Site Health Suite — One Grade, Six Checks, No Faked Score

Most "website audit" tools run one check and call it a grade. This runs six — SSL, security headers, uptime, broken links, structured data, and subdomain takeover exposure — and combines them into a single letter grade that's honest about what it couldn't check.

The one design decision that matters: if a check can't run (a timeout, a blocked probe), that check contributes nothing to the score — the other checks are re-weighted to fill the gap. A site that's unreachable for SSL inspection doesn't silently get graded as if SSL were fine, and it doesn't get punished for a check that never completed either.

The six checks and their weights

Check	Weight	What it catches
Subdomain takeover	25	The one active exploitable risk in this list — weighted highest on purpose
SSL	20	Certificate validity, expiry, chain
Uptime	20	Is it actually up right now
Broken links	15	Dead internal/external links
Security headers	12	HSTS, CSP, X-Frame-Options, and the rest
Structured data	8	JSON-LD presence — an SEO signal, not a security one

A subdomain takeover risk scores worse than 100% broken links, by design — one is a live exploitable hole, the other is a maintenance issue.

Input

{ "sites": ["example.com"], "maxSubdomainsToCheck": 50 }

Sample output

{
  "site": "example.com",
  "overallScore": 95,
  "grade": "A",
  "checks": {
    "ssl": { "score": 100, "status": "valid", "expiresInDays": 74 },
    "securityHeaders": { "score": 83, "missing": ["Content-Security-Policy"] },
    "uptime": { "score": 100, "status": "up" },
    "brokenLinks": { "score": 100, "checked": 42, "broken": 0 },
    "structuredData": { "score": 0, "found": false },
    "subdomainTakeover": { "score": 100, "claimable": 0, "suspicious": 0 }
  },
  "fixList": [
    { "priority": "low", "issue": "No structured data (JSON-LD) found", "fix": "Add Organization/WebSite schema markup for richer search results." }
  ]
}

The fix list

Every run returns a priority-sorted, plain-English fix list — not a raw dump of every check's internals. A buyer wants "here's what to fix, in order," not six separate reports to reconcile themselves.

Typical uses

• Agency deliverable — one grade + a fix list is a paragraph you can put in a client report, not a data table they have to interpret.
• Pre-launch checklist — run before shipping a redesign or migration.
• Vendor/acquisition due diligence — a fast read on a site's technical hygiene.

Pair it with Website Audit for an agency-ready workflow

Use Website Audit — In Plain English first when the deliverable is an owner-facing explanation: it identifies the commercial consequence and gives a careful, paste-ready summary. Use this Suite next when the buyer needs a technical baseline, ordered remediation list and periodic re-check.

Buyer question	Use
“What specific, accurate thing can I say to this business?”	Website Audit
“What should our developer fix first, and did it improve?”	Site Health Suite

Do not turn either output into a claim that a site is compromised. A missing, blocked or unavailable check is shown in the per-check status and excluded from the combined score.

Pricing

$5.00 / 1,000 sites checked ($0.005 per result) — priced above the single-check actors in this portfolio because a row here replaces six separate audits, not one.

⚠️ Read before you act

• Uptime and broken-link checks reflect one moment in time. Re-run periodically for a trend, not a single snapshot as a verdict.
• Subdomain takeover uses the same passive technique as the standalone Subdomain Takeover Auditor — certificate transparency + DNS-over-HTTPS + a public fingerprint database. No scanning, no login.
• A missing check (timeout, blocked probe) never fakes a score — it's excluded and the grade is renormalized over what actually ran. Check the per-check status field to see what that run actually measured.

FAQ

• Why is subdomain takeover weighted highest? It's the only check on this list that represents an active, exploitable risk right now — the others are hygiene or performance signals.
• Can I run just one check? No — this actor's value is the combined grade. For a single check, use the dedicated actor (SSL Certificate Checker, Broken Link Checker, Subdomain Takeover Auditor, etc.).

Related actors

• Website Audit — In Plain English — owner-facing explanation and outreach-ready summary.
• Subdomain Takeover Auditor — the takeover check alone, standalone.
• SSL Certificate Checker — the SSL check alone, standalone.
• Broken Link Checker — the broken-links check alone, standalone.
• HTTP Header & Security Analyzer — a deeper look at security headers alone.

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• Site Health Suite — One Graded Audit, Six Checks declares all 25 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of Site Health Suite include site, grade, score, sslScore, headersScore and uptimeScore.
• Site Health Suite needs no API key, login or account of any kind before its first run.
• Every one of Site Health Suite's 5 inputs is optional, so it runs with no configuration at all.
• Site Health Suite documents score as: Score on the Actor's own scale. The scale is stated in the field's own band.
• Every number published about Site Health Suite is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• Site Health Suite is filed under developer tools and business so that it is found by the people looking for that job, not by its internal name.

Limitations

• Site Health Suite reads only what its sources publish publicly. Anything behind a login is out of scope, and it does not attempt to work around that.
• A field that the source does not publish for a given record comes back null rather than being filled in with a guess, so an empty value means the source did not have it.
• Output quality is bounded by the source. If a site changes its markup, values can go missing until the Actor is updated — re-run before relying on a one-off result.
• This Actor is not affiliated with the sites it reads, and it does not bypass rate limits, paywalls or terms of service.