Coder Legion - Recent posts tagged console

How to Change the WAF Web Console Listening Port When SafeLine Stays on 9443

Sat, 31 Oct 2026 02:47:24 +0000

Changing the WAF web console listening port looks like a one-line edit, but the SafeLine deploy guide only treats one environment key as that port. This troubleshooting note covers one concrete misconfiguration: the operator stored a new port in MGT_PROXY, left MGT_PORT at 9443, and opened a browser URL built from the MGT_PROXY number. The management page did not load. The fix is confirmed when the browser shows the web console on the port named by MGT_PORT, and the administrator reset command still prints a usable login.

SafeLine is a self-hosted web application firewall. Deployed in front of an application, it works as a reverse proxy: clients reach the WAF first, and the WAF filters and monitors HTTP traffic before a request is forwarded. That protection path is not the management console. The console is the admin page documented in the deploy guide at https://docs.waf.chaitin.com/en/GetStarted/Deploy. That guide names the console port with MGT_PORT, described as the web console port to be used. The sample .env sets MGT_PORT=9443, and the Use Web UI section says to open https://<safeline-ip>:9443/. Those two statements are the pair you have to keep aligned.

The misconfiguration

Manual setup creates /data/safeline, downloads compose.yaml, and writes .env in that directory. The sample sets MGT_PORT=9443 and MGT_PROXY=0, plus directory, image, database password, subnet, and token values. MGT_PORT is the web console port to be used. MGT_PROXY is the number of console proxy layers. The same guide says MGT_PROXY should only be used when configuring the proxy for the console, and that the default 0 means no proxy is configured. See https://docs.waf.chaitin.com/en/GetStarted/Deploy.

The failed change ignored that split. The operator wanted the console off the sample port, replaced 0 in MGT_PROXY with the desired port, saved the file, and browsed to https://<safeline-ip>: plus that MGT_PROXY value. MGT_PORT was still 9443. The deploy guide never says MGT_PROXY selects the listening port. A non-zero value is a proxy-layer count for a real console proxy setup. Writing a port there does not move the URL under Use Web UI.

A related mistake shows up after login. The application guide at https://docs.waf.chaitin.com/en/GetStarted/AddApplication tells you to open Applications, choose Add Application, and enter Domain, Port, and Upstream. Port there is the port SafeLine will listen on for the original app, such as 80 or 443, with SSL checked for HTTPS apps. That field is not MGT_PORT. Changing it does not rewrite the console address https://<safeline-ip>:9443/.

What to compare before you call it a port change

Use the deploy guide as the checklist and touch only the key it defines as the console port.

Open .env in the SafeLine directory, shown as /data/safeline in the manual steps. Read MGT_PORT first. That is the web console port to be used, and the published example is 9443. Read MGT_PROXY next. Leave it at 0 unless you are actually configuring proxy layers for the console. Do not store a listen port in MGT_PROXY. Do not use the Applications Port field as the console setting. That field belongs to the protected site.

The guide applies the environment file when you launch with docker compose up -d from the SafeLine directory. The worked example then opens the console at https://<safeline-ip>:9443/, which matches MGT_PORT=9443. If MGT_PORT is still 9443, that is the documented console address, even if another number was typed into MGT_PROXY or into an application form. The sources do not publish a separate post-install migration log, a firewall recipe, or a certificate recipe for an alternate console port. They also do not show a command whose only job is to rebind the console after a later edit. If the page fails on some other number, treat that as a URL mismatch against MGT_PORT, not as proof that the console moved.

If you are still in the environment-writing step, declare the console port only with MGT_PORT, then launch with the documented docker compose up -d command, and open the console with that same port value. The official success case in the guide is port 9443. Keep the browser pattern identical to Use Web UI, and do not assume an undocumented log line will announce the bind.

The screen that confirms the fix

Restore MGT_PROXY to 0 if you are not configuring a console proxy. Point the browser at the port stored in MGT_PORT. In the documented installation that value is 9443, so the confirming page is https://<safeline-ip>:9443/. The deploy guide says opening this page is how you use the web UI after installation. Seeing that console page is the first confirmation. A connection error or a timeout on any other port is the mismatch, not a successful port move.

