sfoln/website-audit · SEO tools, Lead generation, Developer tools On request
Audit any website in one JSON record: SEO tags, security headers grade, SSL certificate, SPF/DMARC e-mail setup, tech stack, speed signals, robots.txt and sitemap, broken links and domain age, with 0–100 scores and a prioritised issue list. $8 per 1,000 websites.
Audit any website and get one JSON record with 0–100 scores and a prioritised list of issues across eight areas: SEO tags (title and description lengths, H1, canonical, robots meta, Open Graph and Twitter cards, hreflang, structured data), security headers with an A–F grade (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookie flags, mixed content), the SSL certificate (issuer, days left), DNS and e-mail setup (SPF, DMARC, MX, CAA, DNSSEC, MTA-STS, BIMI), domain age (RDAP), the tech stack, speed signals (time to first byte, HTML size, compression, request count) and crawlability (robots.txt, sitemap, broken links on the page). Built for agencies prospecting with audits, web developers, IT and security hygiene checks, due diligence and AI agents.
Price
Price per delivered record
Event
Price
Per 1,000
Charged for
Website audit site-audit
$0.008
$8 / 1,000
Charged once per audited website: SEO, security headers, SSL certificate, e-mail DNS, registration, performance, crawl files, link check and tech stack with scores and issues.
Website safety check safety-check paid plans only
$0.002
$2 / 1,000
Paid add-on (includeSafetyCheck): the audited page looked up in Google Web Risk (malware, social engineering, unwanted software). Paid Apify plans only.
Apify free plan: up to 10 items per run. Paid plans have no per-run cap; set maxTotalChargeUsd to cap spend.
Run
Call it from code, an agent or the Console
This API is private on Apify for now. Email us and we will publish it for you, usually within two working days. The calls below work once it is public. contact@sfoln.com
POST https://api.apify.com/v2/actors/sfoln~website-audit/runs?maxTotalChargeUsd=1
GET https://api.apify.com/v2/actor-runs/{runId} # until status is SUCCEEDED
GET https://api.apify.com/v2/datasets/{defaultDatasetId}/items?format=json
Authenticate with an Apify API token. MCP clients can instead sign in with OAuth when prompted. Example prompt for an agent: Audit apify.com: give me its SEO, security and performance scores and the five most important issues to fix.
Input
Input fields
Enter websites (domains or page URLs). Each website produces one audit record with scores and issues.
Field
Type
Default
Meaning
urls *
array
required
Websites Domains (apify.com) or page URLs (https://www.apify.com/pricing), one per line. A domain is audited from its homepage (https://, falling back to http://). Duplicates are removed. Accounts on the Apify free plan can process up to 10 websites per run.
maxLinksToCheck
integer
50
Links to check per website How many links of the audited page are checked for errors (internal links first; 0 turns the check off). Free plan: at most 20. Range 0–200.
includeSafetyCheck
boolean
false
Google Web Risk safety check Also look the page up in Google Web Risk (malware, phishing, unwanted software). Paid add-on: $0.002 per website (safety-check), paid Apify plans only.
maxItems
integer
1000
Max websites Safety cap on how many websites are processed in this run. Range 1–10000.
concurrency
integer
3
Concurrency How many websites are audited in parallel (1–10). Each one makes a few requests at a time to its own site. Range 1–10.
includeRaw
boolean
false
Include raw response data Attach the page's response headers and redirect chain under raw.
Records land in the run's dataset; a synchronous call returns them directly. Each has a status (ok is charged; everything else is free) and a charged flag. The run's OUTPUT record totals items and charges.
Field
Type
Meaning
input
string | object
Input The website as submitted.
status
string
Status ok | not_found | error | skipped_invalid | skipped_budget | skipped_free_plan | skipped_unmetered e.g. "ok"
charged
boolean
Charged Whether this record incurred a pay-per-event charge.
chargedEvent
string
Charged event Pay-per-event event charged for this record (present only when charged; the safety-check add-on is charged separately).
chargedCount
integer
Events charged Events actually charged when the charge came back short of the requested count (present only then; a warning explains it).
source
string
Source website+dns+rdap+tls: the site's own pages, public DNS, RDAP and a TLS handshake.
fetchedAt
string
Fetched at ISO timestamp.
error
object
Error { code, message, provider?, status? } when status is not ok. Codes: site_blocked (401/403/429/503), page_not_found (404/410), http_error, domain_not_found, invalid_url, network, timeout, tls_error, unexpected_type, too_many_redirects; runtime codes: budget_exhausted, free_plan_limit, unmetered, aborted, charge_failed, record_too_large, invalid_record, dataset_push_failed.
warnings
array
Warnings Sections that failed, a link check stopped at its time limit, the free-plan link cap, the safety add-on skipped or failed.
domain
string | null
Domain Registrable domain of the website. e.g. "apify.com"
url
string | null
URL Final URL of the audited page (after redirects).
SEO tags of the page (title and description lengths, H1, canonical, robots meta and X-Robots-Tag, Open Graph and Twitter cards, hreflang, structured data, image alt texts), robots.txt, the XML sitemap and security.txt; the security headers with an A–F grade (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), cookie flags, mixed content and the http-to-https redirect; the SSL certificate; SPF, DMARC, MX, CAA, DNSSEC, MTA-STS and BIMI; domain registration and age (RDAP); the tech stack; time to first byte, HTML size, compression, request count and render-blocking scripts; and broken links on the page.
How are the scores calculated?
Each issue costs its area (SEO, security, e-mail, performance) a fixed number of points, shown in the issue's points field, from a starting 100. The overall score weighs SEO 30%, security 30%, performance 25% and e-mail 15%; an area whose data could not be fetched is left out. Grades: A from 90, B from 75, C from 60, D from 45, E from 25, F below.
Does it run JavaScript or a real browser?
No. It reads the HTML the server sends, like a search engine's first pass, which keeps it fast and cheap. Performance values are server-side signals (time to first byte, HTML size, compression, number of referenced files), not Lighthouse scores.