# Website Launch Auditor: SEO, Broken Links, Security & QA (`mystique-lab/website-launch-auditor`) Actor

Pre-launch QA & security auditor for websites and modern web apps (Cursor, Lovable, Bolt, Next.js). Checks SEO, OpenGraph, broken/placeholder links, mobile UX, exposed .env/.git/sourcemaps, security headers & generates a copy-paste Cursor Fix Prompt.

- **URL**: https://apify.com/mystique-lab/website-launch-auditor.md
- **Developed by:** [Mystique Lab](https://apify.com/mystique-lab) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$5.00 / 1,000 audited website urls

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Launch Auditor: SEO, Broken Links, Security & Pre-Launch QA (`cursorFixPrompt`)

Ship with confidence. **Website Launch Auditor (MYSTIQUE LaunchShield)** is a fast, **$0-proxy** pre-launch QA, SEO, broken-link, mobile UX, and security scanner built for indie hackers, SaaS founders, agencies, and developers shipping with **Cursor, Windsurf, Cline, Lovable, Bolt.new, v0, Replit, Next.js, Astro, and Webflow**.

Instead of handing you a generic PDF checklist, **every audited URL includes a ready-to-paste `cursorFixPrompt`** containing exact DOM selectors, HTTP headers, and step-by-step code instructions so you can fix every bug in **Cursor, Windsurf, or Cline in a single prompt**.

***

### Why Developers & Agencies Use Website Launch Auditor

Modern coding tools (**Cursor, Lovable, Bolt, v0**) help you build an MVP in a weekend—but 90% of modern web apps ship with silent launch killers that tank conversions, SEO indexing, and security:

- **Dead Placeholder Links & Copy:** Unwired `href="#"` or `javascript:void(0)` buttons, hardcoded `http://localhost:3000` links, and leftover `Lorem ipsum` / `TODO:` strings.
- **Broken Social Preview Cards:** Missing or relative `og:image`, `og:title`, `og:description`, and `twitter:card` tags that look broken when shared on X/Twitter, LinkedIn, Slack, Discord, or iMessage.
- **Accidental Secret & Source Exposure:** Publicly downloadable `/.env` files, exposed `/.git/HEAD` repositories, macOS `/.DS_Store` files, and production JavaScript sourcemaps (`.js.map`) that leak proprietary frontend code.
- **Missing SEO & Crawl Foundations:** Missing `<meta name="description">`, `<link rel="canonical">`, `/robots.txt`, `/sitemap.xml`, or Schema.org `application/ld+json` structured data.
- **Mobile Layout & Accessibility Hazards:** Missing `width=device-width` viewport tags, hardcoded inline pixel widths (`>420px`) that cause horizontal scrollbars on mobile phones, unlabeled `<input>` controls, empty icon `<button>` tags, and missing `<img>` `alt` attributes.
- **Missing Security Headers & Mixed Content:** Missing `Strict-Transport-Security` (HSTS), `Content-Security-Policy` (CSP), `X-Content-Type-Options`, `X-Frame-Options`, or insecure `http://` assets loaded on `https://` pages.

***

### Pricing — Transparent Pay-Per-Event (`$0` Proxy Needed)

| Event | Price | Cost for 100 URLs | Cost for 1,000 URLs |
| :--- | :--- | :--- | :--- |
| **`audit`** (Full SEO + Security + Links + UX + `cursorFixPrompt`) | **`$0.005` / URL** | **$0.50** | **$5.00** |

- **$0.00 Start Fee** — no base actor startup charge.
- **$0.00 Proxy Cost** — runs in 256 MB RAM with fast concurrent HTTP & DOM inspection.

