Published: 25 August 2026 · Updated: v2 with 3 new checks View on GitHub mahope/compliance-site-check@v2
If you run a web agency or manage client sites in the EU, you've had the conversation: "Does the site have a privacy policy? Terms of service? Cookie consent?" The answer is usually "I think so" — and then someone opens the site and clicks through three pages to confirm.
That manual check is exactly the kind of thing that should run in CI. After every deploy, before the client sees it, automatically.
What it checks — 9 items in v2
The action now covers three categories: EU compliance pages, security headers, and SEO/social basics. Each check either fetches the page server-side, inspects response headers, or scans the homepage HTML — all with zero npm dependencies.
EU Compliance (6 checks)
- Privacy Policy — tries /privacy, /privacy-policy, /datenschutz and more
- Terms of Service — /terms, /tos, /conditions, /agb
- Cookie Consent Banner — scans HTML for consent platform markers (Cookiebot, OneTrust, Complianz, Osano, Termly and 15+ others)
- Imprint / Legal Notice — /imprint, /impressum, /legal (required in Germany, Austria)
- Accessibility Statement — /accessibility, /a11y, /wcag (required by EAA)
- Data Processing Agreement — /dpa, /data-processing-agreement (required by GDPR Art. 28)
Security Headers (new in v2)
- Content-Security-Policy — mitigates XSS and data injection attacks
- Strict-Transport-Security — enforces HTTPS connections
- X-Frame-Options — prevents clickjacking via iframe embedding
- X-Content-Type-Options: nosniff — prevents MIME type sniffing
- Referrer-Policy — controls how much referrer info is sent
Meta Tags & Language (new in v2)
- Meta Tags — checks title length, description, viewport, canonical, robots, OG title and OG description
- Hreflang / Language Declaration — checks HTML lang attribute and hreflang alternate links for multilingual sites
Each check reports pass, warning, or fail with specific details. The result is a Markdown report and structured JSON output you can use in downstream steps.
Come for compliance, stay for the broader check
The original six compliance checks covered the legal essentials. But when you're already fetching a site's homepage to audit it, security headers and meta tags cost nothing extra to check — and they're just as important for a professional launch.
Missing security headers are a common finding in security audits, and missing meta tags directly affect SEO and social sharing. Adding them to the same CI check means you catch all three categories in one action, one report, zero extra configuration.
Two-minute setup
Add this to your repository under .github/workflows/compliance-check.yml:
name: Weekly Compliance Check
on:
schedule:
- cron: '0 8 * * 1' # every Monday
workflow_dispatch: # also run manually
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: mahope/compliance-site-check@v2
with:
url: 'https://your-client-site.com'
fail-on-missing: 'privacy, imprint, accessibility, security-headers'
Zero dependencies, no API key. The action uses Node 20's built-in fetch() with no npm packages. It just works out of the box.
Post the report to an issue or pull request
The action outputs structured JSON (report-json) and a score (score from 0–100). You can pass it to any downstream step:
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: mahope/compliance-site-check@v2
id: compliance
with:
url: 'https://example.com'
# Post result to a new issue
- name: Post report to issue
uses: actions/github-script@v7
with:
script: |
github.rest.issues.create({
owner: context.repo.owner,
repo: context.repo.repo,
title: 'Compliance Check Report ${{ steps.compliance.outputs.score }}',
body: `${{ steps.compliance.outputs.report-json }}`
})
Or add it to a deploy workflow and only flag it if something changed:
# In your deploy workflow:
- name: Check compliance after deploy
uses: mahope/compliance-site-check@v2
continue-on-error: true
id: check
with:
url: 'https://your-site.com'
- name: Create issue if score dropped
if: ${{ steps.check.outputs.score < 100 }}
uses: actions/github-script@v7
with:
script: |
github.rest.issues.create({ ... })
Example output
## Compliance Check Report for example.com **Score:** 100/100 (Grade A) **Passed:** 9/9 - **Privacy Policy** — Found at https://example.com/privacy - **Terms of Service** — Found at https://example.com/terms - **Cookie Consent Banner** — Cookie consent banner detected on homepage. - **Imprint / Impressum / Legal Notice** — Found at https://example.com/imprint - **Accessibility Statement** — Found at https://example.com/accessibility - **Data Processing Agreement (DPA)** — Found at https://example.com/dpa - **Security Headers** — 5/5 header checks pass. - **Meta Tags** — 7/7 checks pass. - **Hreflang / Language Declaration** — 2/2 checks pass.
A failing site shows which checks are missing and what to add. For example, a site without security headers would show a warning with specific recommendations for each missing header.
Why this matters for web agencies
EU compliance enforcement is accelerating. Germany's GDPR fines passed 1.9 billion in 2025, and the EAA enforcement started in June 2025. Regulatory requirements aren't optional — but nor should they require a person to manually check the footer of every site you manage.
This action gives you an objective, automated baseline: does the site have the basic compliance pages? Are security headers set? Are meta tags in place? It doesn't replace manual review, but it catches the most common gaps before they reach a client, an auditor, or a regulator.
The action stays free. The evidence you file is not.
Everything above is MIT, open source and free forever: the action, all nine checks, the Markdown and JSON output, no account and no API key. What that buys you is a baseline, and the article above says so itself — it catches the most common gaps, and it does not replace manual review.
Here is the one gap it cannot close, in its own words. The action probes whether /privacy returns 200 and whether the homepage mentions one of 15+ consent platforms. A route that exists and a marker in the markup are not the same thing as consent that works: analytics can still load before the visitor agrees, and a policy can exist without anything on the site linking to it. Pro adds two things, and both are named in the product's own code — the GDPR/cookie and NIS2/security checks, and the finding as a file you can attach.
| What you get | Free | EUComply Pro — $79/year per website |
|---|---|---|
| This guide and the action | this page, in full, and the MIT action | included |
| Does the site have the legal pages | route probes for /privacy, /terms, /imprint, /accessibility and /dpa | the same five routes |
| Security headers and meta tags | 5 header checks and 7 meta checks, on every deploy | included |
| Does the consent actually gate analytics | — | GDPR/cookie and NIS2/security checks — 18 more, 33 in all |
| Accessibility, in the same pass | the accessibility checks — 15 WCAG rules in the free browser scanner | the same 15 rules |
| The result | score and grade | included |
| Every finding, spelled out | the whole report on the page | included |
| A file for a client's procurement file | — | pdf download of the whole report as a file |
The licence covers one website. If you only need to know whether your own site passes the nine checks, the action is the whole answer — you never need to pay for anything.
Get started
- Compliance Site Check on GitHub
mahope/compliance-site-check@v2— add it to your workflow today- Need to generate those compliance documents? Try the free GDPR generators (privacy notices, DPAs, RoPAs)
- Want the full manual checklist? E-book: EAA Compliance Checklist
Part of the mahoje.dk toolkit — practical guides and tools for small EU web agencies.