The second confirmation is the account step, not a guessed log path. Run docker exec safeline-mgt resetadmin. When it succeeds, the guide says you must remember the content, then shows the initial username admin, the initial password, and Done. Log in with that username and password on the console page that just loaded. A completed login on the MGT_PORT URL is the screen that proves you are on the web console the install guide configured.

Do not use a block page as that proof. The application guide says a blocking page means SafeLine defended a test attack against a protected site, and that attack detail is viewed from the web console attack list. A block page means you reached a protected application flow. It does not confirm that MGT_PORT changed, and it does not confirm that MGT_PROXY was a valid place to store a port.

If resetadmin succeeds but the browser still targets the wrong port, the account step is not the failure. Read MGT_PORT again. The password block only helps after the console page itself is the one from Use Web UI.

Automatic install does not add a different confirmation. After the documented install command finishes, the deploy guide sends you to Use Web UI, which is the same https://<safeline-ip>:9443/ page. The success text does not print an alternate console port.

What this check does not claim

The home overview at https://docs.waf.chaitin.com/en/home describes SafeLine as a self-hosted WAF and reverse proxy with defenses for web attacks, bot abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. None of those behaviors is a console port switch. Rate limiting, CAPTCHA challenge, authentication challenge, and dynamic protection are traffic controls for protected apps, not substitutes for MGT_PORT.

This note does not claim that every numeric port is suitable, and it does not add steps the deploy guide does not contain. If the console page does not load on the port written in MGT_PORT, stop and re-check the variable names rather than stacking rewrites that the sources do not describe. After the console loads, protecting an application is still a separate task: add Domain, Port, and Upstream, then resolve the domain to the SafeLine server, as https://docs.waf.chaitin.com/en/GetStarted/AddApplication describes.

Why does the console still open on 9443 after I edited the environment file?

Because the sample and the Use Web UI section both use 9443, and that number comes from MGT_PORT, not from whichever numeric field you edited. If MGT_PORT is still 9443, the documented console URL is still https://<safeline-ip>:9443/. A change to MGT_PROXY or to an application Port does not replace that page. The variable definitions are in https://docs.waf.chaitin.com/en/GetStarted/Deploy.

Is the application port the same as the web console port?

No. In Add Application, Port is the port SafeLine listens on for the original app, with 80 or 443 given as examples. The web console port is MGT_PORT in .env. Mixing those fields is the misconfiguration above. The application fields are documented at https://docs.waf.chaitin.com/en/GetStarted/AddApplication.

What does MGT_PROXY change if it is not the listen port?

The deploy guide defines MGT_PROXY as the number of console proxy layers. It should only be used when configuring the proxy for the console. The default is 0, which means no proxy is configured. It is not documented as the web console listening port.

Which screen confirms the console port is the one I intended?

Load https://<safeline-ip>: followed by the MGT_PORT value. For the documented example, that is https://<safeline-ip>:9443/, and the web console page should appear. Then run docker exec safeline-mgt resetadmin and confirm the initial username admin and the Done line before you log in. That loaded console, not a timeout on another port, is the confirmation described in https://docs.waf.chaitin.com/en/GetStarted/Deploy.

Do I need a new administrator password after correcting the port?

Only if you run the documented reset. docker exec safeline-mgt resetadmin prints the initial password and Done. Correcting MGT_PROXY back to 0, or opening the URL that already matches MGT_PORT, does not by itself rotate that password. Use the credentials the command prints if you choose to reset, and use them on the console page that matches MGT_PORT.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

Why I Change the WAF Web Console Listening Port Before Turning Protection On

Sat, 31 Oct 2026 02:46:53 +0000

Before I turn protection on for a live site, I walk a decision checklist. The step I no longer skip is the management listener. Learning how to change the WAF web console listening port belongs in that checklist, because the console is where I will later read blocks, challenges, and attack detail. If I cannot open it on a port I chose, I am not ready to point a domain at the proxy.

SafeLine is a self-hosted web application firewall. Placed in front of an application, it works as a reverse proxy: clients reach SafeLine first, it filters and monitors HTTP and HTTPS traffic, and it forwards traffic it treats as safe to the original application. The product introduction lists defenses for web attacks, proactive bot abuse defense, HTML and JS code encryption, IP-based rate limiting, and a web access control list. Those controls are useless to me if the console listener was an accident.

