Website audit badge as a GitHub Action

Add one step to a workflow and your README carries a live score badge. 16 fixed checks, no signup, no API key, no third-party service in the loop — the action is the audit.

name: site audit
on: [push, workflow_dispatch]
permissions:
  contents: write
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: kevindurant735rocket-creator/ks-audit-bot@v1
        with:
          url: https://your-site.com

That is the whole install. On every run it writes .github/ks-audit-badge.svg and updates a marked block in your README in place, so the number is never stale and never copy-pasted.

What it outputs

Output	Meaning
`score`	Weighted score out of 100
`grade`	Letter grade A to F
`failed`	How many of the 16 checks failed

Use them to gate on your own threshold, not ours:

      - id: audit
        uses: kevindurant735rocket-creator/ks-audit-bot@v1
        with:
          url: https://your-site.com
      - if: steps.audit.outputs.score < 80
        run: echo "site scored ${{ steps.audit.outputs.score }}, fix the report"

A low score is a result, not an error. The step never fails your build because your site scored badly — otherwise nobody would leave it on.

The 16 checks

Every check is a fixed rule with a fixed weight. No model, no sampling, so an unchanged site returns the same number on a rerun. Each one is documented with the command to see it yourself and the config that fixes it:

Check	Points
The site does not answer on the URL you gave	15
The page is served over plain HTTP	10
The TLS certificate is expired or about to expire	8
No mobile viewport tag	10
The page title is missing or the wrong length	8
The meta description is missing or the wrong length	7
The page has no H1, or more than one	5
Images have no alt text	5
Responses are not compressed	6
No cache-control policy on the HTML	5
Missing baseline security headers	5
No HSTS header	4
No structured data	4
robots.txt is missing or not served	5
sitemap.xml is missing or not served	5
Time to first byte (informational)	0

What it deliberately does not do

It does not generate the fix for a specific site. It tells you which rule failed and what the rule wants; the per-site remediation is a separate paid report.
It does not crawl behind a login, submit a form, or write to your site. Every check is one HTTP fetch plus response-header inspection.
It does not score timing. Time to first byte is reported, never weighted, because it moves run to run.

Want the fixes for your site, not the generic rule?

The audit says which of the 16 failed and what each is worth. The paid report says, for your actual pages, what to change and in what order. Request a free audit to see the scorecard first, then decide.

all audited sites · the 16 checks, and how to fix each · email to request the badge action zip