***

### Real Output Example (with Ready-to-Paste `cursorFixPrompt`)

```json
{
  "type": "audit",
  "url": "https://news.ycombinator.com",
  "finalUrl": "https://news.ycombinator.com",
  "statusCode": 200,
  "responseTimeMs": 171,
  "launchReadinessScore": 40,
  "grade": "F",
  "launchReady": false,
  "seoScore": 44,
  "securityScore": 100,
  "linksScore": 100,
  "uxAccessibilityScore": 64,
  "socialPreviewScore": 72,
  "totalIssues": 10,
  "criticalCount": 0,
  "highCount": 2,
  "mediumCount": 5,
  "lowCount": 3,
  "cursorFixPrompt": "You are an expert full-stack engineer. Perform a pre-launch remediation pass on the codebase for `https://news.ycombinator.com` (Current Launch Readiness Score: 40/100, Grade: F).\n\nFix every detected issue below in one shot without breaking existing layout or functionality:\n\n### 1. [HIGH] (seo) Missing `<meta name=\"description\">` tag\n- **Selector / Target:** `head > meta[name='description']`\n- **Detected Evidence:** No meta description present\n- **Required Fix:** Add `<meta name=\"description\" content=\"...\" />` (110–155 characters) summarizing the page value proposition.\n\n### 2. [HIGH] (social_preview) Missing OpenGraph social preview tag(s): og:title, og:description, og:image\n- **Selector / Target:** `head > meta[property^='og:']`\n- **Detected Evidence:** Missing: og:title, og:description, og:image (links shared on X, Slack, Discord, iMessage, and LinkedIn will render without a rich card)\n- **Required Fix:** Add `og:title`, `og:description`, and an absolute 1200x630 `og:image` URL inside `<head>`.\n\n### 3. [MEDIUM] (ux_accessibility) Page has no `<h1>` primary heading\n- **Selector / Target:** `body`\n- **Detected Evidence:** 0 <h1> tags found in DOM\n- **Required Fix:** Ensure the main hero/headline uses a single semantic `<h1>` element for screen readers and search engines.",
  "issues": [
    {
      "severity": "high",
      "category": "seo",
      "code": "MISSING_META_DESCRIPTION",
      "title": "Missing `<meta name=\"description\">` tag",
      "selector": "head > meta[name='description']",
      "evidence": "No meta description present",
      "fixInstruction": "Add `<meta name=\"description\" content=\"...\" />` (110–155 characters) summarizing the page value proposition."
    }
  ],
  "title": "Hacker News",
  "metaDescription": "",
  "ogTitle": "",
  "ogDescription": "",
  "ogImage": "",
  "twitterCard": "",
  "canonicalUrl": "",
  "hasRobotsTxt": true,
  "hasSitemapXml": false,
  "brokenLinks": [],
  "placeholderLinks": [],
  "exposedFiles": [],
  "missingSecurityHeaders": [],
  "auditedAt": "2026-10-24T17:24:00.000000+00:00"
}
```

***

### Copy-Paste Scheduled Automation (Python / n8n / cURL / GitHub Actions CI)

#### 1. cURL (Instant Pre-Launch Check or Webhook Trigger)

```bash
curl -s -X POST \
  "https://api.apify.com/v2/acts/mystique-lab~website-launch-auditor/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "urls": ["https://your-staging-app.vercel.app", "https://your-production-domain.com"],
    "checkBrokenLinks": true,
    "checkExposedFiles": true,
    "checkSecurityHeaders": true
  }' | jq '.[0] | {url, launchReadinessScore, grade, launchReady, cursorFixPrompt}'
```

#### 2. Python (`apify-client`)

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("mystique-lab/website-launch-auditor").call(
    run_input={
        "urls": ["https://stripe.com", "https://example.com"],
        "checkBrokenLinks": True,
        "maxLinksToCheckPerPage": 20,
        "checkExposedFiles": True,
        "checkSecurityHeaders": True,
    }
)

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(f"{item['url']} -> {item['launchReadinessScore']}/100 ({item['grade']})")
    if not item["launchReady"]:
        print("\n--- PASTE THIS INTO CURSOR / WINDSURF ---")
        print(item["cursorFixPrompt"])
```

#### 3. GitHub Actions CI Gate (Block Deploys with Critical Bugs or Exposed `.env`)

