Iframe Title Evidence Auditor

Audit iframe titles, names, sources, lazy loading, sandboxing, referrer policy, duplicates, and normalized static evidence.

Why this Actor

• one evidence row per iframe in document order
• title, name, src, sandbox, loading, allow, and referrerpolicy retained
• missing, empty, generic, and duplicate titles separated
• no claim to inspect embedded cross-origin content
• bounded SSRF-safe parent-page fetching

Input

Provide up to 500 credential-free public HTTP(S) URLs in pages, plus an optional per-run maxPages and per-request timeoutSecs. Localhost, private IP addresses, private DNS resolutions, credential-bearing URLs, unsafe redirects, responses above 2 MB, and more than five redirects are rejected.

Output

Each attempted page produces one normalized dataset row. Successful rows contain the final URL, HTTP status, redirects, evidence, summary, deterministic grade, and findings. Error rows state the exact failure and are not charged as completed audits. This is static response evidence, not legal advice, penetration testing, rendered-browser verification, or certification.

Charging

A small Actor-start event is charged once. Only successful page-audited rows are charged; failed fetches and error rows are not charged as completed audits. Inputs and memory are bounded so costs remain predictable.

Privacy and safety

Use public pages only. Do not submit credentials, cookies, private endpoints, customer lists, personal datasets, or proprietary content. The Actor does not log in, bypass access controls, replay sessions, or copy competitor content.

Public example

The launch manifest uses https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/iframe and requests exactly one page at 256 MB.