Complete Site Audit — crawl a site, get every problem on every page

The problem: finding out what is wrong with a website means running eight different tools. An SEO checker, a security-header scanner, an SSL expiry monitor, a DNS/SPF/DMARC lookup, an accessibility pass, a cookie scanner, a robots/sitemap check, a tech-stack detector. Eight tabs, eight output formats, and nothing tells you what to fix first — and you still have to repeat all of it per page.

The solution: send one URL. The Actor finds your pages from sitemap.xml (falling back to on-page links), audits every page across all ten areas, and returns one record per page plus a site summary. Every finding is tagged high / medium / low with a fixOrder array already sorted into a work queue.

{ "url": "https://example.com", "maxPages": 25 }

{
  "score": 87, "grade": "B", "issueCount": 4,
  "fixOrder": [
    "[high] accessibility: 12/40 images have no alt attribute",
    "[high] email: no DMARC record — spoofed mail is not rejected or reported",
    "[medium] security: missing header: content-security-policy",
    "[low] seo: title is 69 chars (10-60 renders fully in results)"
  ]
}

Schedule it: the second run tells you what changed

An audit you run once is a snapshot. Schedule this Actor and every run diffs against the last one, so you get the thing that actually matters — what broke since last week:

"changes": {
  "isBaseline": false,
  "newIssues": [ { "area": "security", "severity": "low", "msg": "missing header: referrer-policy" } ],
  "fixedIssues": [ "seo|missing meta description" ],
  "stillOpen": 3,
  "previousScore": 91, "scoreDelta": -4,
  "summary": "1 NEW · 1 fixed — 3 still open."
}

The first run records a baseline and says so. Counts inside a finding are normalised, so "12/40 images missing alt" becoming "13/41" is the same ongoing issue rather than a fix plus a new problem — the change list stays worth reading. Alert on changes.newIssues, on scoreDelta, or on certificate.daysUntilExpiry.

What it checks — ten areas in a single pass

Area	What comes back
SEO	title, meta description, H1 count, canonical, JSON-LD blocks, images missing alt, word count, noindex detection
Security headers	HTTPS, all 6 key headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), mixed content
TLS certificate	issuer, subject, validity dates, days until expiry, trust status, protocol version
Email / DNS	A, MX, NS, CAA record counts · SPF record · DMARC record and its enforcement policy
Accessibility	lang attribute, viewport meta, images missing alt, form inputs with no label association, skipped heading levels
Privacy	cookies set, third-party script hosts, known tracker hosts by name
Performance	server response time, HTML document size, script/stylesheet counts
Crawlability	robots.txt, sitemap.xml, ads.txt, /.well-known/security.txt
Social	Open Graph tags, og:image, Twitter Card
Tech stack	WordPress / Next.js / Shopify / Astro / Nuxt / React fingerprints, server and X-Powered-By

Input

Field	Type	Required	Notes
url	string	one of the two	A site to crawl and audit
urls	string[]	one of the two	Audit exactly these pages instead of crawling
maxPages	integer	no	Pages to audit, and the run's billing cap (default 10, max 200)
stateStoreName	string	no	Named store holding the last run's findings for change detection (default site-audit-state)

Send url to crawl, or urls to audit an exact list. Each page becomes one dataset record and one charge. A page that fails to fetch returns an error record and is not charged. Set maxPages: 1 to audit only the URL you gave.

Pricing

$0.03 per page analyzed (pay per event, page-analyzed). You are charged once per page that produced a real audit. Pages that could not be fetched produce a record explaining what happened and cost nothing.

maxPages is your cost ceiling: a 10-page run costs at most $0.30, a 50-page run at most $1.50. Domain-level checks — TLS certificate, DNS/SPF/DMARC/CAA, robots/sitemap/security.txt — run once per run and are not charged per page. There is no subscription and no API key to obtain.

Calling it as an agent tool

This Actor is callable over Apify MCP, so an agent can hand it a URL and read the fixOrder array directly as its task list. It takes one string and returns one flat JSON record per page, plus a SITE_SUMMARY record — no pagination, no session, no auth handshake.

FAQ

Does it render JavaScript? No. Every reading comes from the server-rendered HTML — which is exactly what a search crawler sees. On a client-rendered SPA the SEO and accessibility numbers describe the crawler's view, not the human's. If you need the rendered DOM, this is the wrong tool and it says so rather than guessing.

Is this a full WCAG audit? No, and no automated tool is. It covers the machine-checkable subset — roughly 30% of WCAG success criteria. It cannot judge colour contrast against a background image, keyboard focus order, or whether alt text is meaningful rather than merely present. It finds the failures that are unambiguous.

How is the score calculated? Every issue carries a severity, and the score is 100 − Σ(high 10, medium 4, low 1), floored at 0. Grades: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, else F. The weighting is a judgement call, not a standard — the issues array is the real output and you can re-weight it yourself.

Why does it check DNS and mail records on a website audit? Because a missing SPF or DMARC record is how a company's domain gets used to spoof its own customers, and nobody looks until it happens. It costs one DNS query and it is on the same domain you already asked about.

How does it decide which pages to audit? sitemap.xml first — that is the site's own statement of what matters. If there is no usable sitemap it falls back to same-origin links on the page you gave. It never leaves your origin, skips assets (PDF, images, CSS, JS), and stops at maxPages.

Can I monitor a site over time? That is what it is built for. Each run diffs against the last and fills in changes per page plus a roll-up on the site summary. Give each site its own stateStoreName if you monitor several. If the named store cannot be opened in your account the run still succeeds — it says so in the log and treats the run as a baseline rather than silently reporting "no changes" forever.

What if a check fails? Each sensor is independent and fails soft. If the TLS handshake times out, the certificate section reports the error and the other nine areas still return. A partial audit is still an audit.

Limits

• Server-rendered HTML only; no JavaScript execution.
• Accessibility covers the machine-checkable subset of WCAG, not contrast-on-image or focus order.
• Tech detection is fingerprint-based — it reports what leaves a trace in the markup.
• DNS is resolved over DoH; a domain behind a split-horizon resolver may read differently from inside its own network.
• Default cap of 10 pages per run, raise with maxPages (max 200).

---

Built by Broke to Built. Run it against your own site first — it takes one click and you can check every finding by hand.