# Changelog of SiteVerdict — SSL & Uptime Monitor with Status Page (`siteverdict/siteverdict-ssl-uptime-status-page`) Actor

- **URL**: https://apify.com/siteverdict/siteverdict-ssl-uptime-status-page/changelog.md
- **Full Actor documentation**: https://apify.com/siteverdict/siteverdict-ssl-uptime-status-page.md

## Changelog

### 1.1.1 (2026-11-03)

- Listing text only: "No false alarms" corrected to "Fewer false alarms" (one 5 s re-check), slow alerts documented as sent on every slow check, README Slack example fixed. No code, price, event or memory changes.

### 1.1.0 (2026-11-02)

- Security: every HTTP check, TLS handshake, robots.txt fetch and alert webhook now connects through an SSRF-guarded DNS lookup, so a host cannot pass the private-address check and then resolve to a private address at connect time (DNS rebinding). Private IP literals are refused by the TLS probe too; 6to4, IPv4-compatible and site-local IPv6 forms of private addresses are blocked.
- Accuracy: new `failure` (timeout, connection-refused, dns-failure, tls-expired, tls-self-signed, tls-hostname-mismatch, tls-untrusted, http-status, …), `errorCode` and `tlsStatus` fields. A TLS probe that fails is reported as `not-checked` with a reason, never as a valid certificate, and no longer resets the expiry-alert threshold (which caused a duplicate alert). "Expired N day(s) ago" no longer overstates by one day.
- Billing: a run whose max charge exactly covers its work is no longer reported as stopped. When the limit is reached, unchecked URLs get free `skipped` rows and an honest status note ("N not processed (max total charge reached)"); refused checks leave no history point; the status page is written only after its charge succeeds and alerts are delivered only when charged.
- Contact address in the user agent is now hello@webrevenuescan.com.
- Dependencies: follow-redirects 1.16.2 and ip-address 10.7.5 (lockfile patch updates; clears the high npm advisory).

### 1.0.0 (2026-10-11)

- HTTP uptime checks (status, response time, TTFB, redirects, keyword present/absent, accepted status codes) with one confirmation retry before "down".
- TLS certificate inspection (expiry, issuer, subject, SANs, protocol, trust), plus an SSRF guard re-applied on every redirect hop.
- Persistent history in a named key-value store; uptime % for 24 h / 7 d / 30 d; incident log with durations.
- Static self-contained status page (status.html), status.json and per-monitor SVG uptime badges.
- Alerts on state changes (down, recovery, certificate expiring by threshold, untrusted certificate, optional slow) to Slack or webhook (secret, https-only inputs).
- robots.txt respected per origin; bot-protection pages reported as blocked and never charged.
- Pay-per-event charging within the run's maximum charge; sample mode with seeded history.