Web App Manifest Auditor

Audit one public web page for web app manifest and favicon readiness. The actor fetches the page, finds manifest and icon links, validates the manifest JSON, and returns a structured score with issues and recommendations.

Use cases

• Check launch pages for missing favicons or web app manifests.
• Monitor PWA installability basics across marketing sites and docs portals.
• Validate CMS templates after redesigns or migrations.
• Feed structured manifest and icon diagnostics into QA dashboards.

Input

Field	Type	Required	Description
startUrl	string	Yes	Public HTTP or HTTPS page URL to audit. Credentials and private network targets are rejected.
timeoutSeconds	integer	No	Request timeout for page and manifest fetches. Default is 10 seconds.

Output

Each run pushes one dataset item.

Field	Type	Description
inputUrl	string	Original URL submitted in the input.
normalizedInputUrl	string	URL after adding a default HTTPS scheme when omitted.
finalUrl	string	Final page URL after safe redirects.
status	integer or null	HTTP status returned by the page fetch.
ok	boolean	True when the page fetch completed with a 2xx or 3xx status and no fetch error.
checkedAt	string	ISO timestamp for the audit.
manifestUrl	string or null	First resolved rel="manifest" URL found on the page.
manifestStatus	integer or null	HTTP status returned by the manifest fetch.
manifestValid	boolean	True when the manifest was reachable and parsed as JSON.
manifestName	string or null	Manifest name, when present.
manifestShortName	string or null	Manifest short_name, when present.
faviconCount	integer	Number of favicon, shortcut icon, mask icon, and Apple touch icon links found.
favicons	array	Icon link records with rel, href, resolvedHref, sizes, and type.
manifestIconCount	integer	Number of icons declared in the manifest.
manifestIcons	array	Raw manifest icon records.
hasName	boolean	True when the manifest has name or short_name.
hasStartUrl	boolean	True when the manifest has start_url.
hasDisplay	boolean	True when the manifest has display.
hasThemeColor	boolean	True when the manifest has theme_color.
score	integer	Readiness score from 0 to 100.
grade	string	Letter grade from A to F.
issues	array	Problems found during the audit.
recommendations	array	Suggested fixes.
error	string or null	Fetch or validation error, when one occurred.

Example input

{
  "startUrl": "https://example.com",
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com",
  "normalizedInputUrl": "https://example.com/",
  "finalUrl": "https://example.com/",
  "status": 200,
  "ok": true,
  "checkedAt": "2026-07-15T00:00:00.000Z",
  "manifestUrl": "https://example.com/site.webmanifest",
  "manifestStatus": 200,
  "manifestValid": true,
  "manifestName": "Example App",
  "manifestShortName": "Example",
  "faviconCount": 1,
  "favicons": [
    {
      "rel": "icon",
      "href": "/favicon.ico",
      "resolvedHref": "https://example.com/favicon.ico",
      "sizes": "any",
      "type": null
    }
  ],
  "manifestIconCount": 2,
  "manifestIcons": [
    { "src": "/icon-192.png", "sizes": "192x192", "type": "image/png" },
    { "src": "/icon-512.png", "sizes": "512x512", "type": "image/png" }
  ],
  "hasName": true,
  "hasStartUrl": true,
  "hasDisplay": true,
  "hasThemeColor": true,
  "score": 100,
  "grade": "A",
  "issues": [],
  "recommendations": [],
  "error": null
}

Security

The actor fetches only public HTTP and HTTPS URLs. It rejects URL credentials, localhost and private IP literals, and hostnames that resolve to private IPv4 or IPv6 ranges. Redirect targets are validated before following. Response bodies are capped at 2 MB.

Pricing

Suggested pay-per-event pricing:

Event	Suggested price
Actor start	$0.005
Page audited	$0.01

This keeps single-page checks inexpensive while supporting scheduled QA and batch workflows.

FAQ

Does this check full PWA installability?

No. It checks manifest and icon readiness signals that can be verified from static HTML and manifest JSON. It does not run a browser, service worker, or Lighthouse audit.

Does it download every icon?

No. It extracts icon declarations and manifest icon records. It does not fetch each image file, which keeps runs fast and low maintenance.

Can I audit private staging sites?

No. The actor is designed for public unauthenticated pages only and blocks private network targets for SSRF safety.