Real-browser scan on mobile (390px) and desktop: LCP, CLS with the exact elements that shift, TBT, TTFB, page weight, render-blocking files, oversized images, dead clicks, small tap targets, SEO basics and an optional revenue-impact estimate. Top 5 fixes ranked by impact + HTML report.
Security: proxy input. Only the proxy settings the input form offers are accepted: Apify Proxy, or custom proxy URLs starting with http:// or https://. Other proxy options (for example tieredProxyUrls) and SOCKS proxies are refused before anything is loaded, with a clear message; nothing is charged. Previously a proxy given as tieredProxyUrls skipped the private-network check.
Security: https proxies. A custom https:// proxy is now connected to over TLS (certificate checked, default port 443), so your proxy password is never sent in clear text.
Only Apify's own proxy host is trusted without a check (was: any *.apify.com name). Redirects followed by the built-in HTTP client no longer carry credentials to another site.
No change to outputs or pricing.
The user agent now points to this Actor's public Apify Store page instead of an e-mail address (bot name unchanged).
Start URLs, competitor URLs, internal pages, link checks, robots/sitemap probes, redirects, meta refreshes, script navigations, sub-resources, the agency logo and the alert webhooks are checked against private, loopback, link-local, cloud-metadata and internal destinations in every IP encoding; names are resolved once and the checked address is the one connected to (local DNS-pinned checking proxy for Chromium and the API client; with a customer proxy a per-site checking proxy chains to it; custom proxy URLs must be public hosts).
Refused URLs get an uncharged row (refused: private-network protection; not charged); a page that lands on a private address is refused and not charged. The summary reports sitesRefused and privateRequestsBlocked.
Shared modules src/ssrf-guard.ts + src/netguard.ts (same guard as privacy-policy-checker 2.0.4 / accessibility-auditor 1.0.4). No change to scoring, output fields or pricing.
2.0.5 (2026-10-15) — Price list wording
README pricing now matches the configured prices exactly: page scanned $0.04 (was shown as $0.05), extra lab run $0.01, field data $0.005, competitor comparison $0.05, PDF report $0.10, AI fix pack $0.05, regression alert $0.01. The worked examples were recalculated. The "proposed prices" note was removed. No change to the prices themselves, to inputs or to outputs.
2.0.0 (2026-10-11)
Flagship upgrade. Benchmarked against Lighthouse 12 on 25+ public sites; see BENCHMARK.md.
Accuracy
Lighthouse-compatible scoring: the performance score now uses Lighthouse's log-normal curves for each device.
Mobile is scored with the mobile curves, desktop with the desktop curves.
The default mobile profile is now Slow 4G + 4× CPU, the PageSpeed Insights / Lighthouse profile.
Fast 4G is still available.
Median of 1–5 runs per device (runsPerDevice). Extra runs are billed as extra-lab-run.
Real-user Core Web Vitals (optional): pulled from the Chrome UX Report with the user's own Google API key.
Covers LCP, INP, CLS, FCP and TTFB at p75, URL-level with origin fallback.
Includes Google's pass/fail assessment and plain-language notes where lab and field differ.
Dead-click false positives fixed: every suspected dead click is now clicked in a sandbox and kept only if nothing happens.
The sandbox blocks navigation and every non-GET request.
A "reaction" means a DOM change, a CSS-only reveal (:hover / :focus-within menus), a visual change, navigation, scroll, a pop-up or a non-tracking request.
Confirmed dead clicks are marked verifiedByClick.
Clicks on anything that looks like buy, submit, sign in or consent are never made.
New
INP proxy (tap test): taps up to 6 safe elements (menus, accordions, tabs and buttons) under 4× CPU and reads the Event Timing API.
Reports latency with an input delay / processing / paint split.
Names the scripts that ran during each slow tap (Long Animation Frames API).
Rage-click candidates: confirmed dead clicks, plus taps that take more than 400 ms.
LCP breakdown: TTFB, load delay, load time and render delay, with the bottleneck and a diagnosis.
Also detects lazy-loaded, unprioritised and CSS-background LCP images.
Element screenshots: close-ups of the LCP element and the top 3 layout-shift culprits, plus the annotated full screen.
Layout-shift "likely cause" heuristic: distinguishes an inserted banner, an ad or embed, a font swap, an image without dimensions, and content pushed from above.
Third-party cost per entity: for about 80 known vendors plus unknown domains, reports blocking ms, script ms, requests and bytes.
Prioritised fix list:
Each fix has an effort rating (low, medium or high) and a priority score (impact ÷ effort).
Each fix shows an estimated LCP saving where it can be reasoned about.
When business inputs are given, each fix also shows an estimated revenue gain.
Revenue estimate:
Labelled "ESTIMATE".
Uses real-user LCP when it is available.
Comes with verified, dated source citations.
Competitor comparison: compares your site with up to 5 competitors in one run.
Ranks every metric and lists where you lead and where you trail.
Stored as a type: "comparison" dataset item and in the COMPARISON record.
Monitoring mode: keeps history per site in a named key-value store and reports regressions and improvements.
Regressions need both an absolute and a relative change, to filter out lab noise.
Reports new and resolved issues.
Can output only the sites that changed.
Alerts: to a Slack incoming webhook and/or any public HTTPS webhook (both secret inputs).
White-label PDF report per site: agency name, logo and accent colour.
AI fix (optional, user's own Anthropic or OpenAI key): concrete code and config changes for the detected platform.
Covers WordPress, Shopify, Next.js and others.
Evidence pack: per-site JSON with timestamps, user agents, a HAR-lite request list with timings, and screenshot links.
More exports: CSV-friendly metrics_csv, third_parties and dead_clicks dataset views, plus an agent-ready SUMMARY.
Robots and identification: robots.txt is respected for start URLs and internal pages. The user agent carries a SiteVerdict-SpeedScanner token, like PageSpeed's Chrome-Lighthouse.
New pay-per-event events
extra-lab-run, field-data, competitor-comparison, pdf-report, ai-fix-pack and regression-alert (prices in the README's Pricing section). Each one is charged only when it delivers.
1.0.0 (2026-10-11)
First public release.
Two-device lab scan in real Chrome: mobile 390×844 with touch, 4× CPU slowdown and Fast or Slow 4G; desktop 1366×768.
Core Web Vitals: LCP with the LCP element, CLS session windows with the elements that shifted, TBT and the longest task, FCP and TTFB.
Page weight: bytes by type, third-party share, failed requests and missing compression.
Render blocking and images: render-blocking resources and image analysis.
Dead clicks: found through DevTools listener inspection plus React and Vue handler detection.
Tap targets: WCAG 2.2 SC 2.5.8 check with the spacing and inline exceptions.
SEO basics: on-page checks, robots.txt, sitemap and a broken internal link sample.
Results: Top 5 fixes, an annotated screenshot, the HTML report (REPORT) and the JSON summary (SUMMARY).
