Affiliate Link Health & Disclosure Auditor

Audit public publisher pages for affiliate-link failures, redirect risks, missing sponsored attributes, and missing disclosures. The Actor is designed for affiliate publishers, SEO agencies, and content teams that need repeatable JSON/CSV-ready findings rather than a generic broken-link crawl.

What it checks

• Affiliate destinations that return broken or server-error responses
• Redirect chains that lose recognized tracking parameters
• HTTPS links that downgrade to HTTP
• Excessive redirect chains
• Automated checks blocked by 401, 403, or 429 — reported as manual verification required, not falsely called broken
• Known bot-sensitive affiliate redirectors — reported as inconclusive when an automated 404 is not reliable proof
• Affiliate links missing rel="sponsored"
• New-tab links missing the explicit rel="noopener" hardening attribute
• Pages with affiliate links but no explicit disclosure phrase in parsed HTML text
• Publisher pages that fail or return a non-HTML response

Quick start

{
  "startUrls": [{ "url": "https://publisher.example/reviews/" }],
  "maxPages": 100,
  "maxAffiliateLinks": 1000,
  "concurrency": 5,
  "requestTimeoutSecs": 20,
  "sameDomainOnly": true,
  "affiliatePatterns": ["partner.example/click"]
}

Input reference

Field	Default	Purpose
startUrls	required	Public HTTP(S) pages where crawling starts
maxPages	50	Maximum publisher pages, capped at 500
maxAffiliateLinks	1000	Maximum unique destinations, capped at 5,000
concurrency	5	Parallel destination checks, capped at 20
requestTimeoutSecs	20	Per-request timeout, 5–60 seconds
sameDomainOnly	true	Keep discovered publisher pages on start hostnames
affiliatePatterns	[]	Up to 100 case-insensitive URL substrings for private networks

The Actor recognizes common affiliate networks, Amazon links containing tag, common external affiliate query parameters, and internal /go/, /out/, or /recommends/ redirect paths.

Output

Every dataset row is either a finding or the final audit_summary row.

{
  "type": "tracking_parameter_loss",
  "severity": "high",
  "pageUrl": "https://publisher.example/best-tools/",
  "affiliateUrl": "https://network.example/click?aff_id=123",
  "finalUrl": "https://merchant.example/product",
  "httpStatus": 302,
  "finalHttpStatus": 200,
  "redirectCount": 1,
  "trackingParametersLost": true
}

The summary contains:

• pagesAttempted, pagesAnalyzed, and pageFetchErrors
• pagesScanned (compatibility alias for successfully analyzed pages)
• stoppedBySpendingLimit
• uniqueAffiliateLinksChecked
• affiliateLinkLimitReached
• totalIssues
• issuesBySeverity
• issuesByType

Export the default dataset as JSON, CSV, Excel, XML, RSS, or connect it to Apify schedules, webhooks, and integrations.

How to interpret results

Finding	Meaning
broken_affiliate_link	Final destination returned a reliable 4xx/5xx response
unreachable_affiliate_link	DNS, connection, timeout, or URL-safety failure prevented verification
automated_check_blocked	Destination rejected automation; verify manually
automated_check_inconclusive	A bot-sensitive redirector returned a response that is not reliable proof of failure
tracking_parameter_loss	Recognized tracking parameters disappeared during redirects
insecure_redirect	An HTTPS link redirected to HTTP
excessive_redirect_chain	More than three redirects were observed
missing_rel_sponsored	At least one matching link on the page lacks sponsored
missing_rel_noopener	At least one matching new-tab link lacks the explicit noopener hardening attribute
missing_affiliate_disclosure	Affiliate links were found without an explicit phrase in parsed HTML text; rendered prominence still requires human review

Security and privacy

• Public HTTP(S) pages only
• Embedded URL credentials are rejected
• Localhost, private IP ranges, link-local addresses, and hostnames resolving to private addresses are blocked to reduce SSRF risk
• Redirects are bounded and revalidated
• Publisher response bodies are capped at 5 MB
• The Actor does not bypass login, CAPTCHAs, paywalls, or bot controls
• No customer credentials, cookies, or authentication headers are requested
• Input and output remain in the user's Apify run storage and follow the retention/settings of that Apify account

See PRIVACY.md for the complete data-handling statement.

Pricing

Planned launch pricing is pay per event:

• apify-actor-start: Apify's recommended default start price
• page-processed: one charge immediately before each publisher-page processing attempt, including an attempt that ends in a fetch error
• No apify-default-dataset-item charge, preventing double billing for findings

The Actor stops before unpaid page work when the run spending cap rejects another event.

Limitations

• Automated checks can be blocked or receive different responses than a human browser
• Disclosure detection is heuristic and currently targets explicit English and Dutch phrases in server-rendered HTML. It does not prove rendered visibility, proximity, or legal prominence
• Tracking-loss detection covers recognized query keys; server-side attribution cannot be observed
• JavaScript-only links that are absent from server-rendered HTML are not discovered
• A clean scan is not legal advice, a guarantee of affiliate attribution, or a complete compliance audit

Support

Email info@kayorama.nl with the Actor run ID, the affected public URL, and the finding type. Do not send passwords, cookies, private-page content, or API tokens.