Website SEO & Security Auditor

Complete SEO, security & technical-health audit in one run. Score 0-100, prioritized issues, concrete recommendations — no multiple tools needed.

Stop stitching together separate tools for meta tags, broken links, SSL certs, robots.txt, hreflang and structured data. This Actor audits any URL across all of them in a single call, returns a weighted score (0-100) with letter grade, and emits actionable recommendations derived from the actual HTTP response — no hard-coded metrics, no fabricated values.

Why this Actor?

• All-in-one audit — SEO + TLS + security headers + robots.txt + broken links + structured data in one run, not 5 separate tools
• Real certificate inspection — reads TLS issuer, validity period, days to expiry, trust status, TLS version and subject alternative names
• Mixed-content detection — finds HTTP resources on HTTPS pages with concrete examples
• Smart broken-link checking — HEAD-first with GET fallback per link, configurable cap, reports 4xx/5xx with status codes
• hreflang + x-default — detects all variants, flags missing x-default
• JSON-LD validation — lists @types found, reports invalid blocks
• No start fee — you only pay per page actually audited ($0.01). Failed fetches, timeouts, non-HTML resources are not charged.

What gets checked

On-page SEO — title length, meta description length, H1 count + text, heading structure (H1-H6), canonical validity, lang attribute, meta robots (noindex detection), visible-text word count, image alt coverage, internal vs external link inventory, Open Graph + Twitter Card, hreflang incl. x-default, JSON-LD structured data, viewport meta, favicon.

Security — TLS certificate (issuer, validity, days to expiry, trust, TLS version, SANs), HSTS, CSP (with unsafe-inline/unsafe-eval warnings), X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, mixed HTTP/HTTPS content, Server/X-Powered-By version leakage.

Technical health — redirect chain following (reports full chain + count), broken-link summary (HEAD with GET fallback), robots.txt fetch (lists sitemaps, detects global Disallow: /), response time in ms, gzip/deflate handling, content truncation flag for pages > 5 MB.

Input

Both urls (array) and url (single string) work.

{
  "urls": ["https://example.com", "example.org"],
  "checkBrokenLinks": true,
  "maxLinksToCheck": 25,
  "checkTlsCertificate": true,
  "checkRobotsTxt": true,
  "maxConcurrency": 5,
  "timeoutSeconds": 15,
  "outputFormat": "both"
}

Field	Type	Default	Description
urls	array	—	URLs to audit. https:// is added automatically if missing
url	string	—	Convenience field for a single URL
checkBrokenLinks	boolean	true	HEAD-check links on the page
maxLinksToCheck	integer	25	Cap per page. 0 disables link checking
checkTlsCertificate	boolean	true	Read the TLS certificate
checkRobotsTxt	boolean	true	Fetch and parse robots.txt
maxConcurrency	integer	5	Parallel fetches
timeoutSeconds	integer	15	Per-request timeout (seconds)
maxRedirects	integer	5	Redirects to follow
userAgent	string	Chrome UA	Leave empty for a standard Chrome UA (recommended)
outputFormat	enum	both	csv, json, or both
proxyConfiguration	object	off	Apify Proxy for bot-protected sites

Output

One dataset item per URL. Every field is computed from the actual response.

Field	Type	Description
requestedUrl	string	URL you submitted
finalUrl	string	URL after redirects
ok	boolean	true only on HTTP 2xx with completed audit
httpStatus	integer	Final status code
error	string/null	Real error message (timeout after 15000ms, ENOTFOUND: ...)
score	integer	0-100 weighted sum of all checks
grade	string	A-F
issues	array	{id, severity, weight, message} — critical, warning or info
recommendations	array	Plain-text recommendations, prioritized
criticalCount / warningCount	integer	Counts by severity
redirectCount / redirectChain	integer / array	Full redirect chain with status codes
fetchDurationMs	integer	Actual response time
seo object	—	All SEO fields above
security object	—	Headers, mixed content, certificate
robots object	—	found, sitemaps, disallowsAllCrawlers
links object	—	linksChecked, brokenCount, broken[]
server / contentType / cacheControl	string/null	From response headers
contentTruncated	boolean	true if page > 5 MB
auditDurationMs	integer	Total audit time for the page

Also saved to key-value store: report.csv (36 columns, flat, Excel/Sheets-ready), report.json (everything + summary), OUTPUT (same as report.json).

Pricing

Event	Price
Page audited (page-audited)	$0.01

No start fee. Only successfully audited pages are charged. 100 pages = $1.00.

Usage

Single URL

apify call sootesting~website-seo-security-auditor \
  --input '{"url": "https://example.com"}'

Multiple URLs

apify call sootesting~website-seo-security-auditor \
  --input '{"urls": ["https://example.com", "https://example.org"], "checkBrokenLinks": true}'

Run via API

curl -X POST "https://api.apify.com/v2/acts/sootesting~website-seo-security-auditor/runs?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

Schedule for regression detection

Run daily or weekly to catch expiring certificates, newly broken links, or missing meta tags.

Limitations

• Static HTML parsing — content rendered only by JavaScript is not seen
• Link checking uses HEAD; if the server returns 400/403/405/501, a GET retry is made before marking as broken
• Only HTML pages are audited — PDFs, JSON and images are reported as not_html and not charged
• Pages larger than 5 MB are truncated (contentTruncated: true)
• Bot-protected sites may require proxyConfiguration (Apify Proxy is then used for all calls: page fetch, robots.txt and link checking)