Set the console port before the first launch

The manual deploy page is the place that defines this choice. In the environment file, MGT_PORT is the web console port to be used. The sample sets MGT_PORT=9443, and the same page tells you to open https://<safeline-ip>:9443/ after startup. I treat 9443 as the documented sample, not as a port every host must keep. When that port is already taken, or when my access policy expects the console elsewhere, I change MGT_PORT in .env before I run docker compose up -d. These pages do not describe a console-port switch inside the application dialog, so I do not wait until after DNS and hope one appears.

The automatic installer is a narrower path. The deploy guide gives one command and then sends you to the web UI, which it shows on port 9443. It does not document a port flag on that command. If I need a non-default console port, I use the manual environment file, where MGT_PORT is explicit, and I decide it before protection is turned on. See the deploy guide: https://docs.waf.chaitin.com/en/GetStarted/Deploy

MGT_PROXY is a different knob. The guide defines it as the number of console proxy layers, to be used only when configuring a proxy for the console. The default is 0, which means no proxy is configured. Choosing another MGT_PORT does not, by itself, mean I should change MGT_PROXY.

Keep that port off the public site path

Turning protection on is an application change, not a console login. In Applications, Add Application asks for three facts. Domain is the original app domain, hostname, or IP. Port is the port SafeLine will listen on for that app, such as 80 or 443, with the SSL option checked for HTTPS apps. Upstream is the real address used to forward cleaned traffic. After that, the domain is resolved to the IP of the server where SafeLine runs. Visitors then reach the site through SafeLine. The application steps are documented at https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Those fields are easy to mix up with MGT_PORT. They are not the same decision. If I set the application listen port to the console port, administration and the public site fight over one listener. My order is console port first, application listen port second, and DNS last.

I also refuse to add an application until the host matches the documented minimums: Linux, x86_64 or arm64, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, 1 CPU core, 1 GB of memory, 5 GB of disk, and a CPU with ssse3. The deploy page lists checks such as uname -m, docker version, docker compose version, free -h, df -h, and lscpu | grep ssse3. I run the ones that apply to this machine instead of assuming a laptop test equals the server.

ARM is a hard stop in that same page. SafeLine installed on ARM requires a Pro license to work properly, and the Personal Edition is not supported on ARM. If I am on ARM and that license does not apply, I stop before DNS. The LTS choice is equally explicit: RELEASE=-lts selects the LTS line, which the guide says will no longer be maintained starting from 9.1.0-LTS on 14 August 2025. It recommends moving to the latest version, and waiting about a month after a new release if I want caution. I write that choice down before traffic depends on it.

Secrets come before exposure. The manual steps generate DETECTOR_MGMT_TOKEN and MGT_INTERNAL_TOKEN as 64-character hex values, generate a 16-character alphanumeric DETECTOR_AES_KEY, write them into .env, and set chmod 600 on that file. I do not launch with the sample placeholders still in place. After docker compose up -d, which can take several minutes, I open the console on the port I set. I run docker exec safeline-mgt resetadmin and I keep the initial username and password it prints. The guide shows that initial username as admin. If that page does not load, the listening-port decision is still open, and protection is not ready.

Name the protection you are actually turning on

The introduction lists coverage for SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, bruteforce, HTTP flood, and bot abuse: https://docs.waf.chaitin.com/en/home

The same pages name rate limiting, CAPTCHA challenge, authentication challenge, and dynamic protection. Rate limiting throttles traffic over defined limits, including DoS attempts, bruteforce attempts, and traffic surges. CAPTCHA is documented as a challenge that lets human users through while blocking crawlers and bots. Authentication challenge, when turned on, requires a password or the visitor is blocked. Dynamic protection, when turned on, dynamically encrypts HTML and JS on each visit. I pick the controls this application needs. I do not flip every switch because the container started.

Before I call the site protected, I use the documented probes: a SQL injection query, an XSS payload, a path traversal sequence, a code injection string, and an XXE doctype, with my own domain in place of the example. A blocking page means that request was defended. I then open the attack list in the console and click detail. An empty list sends me back to domain, listen port, upstream, and DNS. It does not send me to a victory message.

