Site Health Audit: Website Security, SEO & GDPR

What does Site Health Audit do?

Site Health Audit checks any website from its URL alone and returns a scored diagnosis: security, email deliverability, GDPR and legal pages, SEO, speed and AI visibility. No access to the site, no plugin, nothing to install on the owner's side.

It is built for web agencies, freelancers and AI agents that need a reliable website audit before quoting or starting work, and a report they can hand to the site owner:

• one score out of 100 and a grade from A to E per website, with a score per area;
• every finding with its impact in plain language and the fix;
• a client-ready PDF and HTML report under your own name;
• findings and report in English, French, German, Spanish or Italian;
• legal checks that follow the country of the website (European Economic Area, United Kingdom, Switzerland).

Because it runs on Apify, you can also call it through the API, schedule it to re-audit a list of sites every week, send results to other tools through integrations, and use it from an AI assistant through MCP.

What does the website audit check?

Area	Checks
Speed	response time, HTML weight, compression, HTTP/2, redirect chains, http → https
Security	SSL certificate (validity, expiry, protocol), HSTS, CSP, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, exposed server versions, CAA record
Email	MX, SPF, DKIM (25 common selectors, with a guard against DNS wildcards), DMARC and its policy
CMS	WordPress, PrestaShop, Shopify, Wix, Webflow, Squarespace, Joomla, Drupal, HubSpot. For WordPress: version, visible plugins and theme, xmlrpc.php, readme.html, user enumeration through the REST API (checked on the response content)
Privacy and legal	cookies set on first load, third-party trackers (Google Analytics / Tag Manager, Meta Pixel, Hotjar, LinkedIn, TikTok, Clarity), consent manager detection (about 30 vendors), links to the legal notice, privacy policy and terms, in the languages of the covered countries
SEO	title, meta description, <h1>, canonical, lang, viewport, noindex, alt attributes, Open Graph, hreflang, robots.txt, sitemap
AI visibility	access of AI crawlers in robots.txt (OpenAI, Anthropic, Perplexity, Google, Mistral AI, Apple, Meta, Amazon, Common Crawl), answer bots told apart from training bots; /llms.txt; schema.org structured data (valid JSON-LD, Organization or LocalBusiness entity, sameAs); nosnippet / noai directives; text readable without JavaScript

What do you get?

One dataset item per address:

• reachable: whether the website could be read. Only reached websites are graded, reported and charged;
• score: the score out of 100, the grade from A to E and the score per area;
• all_findings, sorted by severity. Each finding has a stable code, a severity (critical, major, minor), the technical message, the impact in plain language for the site owner, and the fix;
• a one-sentence summary;
• the jurisdiction applied (country, rules, and how the country was determined);
• sections: the raw data of every area;
• report_pdf_url and report_html_url: signed links to the client-ready report.

In the run's Output tab, the Overview view shows one row per website and the Findings view one row per finding. The reports are listed under Client-ready reports.

The client-ready report

The report is written for a business owner who is not technical. Page one gives the grade and the priorities. Each area follows, with what needs fixing and what is already in order. A technical appendix closes the report for whoever does the work. Your name, contact details and accent color appear on it when you provide them. The HTML version is a single self-contained file that reads well on a phone; the PDF is A4.

How to audit a website

1. Open the Input tab and enter one or more addresses in Websites to audit (full URL or bare domain).
2. Choose the language of the findings and report, and set the country of the website if you know it.
3. Optional: add your name, contact details and accent color to brand the report, or set Client-ready report to None to get the JSON data only.
4. Click Start. Websites are audited in parallel; one website never takes more than two minutes.
5. Read the results in the Output tab, download the reports, or export the dataset as JSON, CSV or Excel.

Input

{
  "urls": ["https://example.de", "another-site.com"],
  "language": "en",
  "country": "auto",
  "report": "pdf+html",
  "brandName": "Example Studio",
  "brandContact": "hello@studio.example",
  "brandAccent": "#1f3a8a",
  "concurrency": 3
}

Only urls is required. Bare domains are accepted. Duplicates are audited once. Up to 500 addresses per run.

• language: en (default), fr, de, es, it.
• country: auto (default) or an ISO code such as FR, DE, GB.
• report: pdf+html (default), html, pdf or none.
• concurrency: websites audited at the same time, 1 to 10 (default 3).

