "private, no-cache, no-store, max-age=0, must-revalidate"
  },
  "links": {
    "found": 89,
    "internal": 73,
    "external": 16,
    "checked": 50,
    "ok": 50,
    "redirected": 0,
    "brokenCount": 0,
    "broken": [],
    "unverifiable": 0,
    "notChecked": 39,
    "stoppedEarly": false
  },
  "crawl": {
    "robotsTxt": {
      "found": true,
      "url": "https://apify.com/robots.txt",
      "disallowsAll": false,
      "crawlDelay": null,
      "sitemaps": [
        "https://apify.com/sitemap.xml"
      ]
    },
    "sitemap": {
      "found": true,
      "url": "https://apify.com/sitemap.xml",
      "source": "robots.txt",
      "type": "sitemapindex",
      "urlCount": 17,
      "truncated": false
    },
    "securityTxt": {
      "found": true,
      "contact": [
        "mailto:security@apify.com"
      ],
      "expires": "2035-01-01T00:00:00.000Z",
      "expired": false
    }
  },
  "tech": {
    "technologyCount": 20,
    "technologyNames": [
      "Algolia",
      "Node.js",
      "Amazon Web Services",
      "Next.js",
      "React",
      "Amazon Cloudfront",
      "Google Workspace",
      "HubSpot",
      "Mailgun",
      "Mixpanel"
    ],
    "byCategory": {
      "CDN": [
        "Amazon Cloudfront"
      ],
      "Analytics": [
        "Leadfeeder",
        "Mixpanel"
      ],
      "Marketing automation": [
        "HubSpot"
      ]
    },
    "cms": null,
    "ecommercePlatform": null,
    "analytics": [
      "Leadfeeder",
      "Mixpanel"
    ],
    "tagManagers": [],
    "advertising": [],
    "marketingAutomation": [
      "HubSpot"
    ],
    "crm": [
      "Intercom"
    ],
    "liveChat": [
      "Intercom"
    ],
    "paymentProcessors": [],
    "emailProvider": "Google Workspace",
    "emailSenders": [
      "Amazon SES",
      "Google Workspace",
      "HubSpot",
      "Mailgun"
    ],
    "hosting": [
      "Amazon Web Services"
    ],
    "cdn": [
      "Amazon Cloudfront",
      "Amazon S3"
    ],
    "webServer": "Next.js",
    "javascriptFrameworks": [
      "React"
    ],
    "programmingLanguages": [
      "Node.js"
    ],
    "saasVerifiedByDns": [
      "Google Search Console",
      "Amazon SES",
      "Google Workspace",
      "HubSpot",
      "Mailgun",
      "Mixpanel"
    ],
    "technologies": [
      {
        "name": "Algolia",
        "slug": "algolia",
        "categories": [
          "Search engines"
        ],
        "version": null,
        "confidence": 100,
        "evidence": [
          "header"
        ],
        "website": "http://www.algolia.com"
      }
    ]
  },
  "safety": null,
  "sections": {
    "page": "ok",
    "tls": "ok",
    "dns": "ok",
    "registration": "ok",
    "links": "ok",
    "safety": "skipped"
  },
  "status": "ok",
  "charged": true,
  "chargedEvent": "site-audit",
  "source": "website+dns+rdap+tls",
  "fetchedAt": "2026-10-14T10:00:00.000Z"
}
```

## FAQ

**What does the audit check?**

SEO tags of the page (title and description lengths, H1, canonical, robots meta and X-Robots-Tag, Open Graph and Twitter cards, hreflang, structured data, image alt texts), robots.txt, the XML sitemap and security.txt; the security headers with an A–F grade (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie flags, mixed content and the http-to-https redirect; the SSL certificate; SPF, DMARC, MX, CAA, DNSSEC, MTA-STS and BIMI; domain registration and age (RDAP); the tech stack; time to first byte, HTML size, compression, request count and render-blocking scripts; and broken links on the page.

**How are the scores calculated?**

Each issue costs its area (SEO, security, e-mail, performance) a fixed number of points, shown in the issue's points field, from a starting 100. The overall score weighs SEO 30%, security 30%, performance 25% and e-mail 15%; an area whose data could not be fetched is left out. Grades: A from 90, B from 75, C from 60, D from 45, E from 25, F below.

**Does it run JavaScript or a real browser?**

No. It reads the HTML the server sends, like a search engine's first pass, which keeps it fast and cheap. Performance values are server-side signals (time to first byte, HTML size, compression, number of referenced files), not Lighthouse scores.


## Related

- [Tech Stack Detector – Website Technologies](https://www.sfoln.com/actors/tech-stack-detector.md) (`sfoln/tech-stack-detector`)
- [Domain WHOIS & DNS Lookup](https://www.sfoln.com/actors/domain-intelligence.md) (`sfoln/domain-intelligence`)
- [SEO Audit API – On-Page Checks for Any URL](https://www.sfoln.com/actors/onpage-seo-audit.md) (`sfoln/onpage-seo-audit`)
- [Local SEO Audit – Google Business Profile](https://www.sfoln.com/actors/local-business-audit.md) (`sfoln/local-business-audit`)
- [URL Safety Checker – Phishing & Malware](https://www.sfoln.com/actors/url-safety-check.md) (`sfoln/url-safety-check`)
- [Website Contact Details Scraper](https://www.sfoln.com/actors/company-contacts-finder.md) (`sfoln/company-contacts-finder`)
- [SEO Competitor Analysis – Traffic & Keywords](https://www.sfoln.com/actors/seo-competitor-snapshot.md) (`sfoln/seo-competitor-snapshot`)

Publisher: SFOLN LLC, contact@sfoln.com. Catalogue: https://www.sfoln.com/catalog.json. Agent guide: https://www.sfoln.com/agents.md.