The checklist I keep is short. Confirm the host, and stop on ARM if the documented license requirement is not met. Set MGT_PORT to the console port I will use, and leave MGT_PROXY at 0 unless the console itself is proxied. Generate the documented secrets and restrict .env. Launch, log in with the resetadmin output, and only then add Domain, Port, and Upstream. Resolve DNS last. Judge the result from the blocking page and the attack detail view.

How do I change the WAF web console listening port?

Set MGT_PORT in the SafeLine .env file used by the manual compose deploy. The deploy guide defines that variable as the web console port to be used and shows 9443 in the sample, with the console at https://<safeline-ip>:9443/. Put the port you want in MGT_PORT, then start with docker compose up -d. That is a console environment setting. It is not a field in Add Application, and these pages do not describe a later port control in the UI.

Is the web console port the same as the application listen port?

No. MGT_PORT is only the web console port. In Add Application, Port is what SafeLine listens on for the protected app, such as 80 or 443, and HTTPS apps need the SSL option. Upstream is the real address that receives forwarded traffic. Changing the console port does not change the public site listener.

What should I verify before I turn protection on?

Match the documented host minimums, including Docker 20.10.14 or newer, Docker Compose 2.0.0 or newer, memory, disk, and ssse3. On ARM, confirm the Pro license requirement, because the Personal Edition is not supported there. Generate the documented secrets, open the console on your MGT_PORT, and log in with the account printed by docker exec safeline-mgt resetadmin. Add the application and point DNS at the SafeLine server only after that login works.

Does a different console port require MGT_PROXY?

No. MGT_PROXY is the number of console proxy layers. Use it only when you are configuring a proxy for the console. The default of 0 means no proxy is configured. A custom MGT_PORT does not imply a console proxy.

How do I know the protection decision worked?

Send the documented SQL injection, XSS, path traversal, code injection, and XXE test requests to your own domain. Expect the blocking page, then open the console attack list and click detail. If you cannot open the console, fix the listening port and the admin login before you judge the site protected.

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

SafeLine website: https://ly.cyberserval.tech/MqhYdmI
Demo: https://demo.waf.chaitin.com:9443/statistics
Official docs: https://docs.waf.chaitin.com/en/home
GitHub: https://github.com/chaitin/SafeLine
Pro offer: https://cyberserval.tech/landing/lto

What Access an SEO Audit Actually Needs | FloxoLab

Fri, 30 Oct 2026 15:50:00 +0000

Direct answer: A diagnosis-only SEO audit normally needs the public website URL and Restricted access to Google Search Console. GA4 Viewer access is optional. CMS, hosting, registrar, passwords, billing, and Search Console ownership are implementation or control privileges, not audit requirements.

Access is where trust quietly breaks down between a business and whoever does its SEO. The request usually arrives bundled and casual: send over your website login, your hosting, your Google accounts, and we will take it from here. Most owners hand it over because they do not know which parts are actually needed and which are just convenient for the agency.

What an audit actually needs

An audit is a diagnosis, not surgery. To find the problems holding a site back, the only things genuinely required are your URL and the ability to read your own search data. That is it.

Access or input	Audit need	Safe scope
Public website URL	Required	No login. Include priority pages and any staging boundary.
Search Console	Usually required	Restricted user. This can view most reports but cannot administer the property or submit a sitemap.
GA4	Optional	Viewer. Add No Cost Metrics or No Revenue Metrics restrictions when those values are outside the audit scope.
Business context	Helpful	Priority services, target geography, intended queries, and known competitors.
CMS, hosting, or registrar	Not needed for diagnosis	Grant separately only for an approved implementation task with an owner and end date.

Notice what is not on that list: no website admin login, no hosting panel, no domain registrar, no passwords. A diagnosis is built from reading data, not from holding the keys to the building.

This holds even for the deeper technical part of an audit. Crawling the whole site to surface broken internal links, redirect chains, duplicate or missing titles, and a bloated sitemap is done with a crawler that visits your pages exactly like any other visitor, over the public web. It reads what is already published, so it needs no login at all.

The next step is to combine that public crawl with read-only Google evidence. The Screaming Frog and Search Console audit workflow shows how to reconcile the URL sets without granting implementation access.

