Website Tech Stack & SEO Audit (SSL, DNS, Security Headers)

Run an on-page SEO audit and tech stack detection on a list of websites in bulk with plain HTTP and DNS requests (no browser, so it is fast and cheap); an optional local business website audit mode checks restaurants, trades and clinics. For every domain you get one structured record covering tech stack, on-page SEO, security headers, SSL certificate expiry, DNS and email provider, plus a simple 0-100 score with a prioritized list of issues and recommendations.

Keywords: website audit API, SEO audit tool, tech stack detector, security headers checker, SSL expiry checker, bulk domain analysis, agency lead qualification.

What you get per site

• HTTP: final URL, redirect chain, status code, response time, HTTPS, HSTS, compression, server header, and which security headers are present or missing (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).
• SSL: issuer, valid from/to, days until expiry, protocol.
• DNS: A/AAAA, MX with an email provider guess (Google Workspace, Microsoft 365, Zoho, Proton and others), NS with a DNS host guess (Cloudflare, Route 53 and others), SPF and DMARC records and policies.
• Tech stack: about 40 built-in signatures: CMS (WordPress, Shopify, Wix, Squarespace, Webflow, Drupal, Joomla, Ghost), frameworks (Next.js, Nuxt, React, Vue, Angular, Gatsby), analytics and tags (GA4, GTM, Meta Pixel, Hotjar, Segment, HubSpot, Intercom, Plausible), CDN/hosting (Cloudflare, Fastly, Akamai, Vercel, Netlify, CloudFront), commerce (Stripe, WooCommerce, BigCommerce, PayPal) and a few libraries and servers.
• On-page SEO: title and length, meta description and length, canonical, robots meta, H1 count, Open Graph and Twitter tags, lang, viewport, JSON-LD types, image alt coverage, word count, internal/external link counts, robots.txt presence, declared sitemaps, sitemap URL count (capped).
• Score and issues: 0-100 score, issues sorted by severity, matching recommendations.
• Local business checks (optional): set "localBusinessMode": true to add a localBusiness block per site for restaurants, trades and clinics: PDF menu or price-list links, phone shown without a tappable tel: link, missing LocalBusiness schema or opening hours, stale footer copyright year, estimated homepage weight, and mobile viewport. It has its own localScore and plain-English issues. Same price per site; off by default.

Use cases

• Agency lead qualification: find prospects with missing meta tags, no HTTPS, weak security headers, or an outdated CMS.
• Competitor stack research: see which CMS, analytics and marketing tools competitors run.
• Security header check: bulk check HSTS, CSP and friends across your portfolio or clients.
• SSL expiry monitoring: schedule the actor daily and alert when sslDaysRemaining is low.
• Email deliverability hygiene: find domains without SPF or DMARC.
• Local business website review: with local business mode on, spot the fixes a small business owner cares about (click-to-call, menu as a web page, hours in Google-readable schema, a current footer).

Input

{ "urls": ["apify.com", "https://wordpress.org", "example.com"], "maxSitemapUrls": 1000, "concurrency": 10, "timeoutSecs": 15 }

Output (abridged)

{
  "domain": "example.com", "ok": true, "status": 200, "score": 58,
  "issues": ["[low] No HSTS header", "[medium] Missing meta description"],
  "technologies": ["Cloudflare"], "emailProvider": null, "dnsProvider": "Cloudflare", "sslDaysRemaining": 76,
  "http": { "finalUrl": "https://example.com/", "responseTimeMs": 91, "compression": "br", "missingSecurityHeaders": ["Content-Security-Policy"] },
  "ssl": { "issuer": "Let's Encrypt", "validTo": "2026-12-25T00:00:00.000Z", "daysRemaining": 76 },
  "dns": { "mx": [], "spf": null, "dmarc": null },
  "seo": { "title": "Example Domain", "h1Count": 1, "wordCount": 27, "robotsTxt": { "present": false }, "sitemap": null }
}

Pricing

Event	Price	Per 1,000
Site audited successfully	$0.004	$4.00

Failed domains (DNS error, timeout, refused) return ok: false with an error and are not charged. You're never charged for failed or empty lookups, and the run's status message tells you why any input came back short. The run stops cleanly at your spending limit.

FAQ

Does it use a browser? No. It fetches the homepage HTML, robots.txt and sitemap.xml, and does DNS and TLS lookups. That keeps it fast and cheap. Does it identify itself? Yes: WintersWorksSiteAudit/1.0 (+contact wintersworks.shop@gmail.com). It makes a small, fixed number of requests per site (homepage, robots.txt, sitemap) and does not crawl. How accurate is tech detection? Signatures are matched against the initial HTML, response headers and cookies. It is a best-effort fingerprint list written for this actor, not a complete database. What is the score? A simple heuristic starting at 100 with deductions per issue. It is a quick triage signal, not a Google ranking prediction.

Limitations

• Homepage only (or the exact URL you give); no site crawl, no Core Web Vitals or rendered-page metrics.
• Content added by JavaScript is not seen, so SPA sites may show low word counts and miss some technologies.
• Sites that block datacenter IPs or bots may return 403 or challenge pages; the audit then reflects that response.
• Email provider and DNS host are guesses from MX and NS hostnames. DKIM is not checked.
• Sitemap counting reads the first declared (or /sitemap.xml) sitemap, up to a few child sitemaps, and does not read .gz sitemaps.

Is it legal? (public data only)

Yes, in the sense that it only reads public or official data: public homepage HTML, robots.txt, sitemap.xml, DNS and TLS handshake. It does not log in, bypass paywalls or access private data. You remain responsible for how you use the results, including privacy, copyright and marketing laws. Not affiliated with or endorsed by the data sources.

Quick start and cost

Run it with the prefilled input to see sample output in seconds; the default run costs only a few cents at most. Then adjust the input and schedule it.

Use from code and AI agents

Call it from any language with the Apify API, or let an AI agent find and run it through the Apify MCP server.

from apify_client import ApifyClient
run = ApifyClient("<YOUR_APIFY_TOKEN>").actor("wintersworks/website-tech-stack-seo-audit").call(run_input={"urls": ["apify.com", "wordpress.org", "example.com"], "maxSitemapUrls": 1000})
items = ApifyClient("<YOUR_APIFY_TOKEN>").dataset(run["defaultDatasetId"]).list_items().items

Results land in the run's dataset (JSON, CSV, Excel). Set a maximum charge per run in the run options to cap spend.

About

Built and maintained by Winters Works. Questions or feature requests: open an issue on the Actor page or email wintersworks.shop@gmail.com.

More from Winters Works

• Bulk Email Verifier & MX Record Checker: clean an email list before you send. Syntax, MX lookup, disposable and role-address checks, no SMTP probing.
• Greenhouse, Lever & Ashby Jobs API: every open role from company careers boards on 5 ATS platforms, normalized into one dataset.
• iOS App Store Reviews Scraper: pull App Store reviews and ratings for any app, with date, rating and keyword filters.
• ClinicalTrials.gov Scraper & Monitor: search trials by condition, drug, sponsor or location, and track what's new or updated between runs.
• WHOIS & Domain Availability MCP Server: give your AI agent domain lookups, expiry dates and availability checks over RDAP.