Resource & Link Migration Auditor

Audit destination pages after a website migration. Given the post-migration pages — from one XML sitemap or an explicit URL list — the Actor fetches each page over HTTP, extracts every resource and link reference (anchors, images and srcset, scripts, stylesheets, media, iframes, canonical and hreflang links), resolves relative URLs, and checks each unique reference once per run. It reports references that still point at the old domain, broken (4xx/5xx) resources and links, redirects, mixed-content references on HTTPS pages, missing or empty references, and cross-domain references, with a per-page and per-run summary.

This is migration QA, not a crawler: discovered links are checked for status but are never crawled, so the audit surface stays bounded by your input pages. Each run is stateless — nothing is persisted between runs.

The package reuses the safe HTTP and SSRF validation core shared by the other Actors in this repository (sitemap_health_monitor, migration_qa_auditor); those packages and their tests are unchanged.

What it checks

• Every destination page's HTTP status and bounded redirect chain, with each hop target validated as a public address before it is followed
• References from a[href], img[src]/img[srcset], script[src], stylesheet link[href], video[src]/video[poster], audio[src], source[src]/source[srcset], iframe[src], canonical link[href], and hreflang alternate link[href]
• Old-domain references: any reference whose host matches an oldDomains entry or its subdomains
• HTTP failures (4xx/5xx) and fetch errors per reference
• Redirects per reference, including over-long chains and redirect responses without a Location
• Mixed content: http:// references on pages served over HTTPS
• Missing references (a tag without its primary attribute) and empty references (href="", src="")
• Cross-domain references, flagged via the internal field and optionally fetched with checkExternal
• Unsupported schemes (mailto:, tel:, javascript:, data:) and unsafe URLs, recorded without being fetched

Each unique reference URL is fetched at most once per run; every occurrence is reported with its own source page, tag, and attribute, so one shared stylesheet produces one network check and one record per page that uses it.

Input

Provide either sitemapUrl or urls — not both.

{
  "sitemapUrl": "https://new.example.com/sitemap.xml",
  "oldDomains": ["old.example.com"],
  "maxPages": 100,
  "maxReferencesPerPage": 100,
  "checkExternal": false
}

{
  "urls": ["https://new.example.com/pricing", "https://new.example.com/about"],
  "oldDomains": ["old.example.com", "assets-old.example.com"]
}

Field	Description
sitemapUrl	Public HTTP(S) XML sitemap listing destination pages. Nested sitemap indexes and gzip payloads are supported.
urls	Explicit destination page list, used instead of sitemapUrl. Entries are normalized and deduplicated.
oldDomains	Optional pre-migration domains. References to these domains or their subdomains are flagged as old-domain references.
maxPages	Hard cap on audited pages. Lists longer than this are rejected before any network work; sitemap-derived sets are truncated. Default 100; maximum 1,000.
maxReferencesPerPage	References extracted per page beyond this cap are dropped and counted as truncated. Default 100; maximum 500.
maxTotalReferences	Hard cap on unique reference URLs checked per run. Default and maximum 5,000.
concurrency	Concurrent page or reference fetches. Default 10; maximum 50.
timeoutSecs	Per-request timeout. Default 20 seconds; range 2-60.
maxRedirects	Maximum redirect hops followed per page or reference. Default 5; range 0-10.
checkExternal	Fetch cross-domain references too. Disabled by default: external references are recorded and flagged (external-not-checked) but not fetched.

Invalid combinations (both source modes, neither mode, empty lists, URLs with credentials or non-HTTP schemes, malformed oldDomains, counts above caps) fail fast with a clear validation error before any network work.

Output

Every run writes one summary record, one page-result record per audited page, and one reference-result record per reference occurrence to the default dataset.