How to grant read-only access safely

Both Google tools have a low-privilege viewing role. Add a specific email, choose the lowest role that still exposes the required reports, and remove it when the work is done. These roles do not provide control over your website, domain, or Google account.

Search Console: the Restricted role

In Search Console, open Settings > Users and permissions, click Add user, enter the email you were given, and choose Restricted. Search Console offers Owner, Full, and Restricted. Owner has full control, including adding and removing other users. Restricted has simple view rights on most data, which is all an auditor needs.

Search Console, Settings > Users and permissions. The Restricted role gives read-only view rights, which is all an audit needs. Interface shown as of June 2026.

Restricted users cannot change settings, cannot submit or remove sitemaps, cannot request removals, and cannot touch other users. They can look, and that is the point. When the audit is finished, open the same screen and remove the user.

GA4: the Viewer role

If you want to share Analytics, go to Admin > Property Access Management, add the email, and choose Viewer. GA4 has Administrator, Editor, Marketer, Analyst, and Viewer. Viewer is the read-only floor: it can see report data and settings and build explorations, but it cannot change configuration or manage users.

GA4, Admin > Property Access Management. The Viewer role is read-only: see reports and settings, change nothing. Interface shown as of June 2026.

Prefer not to share access at all? A good audit can still run on exports and screenshots: your Search Console performance, coverage, and a few key reports. It is slightly less thorough than live access, but it keeps you fully in control of what is shared.

What you should never hand over for an audit

If someone needs any of the following just to tell you what is wrong with your site, the request does not match the job. None of these are required to read your data and write a fix list.

Your website admin or CMS password. A login to WordPress, Shopify, or your CMS lets someone change the site, not just read it. An audit changes nothing.
Hosting or cPanel access. Server-level access controls files, databases, and email. There is no audit reason to hold it.
Domain registrar login. Whoever controls the registrar can move or lose the domain itself. Never share it for analysis.
Search Console Owner. Owner can add and remove users and change verification. Restricted is the correct level for an outside reviewer.
Anything financial. Ad accounts with payment methods, billing portals, or card details have nothing to do with an SEO diagnosis.

The pattern is simple. Reading your data needs a read-only role on the data. Anything that can change, move, charge, or delete is not part of finding out what is wrong.

The "no access, no service" red flag

Some providers will not start until they have full back-end access to your site. It is often written into the terms: without admin access, the service cannot be delivered. For an ongoing engagement that implements changes every month, that is at least understandable. For an audit, it is the wrong shape entirely.

Demanding full control before anyone has even told you what is broken inverts the order. You are handing over the keys to buy a diagnosis. A diagnosis comes first, from reading the data, and only then does the question of who changes what, with how much access, even arise. If the only access on offer is all of it, that tells you the product is a retainer, not an audit. (For more on how those retainers are structured, see what a typical SEO retainer actually does.)

Access is also a provider-selection test. The guide to choosing an SEO agency in the Philippines shows how to compare permission requests alongside evidence, deliverables, ownership, reporting, and contract terms.

When backend access is legitimate

There is a real case for deeper access, and it is worth stating clearly so this does not read as if access is always suspect. Once you have the audit and decide to have the fixes implemented, editing the site obviously requires the ability to edit the site.

The difference is that implementation is a separate step, under a separate agreement, with a separate and scoped level of access, granted only for the work being done and removed afterward. That is the opposite of handing over admin up front as a condition of starting. Implementation may require write access; the audit never does. Keeping those two things apart is what keeps you in control.

Access closeout checklist

Use a named individual account instead of sharing a password.
Keep the business-controlled account as the property owner.
Record the role, purpose, approver, and intended removal date.
Grant implementation access under a separate scope, only after the proposed change is approved.
Remove the auditor after delivery and confirm that no temporary verification token or implementation account remains.

The bottom line

An audit reads, it does not write. The honest version needs your URL, a Restricted user in Search Console, and optionally a Viewer in GA4. Everything beyond that is either convenience for the provider or a sign you are being sold something larger than a diagnosis. Grant the viewing roles, keep the keys, and remove access when the work is done.

The fixed-price SEO audit works exactly this way: Restricted Search Console access (or your exports), a technical and on-page review of your site and search data, and a prioritized fix list you own. One report at a flat $150, no retainer, no admin login, no ranking promises. If you choose an ongoing retainer, any access needed to implement an approved fix is scoped separately. Get in touch to start.

