# Changelog of WCAG 2.2 & EAA Accessibility Checker · SiteVerdict (`siteverdict/siteverdict-accessibility-auditor`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-accessibility-auditor/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-accessibility-auditor.md

## Changelog

All notable changes to SiteVerdict — Website Accessibility Auditor (WCAG 2.2 & EAA).

### 1.0.10 (2026-10-17) — URL privacy in the crawl state

- **Privacy:** the crawl bookkeeping record `CRAWL_STATE` in the run's key-value store no longer keeps the full URLs of the pages entered or found (which could include a query string such as `?token=…`). It now keeps only their `urlHash` (the same 16-hex SHA-256 value as the dataset field), which is enough to avoid auditing a page twice after a platform migration. The full URL is used only in memory while the audit runs. A crawl state written by an earlier build is converted when it is read.
- No change to inputs, outputs, scoring or pricing.

### 1.0.9 (2026-10-16) — Proxy input security + URL privacy

- **Security: proxy input.** Only the proxy settings the input form offers are accepted: Apify Proxy, or custom proxy URLs starting with `http://` or `https://`. Other proxy options (for example `tieredProxyUrls`) and SOCKS proxies are refused before anything is loaded, with a clear message; nothing is charged. Previously a proxy given as `tieredProxyUrls` skipped the private-network check.
- **Security: https proxies.** A custom `https://` proxy is now connected to over TLS (certificate checked, default port 443), so your proxy password is never sent in clear text.
- Only Apify's own proxy host is trusted without a check (was: any `*.apify.com` name). Redirects followed by the built-in HTTP client no longer carry credentials to another site.
- No change to outputs or pricing.
- The dataset, `SUMMARY`, the HTML report and the run log no longer repeat the query string, fragment or credentials of the URLs you enter (or of pages found while crawling): `https://shop.example/reset?token=…` is shown as `https://shop.example/reset?[redacted]`. New field `urlHash` (first 16 hex characters of SHA-256 over the full URL) to join rows to your own list. The audit itself still loads the full URL. No change to inputs or pricing.

### 1.0.8 (2026-10-16) — Custom proxy pinning

- When you use your own proxy (Apify Proxy or custom proxy URLs), the browser and the robots.txt reader now go through a local checking proxy chained to your proxy, instead of connecting to your proxy directly. Every address is checked there, and the connection to your proxy is made to exactly the address that was checked, so a proxy host name that later points to a private or internal address is refused. No change to inputs, outputs or pricing.

### Memory default (15 Oct 2026)

- 15 Oct 2026 (build after this entry): default run memory is now 2048 MB via `defaultMemoryMbytes` (was 4096 MB; peak 648 MB at 2048). Measured on the example input: same output, see the public-15 remediation log. You can still choose more memory per run. No change to inputs, outputs or pricing.

### 1.0.4 (2026-10-15) - private-network (SSRF) protection

- **Security: private, local and internal addresses are refused.** Start URLs pointing to `localhost`, `127.0.0.1`, private ranges (10.x, 172.16-31.x, 192.168.x), link-local, CGNAT, the cloud metadata address `169.254.169.254`, IPv6 loopback/unique-local, IPv4-mapped IPv6, or decimal/octal/hex IP forms are refused before anything is loaded, with a `failed` row that says why. Nothing is charged. Names that resolve to such addresses are refused too.
- **Every browser request is checked, not only the first page.** Without your own proxy, Chromium and the robots.txt reader send every request (redirects, images, scripts, iframes, fetch/XHR, WebSockets, crawled links) through a local checking proxy that resolves each host once, refuses private answers and connects to exactly the checked address (DNS rebinding cannot switch the target). With your own proxy, every browser request is checked by request interception instead.
- No change to inputs, outputs, scoring or pricing.

### 1.0.0 (2026-10-11)

First release.

- axe-core 4.14.0 with WCAG 2.0, 2.1 and 2.2 Level A and AA tags (optional AAA) plus best-practice rules.
- Desktop (1366 px) and mobile (390 px touch, mobile user agent) audits, both included in one `page-audited` event.
- Custom checks:
  - keyboard Tab-through: visible focus (2.4.7), focus off-screen, focus obscured by sticky content (2.4.11), possible keyboard trap (2.1.2), focus-triggered navigation (3.2.1), skip link present, missing or broken (2.4.1)
  - WCAG 2.2 target size (2.5.8) with the spacing and inline exceptions
  - reflow at 320 px (1.4.10)
  - long animations (2.2.2) and prefers-reduced-motion support (2.3.3)
  - vague link text (2.4.4), placeholder-only labels (3.3.2), suspicious alt text (1.1.1), generic page title (2.4.2), pages with no headings (1.3.1)
- Every issue is mapped to WCAG success criteria and level, EN 301 549 clause and EAA relevance, with a severity, selectors, HTML snippets and a plain-English fix.
- Per-page 0–100 score, A–F grade, severity counts and top 10 fixes. Per-site summary. Shareable, printable HTML report (`REPORT`) and JSON summary (`SUMMARY`).
- Optional same-site crawl with robots.txt support, include/exclude patterns, depth and page limits.
- Pages that fail, are blocked, are skipped or redirect off-site are reported and never charged. Respects the user's maximum charge.