TOOL OPEN SOURCE

Automate Your EU compliance checks in CI

A free GitHub Action that checks websites for compliance basics, security headers, SEO meta tags, and language declarations — after every deploy, with zero setup cost.

Published: 25 August 2026 · Updated: v2 with 3 new checks View on GitHub mahope/compliance-site-check@v2

If you run a web agency or manage client sites in the EU, you've had the conversation: "Does the site have a privacy policy? Terms of service? Cookie consent?" The answer is usually "I think so" — and then someone opens the site and clicks through three pages to confirm.

That manual check is exactly the kind of thing that should run in CI. After every deploy, before the client sees it, automatically.

What it checks — 9 items in v2

The action now covers three categories: EU compliance pages, security headers, and SEO/social basics. Each check either fetches the page server-side, inspects response headers, or scans the homepage HTML — all with zero npm dependencies.

EU Compliance (6 checks)

Security Headers (new in v2)

Meta Tags & Language (new in v2)

Each check reports pass, warning, or fail with specific details. The result is a Markdown report and structured JSON output you can use in downstream steps.

Come for compliance, stay for the broader check

The original six compliance checks covered the legal essentials. But when you're already fetching a site's homepage to audit it, security headers and meta tags cost nothing extra to check — and they're just as important for a professional launch.

Missing security headers are a common finding in security audits, and missing meta tags directly affect SEO and social sharing. Adding them to the same CI check means you catch all three categories in one action, one report, zero extra configuration.

Two-minute setup

Add this to your repository under .github/workflows/compliance-check.yml:

name: Weekly Compliance Check
on:
  schedule:
    - cron: '0 8 * * 1'  # every Monday
  workflow_dispatch:  # also run manually

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: mahope/compliance-site-check@v2
        with:
          url: 'https://your-client-site.com'
          fail-on-missing: 'privacy, imprint, accessibility, security-headers'

Zero dependencies, no API key. The action uses Node 20's built-in fetch() with no npm packages. It just works out of the box.

Post the report to an issue or pull request

The action outputs structured JSON (report-json) and a score (score from 0–100). You can pass it to any downstream step:

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: mahope/compliance-site-check@v2
        id: compliance
        with:
          url: 'https://example.com'

      # Post result to a new issue
      - name: Post report to issue
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: 'Compliance Check Report ${{ steps.compliance.outputs.score }}',
              body: `${{ steps.compliance.outputs.report-json }}`
            })

Or add it to a deploy workflow and only flag it if something changed:

# In your deploy workflow:
      - name: Check compliance after deploy
        uses: mahope/compliance-site-check@v2
        continue-on-error: true
        id: check
        with:
          url: 'https://your-site.com'

      - name: Create issue if score dropped
        if: ${{ steps.check.outputs.score < 100 }}
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.create({ ... })

Example output

## Compliance Check Report for example.com

**Score:** 100/100 (Grade A)
**Passed:** 9/9

-  **Privacy Policy** — Found at https://example.com/privacy
-  **Terms of Service** — Found at https://example.com/terms
-  **Cookie Consent Banner** — Cookie consent banner detected on homepage.
-  **Imprint / Impressum / Legal Notice** — Found at https://example.com/imprint
-  **Accessibility Statement** — Found at https://example.com/accessibility
-  **Data Processing Agreement (DPA)** — Found at https://example.com/dpa
-  **Security Headers** — 5/5 header checks pass.
-  **Meta Tags** — 7/7 checks pass.
-  **Hreflang / Language Declaration** — 2/2 checks pass.

A failing site shows which checks are missing and what to add. For example, a site without security headers would show a warning with specific recommendations for each missing header.

Why this matters for web agencies

EU compliance enforcement is accelerating. Germany's GDPR fines passed 1.9 billion in 2025, and the EAA enforcement started in June 2025. Regulatory requirements aren't optional — but nor should they require a person to manually check the footer of every site you manage.

This action gives you an objective, automated baseline: does the site have the basic compliance pages? Are security headers set? Are meta tags in place? It doesn't replace manual review, but it catches the most common gaps before they reach a client, an auditor, or a regulator.

Get started

Part of the Hermes Compliance toolkit — practical guides and tools for small EU web agencies.