🛡️ Website Tech Stack & Security Audit: SSL, Headers, Pixels

Audit any list of websites in one run and get one row per site with its technology stack (CMS, framework, CDN/WAF, analytics, ad pixels, chat, payments, cookie consent tool), its SSL certificate and TLS setup, its HTTP security headers graded A+ to F, its security.txt, and which AI crawlers its robots.txt blocks.

• ✅ Tech stack from the page code: script and asset URLs, meta tags and response headers, never words on the page, so a site that mentions Shopify is not called a Shopify store
• ✅ SSL certificate details: issuer, expiry and days left, TLS version, cipher, SANs, fingerprint, and whether the certificate is trusted
• ✅ Security headers grade with the missing headers and plain-English findings
• ✅ AI crawler rules read properly from robots.txt, including grouped rules
• ✅ Fast and cheap: plain HTTP and TLS, no browser, no proxies
• ✅ Unreachable sites and invalid inputs are free

What does it do?

For every website it:

1. Connects over TLS and reads the certificate: who issued it, when it expires, whether it is trusted, the TLS version and cipher.
2. Loads the home page, following redirects, and checks whether plain http:// redirects to https://.
3. Grades the HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin policies) and flags version leaks and wildcard CORS.
4. Identifies the technology from the page code and headers.
5. Reads /.well-known/security.txt, robots.txt and llms.txt.
6. Finds the security or trust page and the privacy, subprocessor and DPA links, and lists the compliance frameworks those pages mention.

Use cases

• 🎯 Agency and freelancer prospecting. Find sites with an expiring certificate, a failing security grade or an outdated stack, and lead with the fix.
• 🔎 Technographic lead lists. Every Shopify store, WordPress site or Next.js app in a list of domains, with their analytics and ad tools.
• 🛡️ Vendor and portfolio security reviews. A quick external hygiene check across hundreds of vendors or your own domains.
• ⏰ Certificate monitoring. Schedule it daily and alert when sslDaysRemaining drops below 14.
• 🤖 AI crawler research. Which publishers block GPTBot, ClaudeBot, PerplexityBot or Google-Extended.

What data can you get?

Group	Fields
Technology	cmsOrFramework, wafOrCdn, allDetectedTechnologies, techCategories (CMS and frameworks, analytics, ad pixels, consent tools, chat, payments), cookieConsentBanner, gtmContainerIds, ga4MeasurementIds
SSL / TLS	sslValid, sslIssuer, sslSubject, sslValidFrom, sslValidTo, sslDaysRemaining, sslExpired, sslSelfSigned, tlsVersion, cipherSuite, sslSanDomains, sslSha256Fingerprint, sslError
Security headers	securityGrade (A+ to F), securityScore (0–100), securityHeaders, missingSecurityHeaders, headerWarnings, serverHeader, xPoweredBy, cookiesSetCount, cookiesMissingSecureOrHttpOnly, httpRedirectsToHttps
security.txt	hasSecurityTxt, securityTxtUrl, securityTxtContacts, securityTxtExpires, securityTxtExpired, securityTxtPolicy
Crawlers	hasRobotsTxt, hasLlmsTxt, blockedAiCrawlers
Compliance pages	trustCenterUrl, trustCenterPlatform, privacyPolicyUrl, termsOfServiceUrl, subprocessorsUrl, dpaUrl, complianceMentions
Summary	riskFlags: the findings worth acting on, in plain English
Basics	domain, finalUrl, httpStatusCode, title, redirectChain, status

How the grade works

The score starts at 0 and adds points for a valid certificate on TLS 1.2 or 1.3 (25), HSTS (20), a Content-Security-Policy (20), framing protection (10), nosniff (10), a Referrer-Policy (7), a Permissions-Policy (5) and a cross-origin policy (3). It takes points off for HSTS with max-age=0, 'unsafe-inline' in the CSP, and server or framework version leaks. A+ is 90 or more, A 80, B 70, C 55, D 40, and below that F.