Sources checked

Search Console permissions and GA4 roles were rechecked against Google's official documentation on August 2, 2026.

Originally published on FloxoLab.

SEO Automation with n8n: What to Automate Safely

Fri, 02 Oct 2026 15:50:00 +0000

SEO automation is safest when it collects evidence, applies repeatable rules, and asks a person to approve any change that could affect indexing, rankings, or published copy. n8n is useful for that middle layer. It can pull Search Console data, compare periods, filter noisy rows, log findings, and route a short review queue without being allowed to rewrite the site.

Partner disclosure. This guide includes a partner link to n8n Cloud. If you sign up through it, I may earn a commission at no extra cost to you.

That boundary matters. A workflow that says “these five pages lost impressions after a release” saves time. A workflow that changes five canonical tags because a metric moved can damage the site before anyone checks the reason.

Start with the native option

For an occasional check, use Search Console directly. Its Performance report already lets you filter by query, page, country, device, search appearance, and date. You can compare periods and export a table without building or maintaining a workflow.

n8n becomes useful when the work is recurring or needs more than one system:

run the same report every week;
compare a current window with a previous equivalent window;
ignore changes below a minimum impression threshold;
join SEO data with a release log or content inventory;
deduplicate alerts that have already been reviewed;
send different issues to different owners;
preserve an audit trail of what was detected and decided.

The automation should reduce repetitive preparation. It should not conceal how the decision was made.

Use a three-level safety model

Classify each SEO task before adding it to a workflow.

Level	Automation role	Examples	Default control
Observe	Read data and record facts	Search Console exports, sitemap checks, status monitoring	Can run unattended
Recommend	Apply rules and prepare a review queue	Flag falling pages, find sitemap mismatches, draft a title option	A person reviews the evidence
Change	Modify a public or indexable resource	Edit copy, redirects, canonicals, robots rules, internal links	Explicit approval plus rollback

Most small sites should keep their first SEO workflow in the first two levels. The potential gain from automatically changing a title is small compared with the cost of changing the wrong page or losing the original context.

What is generally safe to automate

Scheduled Search Console exports

Google provides a Search Analytics API for querying performance data. A request can group results by dimensions such as page, query, country, and device, and can apply filters before returning rows.

The API is not a complete event log. Google states that the service does not guarantee every row and returns top rows rather than all rows. Search Console also omits anonymized queries for privacy. Treat the export as strong first-party evidence with known limits, not an exhaustive ledger of every search.

Period comparisons with noise controls

A useful workflow can calculate:

click change = current clicks - previous clicks
impression change = current impressions - previous impressions
CTR change = current CTR - previous CTR

Do not alert on percentage change alone. A fall from two impressions to one is a 50 percent decline but is rarely a useful incident. Require a minimum volume and a meaningful absolute change.

review when:
current impressions >= 100
and absolute impression change >= 50
and percentage change <= -30%

Those values are starting rules, not universal SEO standards. Tune them to the size and volatility of the site.

Technical monitoring

n8n can schedule simple checks for:

important URLs returning a non-200 status;
sitemap URLs that redirect or fail;
canonical targets that no longer resolve;
a robots.txt or sitemap fetch that suddenly changes;
a critical page becoming unavailable;
a release list that does not match the expected public URLs.

Keep the monitor narrow: crawling every URL from a small n8n instance can overload the site, duplicate a proper crawler, or create false alarms from temporary rate limits.

Evidence packaging

The highest-value step is often the least dramatic one: build a review packet. Instead of sending “traffic down,” send:

affected URL;
metric and comparison windows;
absolute and percentage change;
minimum sample threshold;
recent release or content-change date;
current status code and canonical;
a link to Search Console for manual investigation;
the previous decision if the same issue was reviewed before.

That makes the alert actionable and keeps the workflow from pretending it knows the cause.

What should not run without review

Do not let a first SEO automation publish or change these items by itself:

titles, descriptions, headings, or body copy;
canonical tags;
redirects;
noindex, robots.txt, or crawl directives;
sitemap membership;
internal links at scale;
deletion or consolidation of pages;
repeated indexing requests;
AI-generated articles or local pages.

