# Changelog of Website AI-Readiness Audit (`madpai/ai-readiness-audit`) Actor

- **URL**: https://apify.com/madpai/ai-readiness-audit/changelog.md
- **Full Actor documentation**: https://apify.com/madpai/ai-readiness-audit.md

## Changelog

### 2026-11-02 (security update)

#### Security

- Connections are pinned to the addresses that passed the private-address check. Each host name is checked again when the connection opens, including redirect hops and robots.txt, so a name that switches to a private address after the first lookup (DNS rebinding) is never connected to. Private IP addresses written directly in a URL are refused too. TLS still verifies the host name.

#### Changed

- If a site's robots.txt host resolves to a private, loopback, link-local or reserved address, the item is now a free `blocked-private` (not `robots-unavailable`), not a robots.txt result.

### 0.1.3 (2026-11-02)

#### Fixed

- Every item that wasn't audited now has an `errorCode`. Inputs that aren't a URL or domain get a free `invalid-input` item, and unexpected failures get `internal-error`.
- The host name is looked up first. A domain that doesn't resolve now gets a free `unreachable` item ("DNS lookup failed (ENOTFOUND)") with no request sent, not even robots.txt. In 0.1.1 it came back as `robots-unavailable`. (Build 0.1.2 was an internal beta test build and was never released.) The same lookup feeds the private-address check.

### 0.1.1 (2026-11-02, first public release)

#### Added

- AI-readiness score (0–100) and grade with fixes: robots.txt rules for 16 AI crawlers, llms.txt, sitemap, HTTPS, and sampled-page checks for server-rendered text, JSON-LD, titles, headings, robots directives, dates and canonicals. Markdown report included.
- `errorCode` on items that weren't audited: `robots-disallowed`, `robots-unavailable`, `redirect-signin`, `blocked-private`, `http-error` or `unreachable`. Invalid inputs had no `errorCode` in this build.
- `redirectedTo` and a `redirected` finding when the homepage redirects to another host.

#### Changed

- robots.txt is read before any other request to a host (RFC 9309). If it can't be fetched (server error, 429 or network error), the site isn't audited.
- llms.txt, llms-full.txt and sitemap probes are checked against robots.txt, like sampled pages.
- About 1 request per second per host, or the robots.txt Crawl-delay if longer (up to 30 s), counted from the robots.txt request. Retry-After is honoured, and a host that answers 429 three times in a row gets no further requests. `ownSiteConfirmed` is required to relax robots.txt or the delay for your own sites.
- Only the first 256 KB of llms-full.txt is read. Default memory is 256 MB.
- Homepages that redirect to a sign-in page aren't audited. Private, loopback, link-local and reserved addresses are never requested.
- Different spellings of the same site are audited and charged once.

#### Pricing

- Pay per event: `site-audit` at $8 per 1,000 completed audits ($0.008 each). Unreachable, blocked and private-address sites are saved with an error and not charged.