Only public websites on the standard ports (80 and 443) are accepted. An address that is not a public website (localhost, a private IP address, another scheme than http or https) gives an item with "error": "invalid_url" and is not charged.

Output

{
  "url": "https://example.de",
  "host": "example.de",
  "audited_at": "2026-10-03T06:59:05+00:00",
  "language": "en",
  "reachable": true,
  "score": {
    "total": 72,
    "grade": "C",
    "by_section": { "performance": 95, "security": 60, "email": 70, "privacy": 70, "seo": 80, "llm": 55 },
    "cap": null
  },
  "jurisdiction": { "country": "DE", "gdpr": true, "consent_required": true, "legal_notice_required": true, "legal_notice_name": "Impressum", "law_ref": "§ 5 DDG", "authority": null, "basis": "tld" },
  "all_findings": [
    {
      "section": "email",
      "code": "dmarc_missing",
      "severity": "major",
      "message": "No DMARC record on _dmarc.example.de",
      "impact": "Without DMARC, Gmail, Yahoo and Outlook treat your email with suspicion, and you cannot tell who is spoofing your address.",
      "fix": "Publish a DMARC record, starting in monitoring mode (p=none) with a reporting address."
    }
  ],
  "summary": "example.de: grade C (72/100). 12 issues found: 4 important, 8 to improve. Start with: …",
  "report_html_url": "https://api.apify.com/v2/key-value-stores/<store-id>/records/report-example.de.html?signature=<signature>",
  "report_pdf_url": "https://api.apify.com/v2/key-value-stores/<store-id>/records/report-example.de.pdf?signature=<signature>"
}

The excerpt leaves out cms and sections. score.cap is null, or { "limit": 59, "code": "<finding code>" } when a ceiling lowered the score (see the grade rules below).

The report links are signed: anyone who has the link can open the report, without an Apify account. They work as long as the run's storage is kept.

A website that could not be reached still gives an item, with "reachable": false, the reason in summary, and the DNS, email and certificate findings that could be established. It has no report links. An address that could not be audited at all gives "reachable": false with an error code (invalid_url, audit_timeout or audit_failed) and an error_message in English.

How much does a website audit cost?

Site Health Audit uses pay-per-event pricing. Platform usage is included: you pay only for these events.

Event	Price	Charged
Website audited (site_audited)	$0.03	once per website reached, when its result is in the dataset
Report generated (report_generated)	$0.15	once per website reached, when its report is stored. Not charged when the report is set to None
Actor start (apify-actor-start)	$0.00005	once per run, by the platform (once per GB of memory above 1 GB)

One website costs $0.03 for the data alone and $0.18 with the client-ready report. Auditing 100 websites with reports costs $18; the data alone costs $3.

You are only charged for websites the Actor could reach: an unreachable site, a site that blocks the check, or an invalid address costs nothing and produces no report. If a report cannot be generated, the audit is delivered and only the $0.03 is charged.

Can I cap the cost of a run?

Yes. Set a maximum cost for the run in Apify Console or through the API. Before starting a website, the Actor checks that the remaining budget covers its full price ($0.03, or $0.18 with a report). Websites that do not fit are skipped without any request, are not charged, and are listed in the run's final status message and in the log. A limit of $0.20 covers one website with its report.

Countries and legal checks

Three findings depend on the country: a missing legal notice, trackers loaded without a recognized consent manager, and a missing privacy policy.

• Country detection: your country input first, then a national domain (.fr, .de, .co.uk), then the region of the page language (de-AT). A language alone (lang="fr" on a .com) never triggers a national obligation, because French is also spoken in Belgium, Switzerland and Canada. Set country when you know it.
• Legal notice: reported as mandatory only where a national text and an established named page were sourced: France (mentions légales), Germany, Austria and Liechtenstein (Impressum), Spain (aviso legal). Elsewhere the audit stays silent.
• Tracker consent: reported across the EEA and the UK, except where the national rule could not be confirmed (Bulgaria, Estonia, Iceland) and not in Switzerland. In the UK, analytics-only sites are not flagged.
• Outside Europe: no legal claim is made; a missing privacy policy is reported as a good-practice point.

Where do the legal rules come from?