The same metric can have several causes. Falling clicks may reflect lower demand, a ranking change, a different result layout, a tracking issue, a migration, or a page that is intentionally targeting a narrower audience. A workflow can identify the symptom. It cannot infer the business decision from one number.

A safe weekly n8n workflow

The first version can use this sequence:

Schedule Trigger
  -> HTTP Request: Search Analytics API
  -> normalize rows
  -> compare with previous period
  -> apply volume and change thresholds
  -> check the alert ledger
  -> write a review record
  -> notify the owner

Step 1: choose equivalent periods

Compare like with like. A seven-day period can be compared with the previous seven days, but weekday patterns and holidays can still distort a small sample. For a low-volume site, 28-day windows are usually more stable. Record the exact dates because “last month” becomes ambiguous when somebody opens the alert later.

Step 2: query only the data you need

The Search Analytics API accepts a rowLimit from 1 to 25,000 and uses startRow for pagination. Google also warns that queries grouped or filtered by page and query can be more expensive against API load limits.

Start with the smallest useful query:

one search type;
one property;
only the required dimensions;
a bounded date range;
a row limit appropriate to the site.

Do not repeatedly query long historical ranges on every execution. Store completed period summaries and fetch only the window that needs updating.

Step 3: label preliminary data

Recent Search Console data can be incomplete. The API can return metadata showing that a result contains incomplete or still-processing data. A weekly report should either avoid the newest days or label them so a reviewer does not compare a final period with a preliminary one.

Step 4: normalize before comparing

Keep the comparison key explicit. If the workflow groups by page, normalize the public URL rules first but do not silently merge distinct pages. If it groups by query and page, remember that the available rows are still limited to the top data returned by Search Console.

Store raw input separately from calculated fields. That makes the result inspectable when a threshold behaves unexpectedly.

Step 5: prevent duplicate alerts

Create a stable key such as:

property + report_type + page + current_period_end

Before sending a notification, check whether that key is already in the alert ledger. Update an existing record when the evidence changes instead of creating a new task every time the workflow runs.

Step 6: notify, then wait for a decision

Send the review packet to email, Slack, Google Chat, Telegram, or the team’s normal task system. The notification should offer controlled outcomes such as investigate, accept as expected, create a content task, create a technical task, or snooze until more data exists.

For a workflow that must continue after a person responds, n8n can use a Wait step or an app operation that waits for approval. Record the reviewer, timestamp, and decision before any downstream action.

Example review logic

Finding	Workflow can do	Person must decide
Important URL returns 404	Capture response, timestamp, expected URL, and recent release	Restore, redirect, or intentionally retire
Sitemap URL redirects	List source and destination and check destination status	Update sitemap, redirect map, or page plan
Impressions fall 40 percent	Verify sample, compare periods, attach page and query rows	Whether demand, rankings, intent, or a site change caused it
Two pages appear for one query	Package page-level Search Console data	Whether intents differ or pages should be clarified or merged
CTR falls while impressions rise	Flag query and page combinations	Whether the snippet, ranking mix, or result layout explains it

When the finding concerns two competing URLs, use the full Search Console cannibalization diagnosis before changing either page. When a page is excluded, use the Crawled, currently not indexed decision guide rather than treating every exclusion as an error.

Add failure handling before trusting the report

The workflow itself needs monitoring. OAuth tokens expire, APIs return rate limits, schemas change, and a partial execution can send a misleading “all clear.”

Fail the report if the source request fails.
Record the number of source rows and filtered rows.
Distinguish “zero findings” from “no data received.”
Retry only temporary failures with a bounded policy.
Send exhausted failures to an Error Workflow.
Store the last successful run time.
Test with a known sample before scheduling production runs.

Use the failed n8n workflow debugging guide when a node fails, and add an n8n Error Workflow so a broken SEO report cannot fail silently.

Cloud or self-hosted n8n?

n8n Cloud is the simpler starting point for a small team because hosting, updates, and the workflow service are managed. Self-hosting can offer more infrastructure control, but it also makes backups, upgrades, security, uptime, and incident recovery your responsibility.

Choose based on operational responsibility, not on the SEO logic. The workflow should use least-privilege credentials either way. A read-only Search Console scope is preferable when the workflow only reads performance data. The n8n Cloud versus self-hosted cost guide compares the wider ownership trade-off.