Summary:

{
  "recordType": "summary",
  "checkedAt": "2026-08-07T09:15:00+00:00",
  "pagesAudited": 2,
  "pageFailures": 0,
  "referencesDiscovered": 14,
  "uniqueReferences": 11,
  "referencesChecked": 10,
  "httpFailures": 1,
  "redirects": 2,
  "oldDomainReferences": 3,
  "mixedContentReferences": 1,
  "errors": 0,
  "truncatedReferences": 0
}

Page result:

{
  "recordType": "page-result",
  "pageUrl": "https://new.example.com/pricing",
  "finalUrl": "https://new.example.com/pricing",
  "status": 200,
  "redirectChain": [
    {"url": "https://new.example.com/pricing", "status": 200}
  ],
  "referencesDiscovered": 9,
  "referencesTruncated": 0,
  "issueCodes": [],
  "error": null,
  "checkedAt": "2026-08-07T09:15:00+00:00"
}

Reference result:

{
  "recordType": "reference-result",
  "sourcePage": "https://new.example.com/pricing",
  "tag": "img",
  "attribute": "src",
  "referenceUrl": "https://old.example.com/assets/hero.png",
  "finalUrl": "https://old.example.com/assets/hero.png",
  "status": 404,
  "redirectChain": [
    {"url": "https://old.example.com/assets/hero.png", "status": 404}
  ],
  "internal": false,
  "oldDomainReference": true,
  "mixedContent": false,
  "issueCodes": ["old-domain-reference", "http-4xx"],
  "error": null,
  "checkedAt": "2026-08-07T09:15:00+00:00"
}

Issue codes: old-domain-reference, mixed-content, http-4xx, http-5xx, redirect, redirect-loop, redirect-chain-too-long, redirect-without-location, fetch-error, missing-reference, empty-reference, unsupported-scheme, unsafe-url, external-not-checked, non-html.

A reference is internal when its host matches the source page's host. References that are missing, empty, non-HTTP, or unsafe are reported with referenceUrl: null and are never fetched. truncatedReferences counts references dropped by maxReferencesPerPage or maxTotalReferences.

Pricing

The Actor uses Apify pay-per-event pricing with the page-audited charge event. When monetization is enabled, users are charged $0.002 per page audited — displayed as $2 per 1,000 pages. One page-audited event corresponds to one destination page audit, including extraction and checking of its bounded references; reference checks within a page do not generate extra events.

Apify platform usage (compute units and other resources consumed by the run) may still be shown to users according to their plan and Apify's pricing rules, as described in the Actor's listing.

The Actor respects the run's maximum total charge: it computes the chargeable page prefix from the Actor charging budget before any page work, audits only that prefix, and stops before page checks if no page can be charged.

Final pricing is configured in the Apify Store listing and may change subject to Apify's pricing-change notice rules.

Security and privacy

• Only public HTTP(S) targets are accepted.
• URL credentials, localhost, and non-public, loopback, link-local, multicast, unspecified, or reserved addresses are rejected.
• Every redirect target — for pages and references alike — is resolved and validated before it is followed; a redirect to a private address fails that item with an error record instead of being fetched.
• Page counts, reference counts, concurrency, redirects, response bytes, and timeouts are all capped before or during network work.
• The Actor does not use a browser, proxy, LLM, external database, or third-party analytics service.
• Each run is stateless; results live only in the run's default dataset, subject to the retention and access settings of the Apify account running the Actor.

Do not place secrets, private URLs, or personal data in any input field.

Limitations

• JavaScript-rendered pages are not rendered; references are extracted from the raw HTML only.
• The audit is bounded by the input pages: links discovered on pages are status-checked but never crawled, so references on pages outside the input are not discovered.
• Sitemap input must be a valid XML sitemap; nested indexes are followed up to 20 files.
• Reference checks verify reachability (status and redirects), not content correctness; bodies of resources are not downloaded.
• With checkExternal disabled, cross-domain references are reported from markup only, without a live status.
• Network failures and rate limits are reported as per-item errors; they are not automatically retried indefinitely.
• The Actor does not send notifications itself. Use Apify schedules, webhooks, or an automation platform.

Support

For reproducible issues, open an issue from the Actor page and include the Apify run ID, sanitized input, expected result, and affected public URL. Do not include API tokens or private data.

This Actor audits migration reference hygiene; it does not provide legal, security-audit, or uptime guarantees.