# Changelog of SiteVerdict — Core Web Vitals, Dead Click & SEO Scanner (`siteverdict/siteverdict-speed-revenue-scanner`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-speed-revenue-scanner/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-speed-revenue-scanner.md

## Changelog

### 2.0.7 (2026-10-16) — Proxy input security

- **Security: proxy input.** Only the proxy settings the input form offers are accepted: Apify Proxy, or custom proxy URLs starting with `http://` or `https://`. Other proxy options (for example `tieredProxyUrls`) and SOCKS proxies are refused before anything is loaded, with a clear message; nothing is charged. Previously a proxy given as `tieredProxyUrls` skipped the private-network check.
- **Security: https proxies.** A custom `https://` proxy is now connected to over TLS (certificate checked, default port 443), so your proxy password is never sent in clear text.
- Only Apify's own proxy host is trusted without a check (was: any `*.apify.com` name). Redirects followed by the built-in HTTP client no longer carry credentials to another site.
- No change to outputs or pricing.
- The user agent now points to this Actor's public Apify Store page instead of an e-mail address (bot name unchanged).

### 2.0.5 (2026-10-15) — Private-network (SSRF) protection

- Start URLs, competitor URLs, internal pages, link checks, robots/sitemap probes, redirects, meta refreshes, script navigations, sub-resources, the agency logo and the alert webhooks are checked against private, loopback, link-local, cloud-metadata and internal destinations in every IP encoding; names are resolved once and the checked address is the one connected to (local DNS-pinned checking proxy for Chromium and the API client; with a customer proxy a per-site checking proxy chains to it; custom proxy URLs must be public hosts).
- Refused URLs get an uncharged row (`refused: private-network protection; not charged`); a page that lands on a private address is refused and not charged. The summary reports `sitesRefused` and `privateRequestsBlocked`.
- Shared modules `src/ssrf-guard.ts` + `src/netguard.ts` (same guard as privacy-policy-checker 2.0.4 / accessibility-auditor 1.0.4). No change to scoring, output fields or pricing.

### 2.0.5 (2026-10-15) — Price list wording

- README pricing now matches the configured prices exactly: page scanned **$0.04** (was shown as $0.05), extra lab run $0.01, field data $0.005, competitor comparison $0.05, PDF report $0.10, AI fix pack $0.05, regression alert $0.01. The worked examples were recalculated. The "proposed prices" note was removed. No change to the prices themselves, to inputs or to outputs.

### 2.0.0 (2026-10-11)

Flagship upgrade. Benchmarked against Lighthouse 12 on 25+ public sites; see BENCHMARK.md.

#### Accuracy

- **Lighthouse-compatible scoring:** the performance score now uses Lighthouse's log-normal curves for each device.
  - Mobile is scored with the mobile curves, desktop with the desktop curves.
  - The default mobile profile is now **Slow 4G + 4× CPU**, the PageSpeed Insights / Lighthouse profile.
  - Fast 4G is still available.
- **Median of 1–5 runs per device** (`runsPerDevice`). Extra runs are billed as `extra-lab-run`.
- **Real-user Core Web Vitals (optional):** pulled from the Chrome UX Report with the user's own Google API key.
  - Covers LCP, INP, CLS, FCP and TTFB at p75, URL-level with origin fallback.
  - Includes Google's pass/fail assessment and plain-language notes where lab and field differ.
- **Dead-click false positives fixed:** every suspected dead click is now clicked in a sandbox and kept only if nothing happens.
  - The sandbox blocks navigation and every non-GET request.
  - A "reaction" means a DOM change, a CSS-only reveal (`:hover` / `:focus-within` menus), a visual change, navigation, scroll, a pop-up or a non-tracking request.
  - Confirmed dead clicks are marked `verifiedByClick`.
  - Clicks on anything that looks like buy, submit, sign in or consent are never made.

#### New

- **INP proxy (tap test):** taps up to 6 safe elements (menus, accordions, tabs and buttons) under 4× CPU and reads the Event Timing API.
  - Reports latency with an input delay / processing / paint split.
  - Names the scripts that ran during each slow tap (Long Animation Frames API).
- **Rage-click candidates:** confirmed dead clicks, plus taps that take more than 400 ms.
- **LCP breakdown:** TTFB, load delay, load time and render delay, with the bottleneck and a diagnosis.
  - Also detects lazy-loaded, unprioritised and CSS-background LCP images.
- **Element screenshots:** close-ups of the LCP element and the top 3 layout-shift culprits, plus the annotated full screen.
- **Layout-shift "likely cause" heuristic:** distinguishes an inserted banner, an ad or embed, a font swap, an image without dimensions, and content pushed from above.
- **Third-party cost per entity:** for about 80 known vendors plus unknown domains, reports blocking ms, script ms, requests and bytes.
- **Prioritised fix list:**
  - Each fix has an effort rating (low, medium or high) and a priority score (impact ÷ effort).
  - Each fix shows an estimated LCP saving where it can be reasoned about.
  - When business inputs are given, each fix also shows an estimated revenue gain.
- **Revenue estimate:**
  - Labelled "ESTIMATE".
  - Uses real-user LCP when it is available.
  - Comes with verified, dated source citations.
- **Competitor comparison:** compares your site with up to 5 competitors in one run.
  - Ranks every metric and lists where you lead and where you trail.
  - Stored as a `type: "comparison"` dataset item and in the `COMPARISON` record.
- **Monitoring mode:** keeps history per site in a named key-value store and reports regressions and improvements.
  - Regressions need both an absolute and a relative change, to filter out lab noise.
  - Reports new and resolved issues.
  - Can output only the sites that changed.
- **Alerts:** to a Slack incoming webhook and/or any public HTTPS webhook (both secret inputs).
- **White-label PDF report** per site: agency name, logo and accent colour.
- **AI fix (optional, user's own Anthropic or OpenAI key):** concrete code and config changes for the detected platform.
  - Covers WordPress, Shopify, Next.js and others.
- **Evidence pack:** per-site JSON with timestamps, user agents, a HAR-lite request list with timings, and screenshot links.
- **More exports:** CSV-friendly `metrics_csv`, `third_parties` and `dead_clicks` dataset views, plus an agent-ready `SUMMARY`.
- **Robots and identification:** robots.txt is respected for start URLs and internal pages. The user agent carries a `SiteVerdict-SpeedScanner` token, like PageSpeed's `Chrome-Lighthouse`.

#### New pay-per-event events

`extra-lab-run`, `field-data`, `competitor-comparison`, `pdf-report`, `ai-fix-pack` and `regression-alert` (prices in the README's Pricing section). Each one is charged only when it delivers.

### 1.0.0 (2026-10-11)

First public release.

- **Two-device lab scan in real Chrome:** mobile 390×844 with touch, 4× CPU slowdown and Fast or Slow 4G; desktop 1366×768.
- **Core Web Vitals:** LCP with the LCP element, CLS session windows with the elements that shifted, TBT and the longest task, FCP and TTFB.
- **Page weight:** bytes by type, third-party share, failed requests and missing compression.
- **Render blocking and images:** render-blocking resources and image analysis.
- **Dead clicks:** found through DevTools listener inspection plus React and Vue handler detection.
- **Tap targets:** WCAG 2.2 SC 2.5.8 check with the spacing and inline exceptions.
- **SEO basics:** on-page checks, robots.txt, sitemap and a broken internal link sample.
- **Results:** Top 5 fixes, an annotated screenshot, the HTML report (`REPORT`) and the JSON summary (`SUMMARY`).
- **Revenue estimate:** optional and transparent.
- **Pay-per-event charging:** `page-scanned`.