```yaml
name: LaunchShield Pre-Deploy Audit
on:
  deployment_status:
jobs:
  launch-audit:
    if: github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    steps:
      - name: Run MYSTIQUE LaunchShield on Preview URL
        run: |
          RESPONSE=$(curl -s -X POST \
            "https://api.apify.com/v2/acts/mystique-lab~website-launch-auditor/run-sync-get-dataset-items?token=${{ secrets.APIFY_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d "{\"urls\": [\"${{ github.event.deployment_status.target_url }}\"]}")
          echo "$RESPONSE" | jq '.[0].cursorFixPrompt' -r
          CRIT=$(echo "$RESPONSE" | jq '.[0].criticalCount')
          if [ "$CRIT" -gt 0 ]; then
            echo "Critical launch issues detected! Paste the Cursor Fix Prompt above to resolve."
            exit 1
          fi
```

#### 4. n8n / Make Scheduled Weekly Site Health Monitor

1. Add a **Schedule Trigger** (every Monday at 8:00 AM).
2. Add an **HTTP Request** node (`POST https://api.apify.com/v2/acts/mystique-lab~website-launch-auditor/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN`) with your client domains in `urls`.
3. Add an **IF** node checking `{{$json.launchReadinessScore < 85 || $json.criticalCount > 0}}` and route `{{$json.cursorFixPrompt}}` directly to your engineering **Slack** or **Linear** channel.

***

### Ready-to-Use Visual QA Audits, Frontend Design Rules & Extensions (`LAUNCH2` for `$2 OFF`)

Want a 24-hour multi-viewport Playwright Visual QA Audit, production UI design rules for Cursor/Windsurf, or 1-click website technology & SEO inspection in your browser?

- **[$27 LaunchShield 25-Point Visual QA, SEO, Security & Conversion Audit (`LAUNCH2` `$2 OFF`)](https://mystiquelabshop.gumroad.com/l/launchshield-visual-qa-audit/LAUNCH2)** — Full Desktop (`1440×900`) & Mobile (`390×844`) Playwright renders, broken link & security header scan, and a copy-paste developer remediation prompt.
- **[$0+ / $17 MYSTIQUE UI Taste & Frontend Polish Skills (`LAUNCH2` `$2 OFF`)](https://mystiquelabshop.gumroad.com/l/ui-taste-skills/LAUNCH2)** — `10` Free Starter Skills or the `40-Skill Pro Vault` (`SKILL.md` + `.cursorrules` + `DESIGN.md`) for agency-grade typography, color tokens, and layout polish.
- **[$0+ / $10 Startup X-Ray & LaunchShield Browser + Cursor/VS Code Extension (`LAUNCH2` `$2 OFF`)](https://mystiquelabshop.gumroad.com/l/startup-xray/LAUNCH2)** — Instant 1-click inspection of any site's tech stack, SEO/OpenGraph tags, security headers, and B2B signals (`$0+` Free Extension / `$10` Pro Key).
- **Full MYSTIQUE LAB Storefront:** <https://mystiquelabshop.gumroad.com> *(Promo Code `LAUNCH2` auto-applied above for `$2 OFF`)*

# Actor input Schema

## `urls` (type: `array`):

List of live URLs to audit (e.g. \['https://example.com', 'https://news.ycombinator.com']).

## `checkBrokenLinks` (type: `boolean`):

Concurrently test HTTP status codes of links found on each page to catch 404/500 dead links.

## `maxLinksToCheckPerPage` (type: `integer`):

Maximum number of unique HTTP/HTTPS links to verify per audited page (1–50).

## `checkExposedFiles` (type: `boolean`):

Probe /.env, /.git/HEAD, /.DS_Store, and linked JavaScript .js.map files for accidental production exposure.

## `checkSecurityHeaders` (type: `boolean`):

Check Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and HTTP mixed-content assets.

## `checkSeoAndSocial` (type: `boolean`):

Verify title, meta description, canonical URL, favicon, JSON-LD structured data, OpenGraph/Twitter tags, /robots.txt, and /sitemap.xml.

## `maxItems` (type: `integer`):

Maximum number of URLs to audit in a single run.

## Actor input object example

```json
{
  "urls": [
    "https://example.com",
    "https://news.ycombinator.com"
  ],
  "checkBrokenLinks": true,
  "maxLinksToCheckPerPage": 20,
  "checkExposedFiles": true,
  "checkSecurityHeaders": true,
  "checkSeoAndSocial": true,
  "maxItems": 25
}
```

# Actor output Schema

## `audits` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://example.com",
        "https://news.ycombinator.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("mystique-lab/website-launch-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://example.com",
        "https://news.ycombinator.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("mystique-lab/website-launch-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://example.com",
    "https://news.ycombinator.com"
  ]
}' |
apify call mystique-lab/website-launch-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,mystique-lab/website-launch-auditor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/0RWfNFxbh083xcw29/builds/H4O3n8CYkF4JCZ13a/openapi.json