Download images and files in bulk from direct URLs or from every image on a list of web pages (img, srcset, og:image), plus linked PDFs, CSVs or ZIPs. Files saved to Apify storage with links, size, dimensions, alt text and SHA-256. Dedupe and size filters. $1 per 1,000 files.
2026-11-02 (actor.json version unchanged: 1.0): private-address (SSRF) guard
On the Apify platform, every request (input URLs, image and file links found on pages, each redirect hop, and
robots.txt) is refused when the host resolves to a private, loopback, link-local, carrier-grade NAT, reserved,
multicast or unspecified address (including IPv4-mapped IPv6), or when any of the host's addresses is one. Same
rules as Bulk HTTP Request.
Such a URL is not charged and counts in failed, with the reason "not fetched: private, loopback and link-local
addresses are not allowed" in the log and, when no file is saved, in the usual free status row
(recordType: "status", message: "Not charged: no file was saved. ...").
A site whose own host is private is reported as blocked (not as a robots.txt problem). A robots.txt that redirects
to a private address makes the site disallowed, like an unreachable robots.txt.
A host that cannot be resolved still fails as before ("DNS or connection error"); if that happens on robots.txt
the reason now names DnsLookupFailed instead of ConnectError.
Local runs (APIFY_IS_AT_HOME not set) are unchanged.
Files: my_actor/common.py (guard helpers; Http._robots_for checks the site first), my_actor/main.py (hook
on the httpx client, Blocked handled), tests/test_ssrf_guard_1102t.py (new), README Limits (one line).