How to use it

1. Click Try for free (or Start) at the top of this page.
2. Paste websites into Websites or domains, one per line.
3. Leave the checks switched on, or turn off any you do not need for a faster run.
4. Press Start, then download the results from the Output tab as Excel, CSV or JSON.

Input example

{
  "websites": ["stripe.com", "wordpress.org", "shopify.com"],
  "checkSecurityTxt": true,
  "discoverCompliancePages": true,
  "checkRobotsAndAiBots": true
}

Output example

Shortened; real values from an audit of wordpress.org in October 2026:

{
  "domain": "wordpress.org",
  "status": "ok",
  "securityGrade": "C",
  "securityScore": 55,
  "cmsOrFramework": "WordPress",
  "allDetectedTechnologies": ["WordPress", "Google Tag Manager (GTM)"],
  "sslValid": true,
  "sslDaysRemaining": 68,
  "tlsVersion": "TLSv1.3",
  "httpRedirectsToHttps": true,
  "hasSecurityTxt": true,
  "trustCenterUrl": "https://wordpress.org/about/security/",
  "missingSecurityHeaders": ["Content-Security-Policy (CSP)", "..."],
  "riskFlags": ["Missing Content-Security-Policy (CSP) header"]
}

A news site that blocks AI crawlers returns, for example, "blockedAiCrawlers": ["GPTBot", "OAI-SearchBot", "ChatGPT-User", "ClaudeBot", "Claude-SearchBot", "PerplexityBot", "Google-Extended", "CCBot", "Bytespider", "Applebot-Extended"].

Statuses and errors

status	Meaning	Charged?
ok	The site was audited. Individual checks that could not run show null	Yes
unreachable	The site could not be loaded over HTTPS or HTTP. error says why	No
blocked	The site's bot protection or rate limiting refused the request (for example Cloudflare's "Too many requests"). The certificate details are still included, but headers and technology are not graded	No
invalid_input	Not a domain or URL, or it points at a private or internal address	No

How much does it cost?

You pay per website audited. Unreachable and invalid inputs are free, and platform usage is included.

Websites	Price on the Free and Bronze tiers
100	$0.30
1,000	$3.00
10,000	$30.00

FAQ

Is this a penetration test or vulnerability scan?

No. It only reads what any visitor's browser receives: the certificate, response headers, the home page and a few public files. It sends no attack traffic, so it is safe to run on any public site, and it is not a substitute for a real security assessment.

Why was a site blocked?

Some large sites behind bot protection (Cloudflare, Akamai and others) refuse automated requests from cloud servers, or rate-limit them. The tool retries once, and if the site still refuses it returns blocked with the certificate details it could read, and does not charge for it. In testing, most business websites answered normally; a few very large consumer brands and news sites did not.

Why did it miss a technology I know the site uses?

It reads the HTML the server sends. Tools added later by JavaScript or a tag manager, and anything behind a login, may not be visible. That is also why the cookie-consent finding says a consent tool "may still load through a tag manager".

What counts as an AI crawler being blocked?

A robots.txt group that names the crawler and disallows the whole site (Disallow: /). Rules that only block some paths, or a general User-agent: * rule, are not counted.

Can I use it through the API or from an AI agent?

Yes:

curl -X POST "https://api.apify.com/v2/acts/optimistical_lectern~website-security-compliance-auditor/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"websites": ["stripe.com"]}'

From Python: ApifyClient("YOUR_APIFY_TOKEN").actor("optimistical_lectern/website-security-compliance-auditor").call(run_input={"websites": ["stripe.com"]}). AI agents can use it through Apify's MCP server at mcp.apify.com. It runs with limited permissions.

Something looks wrong?

Open an issue on the Issues tab with the website. Every report is read.

Related tools

• 🌐 Domain WHOIS, DNS & Email Security: registration, mail provider, SPF and DMARC for the same domains
• 📇 Website Contact Extractor: who to contact at each site