A legal obligation is stated for a country only when it was traced to a source: in most cases the national law on its official publication site or the country's data protection authority, alongside the European texts (GDPR, ePrivacy Directive, e-Commerce Directive); a few rules rest on secondary sources. When a rule could not be confirmed, the audit says nothing rather than guess. This is not legal advice, and the rules have not been reviewed by a lawyer.

How is the grade computed?

• Each area starts at 100 and loses 40 points per critical finding, 15 per major one, 5 per minor one.
• Missing security headers cost at most 15 points together, however many are missing.
• The overall score weights the six areas: security 25%, speed 20%, email 15%, privacy 15%, AI visibility 13%, SEO 12%.
• Grades: A from 90, B from 75, C from 60, D from 40, E below.
• A critical finding caps the overall score at 59 (grade D at best). An invalid SSL certificate caps it at 39 (grade E).
• A website that could not be reached gets no grade: the summary and the item say why (reachable is false).

FAQ

Is it legal to audit a website I do not own?

The audit only reads what a website publishes to every visitor and to public DNS: it makes a small number of ordinary, unauthenticated requests, identifies itself in its User-Agent, never tries to log in and never exploits anything. Even so, audit only websites you own or are authorised to assess, and follow the laws that apply to you. You are responsible for how you use the results.

Why does a website show as unreachable or blocked?

Some websites refuse automated visits (HTTP 401, 403 or 429), sit behind a bot-protection service, or answer too slowly. The item then has "reachable": false and its summary gives the reason. You are not charged. If the site is yours, allow the visit in your firewall or bot protection, or try again later; a temporary refusal often clears on a second run.

Why is a finding marked as a point to confirm?

Trackers and consent banners are read from the initial HTML, without running scripts. A banner loaded by another script can be missed, so the finding asks for a check in a browser before you act on it.

Can I audit a specific page instead of the home page?

Yes. The audit reads the address you give. Files such as robots.txt are always read at the root of the site.

What personal data is stored?

The results describe the website, not people. WordPress usernames are never stored, only their number. Cookies are stored by name, without their value. No email address is extracted from pages, and the report addresses of DMARC records are masked. From structured data, only the public entity the site declares about itself is kept (name, address of its page, public profiles), without its phone number. Page titles and descriptions are stored as published.

Where do I get help or report a problem?

Open an issue in the Issues tab of this Actor. Give the run ID and the address concerned.

Limits

• Read-only: unauthenticated GET requests only, no login attempt, no form submission, no write. Per website, the audit reads the address you give, checks whether http:// redirects to https://, and reads /robots.txt, /sitemap.xml, /llms.txt and /llms-full.txt, the public DNS records of the domain and the SSL certificate. On WordPress sites it also requests /wp-json/, /wp-json/wp/v2/users, /xmlrpc.php, /readme.html and /wp-login.php, once each, to check whether they are exposed. Nothing else is requested.
• One page per website: this is not a crawler, and internal pages are not visited.
• Trackers are read from the initial HTML, without running scripts: a consent banner loaded by another script can be missed.
• WordPress detection relies on public traces; a hardened site can hide its plugins and version.
• DKIM is looked up on 25 common selectors; a custom selector goes unnoticed, and the finding says so.
• AI visibility measures what can be verified from the site (access, structure, readability). It does not tell whether an assistant actually cites the site. llms.txt is a proposed standard with uneven adoption; its absence is reported as a minor point.
• Speed checks measure the HTML response, not a full browser rendering (no Core Web Vitals).
• An audit that has not finished after 120 seconds is stopped and not charged.
• Asian markets and their platforms are out of scope.

Use it from the API, schedules, integrations and AI agents

The Actor ID is fewbricks/site-health-audit.

API

Run the audit and get the results in one call:

curl -X POST "https://api.apify.com/v2/acts/fewbricks~site-health-audit/run-sync-get-dataset-items?token=<YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://example.com"], "language": "en", "report": "pdf"}'

Schedules and integrations

Save your list of websites as a task and add a schedule to audit it every week or every month. Use Apify integrations and webhooks to send each result to your own tools when a run finishes.

AI agents (MCP)

{ "mcpServers": { "apify": { "url": "https://mcp.apify.com?tools=fewbricks/site-health-audit" } } }

The dataset fields are described in the Actor's schemas, so an agent knows what each field means before it runs the audit.