A practical launch checklist

Begin with one property and one report.
Use read-only credentials.
Keep recent incomplete data out of final comparisons or label it.
Set minimum volume and absolute-change thresholds.
Store raw evidence and calculation inputs.
Deduplicate alerts.
Require a human decision for public site changes.
Add a rollback plan before automating any approved write.
Monitor the automation itself.
Review the rules after several real runs.

SEO automation is useful when it gives a person a shorter, better evidence queue. It becomes risky when the workflow converts an uncertain signal directly into a site change.

Sources checked

n8n partner link

Want managed n8n for the reporting workflow?

n8n Cloud is the simplest starting point if you want to build the reporting and approval logic without maintaining the workflow server. Affiliate disclosure: I may earn a commission if you sign up through this link, at no extra cost to you.

Try n8n Cloud

Need the SEO workflow mapped?

Send the property type, report frequency, decision threshold, and notification channel. I can map a read-only first version and define where human approval must remain.

Discuss the workflow

Originally published on FloxoLab.

Technical SEO Audit with Screaming Frog and Search Console

Wed, 23 Sep 2026 15:50:00 +0000

Direct answer: export or connect Search Console first, run a scoped Screaming Frog crawl, normalize both datasets to final canonical URLs, and compare the sets. Prioritize pages that already earn impressions or clicks, important pages Google knows but the crawl missed, and crawlable indexable pages with conflicting status, canonical, directive, or sitemap signals. Re-crawl after implementation, then use Search Console to confirm Google's stored view catches up.

The tools answer different questions. Screaming Frog reports what its configured crawler can reach and extract from the live site. Search Console reports Google's processed search and indexing evidence, with reporting limits and delays. Agreement raises confidence. A disagreement is a diagnosis lead, not an automatic error.

This guide starts after you have chosen the crawler and obtained safe viewing access. If you are comparing the free and paid versions, limitations, or whether the software suits you, read the separate Screaming Frog review. If someone else will access the property, define the minimum role using the SEO audit access guide.

Know what each dataset can prove

Evidence	Useful for	Does not prove
Screaming Frog crawl	Live response, internal discovery, directives, canonicals, links, metadata, and crawl depth under the chosen configuration	That Google discovered, rendered, selected, indexed, or ranked the same URL
Performance report	Pages and queries receiving reported Google Search impressions and clicks during the selected period	A complete URL inventory, current live status, or index status for every page
Page indexing report	Google-known URL totals, indexed and non-indexed groups, and representative examples by reason	That every non-indexed URL is an error or that every example can be exported
URL Inspection	Google's stored index view for one URL and a separate live fetch test	A guarantee that the page will appear or rank in search results

Google's Performance report documentation calls this canonical URL aggregation: most performance data is assigned to the page's canonical URL, not to a duplicate URL. That means a row may not use the exact URL variant that received the original request. Preserve the raw URL, but add a normalized join key rather than assuming a missing exact-string match means missing search evidence.

1. Define the scope and protect the baseline

Record the audit boundary before changing any crawler setting. Include the public host, allowed subdomains, staging exclusions, important folders, locale rules, parameter policy, expected canonical host, and the date range for Search Console. Save the raw exports and crawl file. You need the unchanged evidence when a filter or fix later changes the counts.

Property: https://example.com/
Audit date: 2026-08-04
Search Console period: last 90 days
Included hosts: example.com
Excluded areas: /account/, /checkout/, staging.example.com
Rendering: HTML / JavaScript
Canonical policy: HTTPS, non-www, no trailing slash
Expected indexable templates: service, category, product, guide

Do not aim an unrestricted crawl at infrastructure you do not own or have permission to test. Exclude private, transactional, faceted, calendar, and infinite URL spaces before starting. Use an appropriate crawl speed, especially on small or fragile hosting.

For a store-specific inventory that separates categories, products, variants, filters, pagination, stock states, and Product data, use the ecommerce SEO audit checklist after scoping the crawl.

2. Export the Google evidence before the crawl

In Search Console, choose the correct property and save these three views:

Performance, Pages. Use a meaningful comparison window, normally 90 days for a stable audit and longer when the business is seasonal. Export clicks, impressions, CTR, and position by page.
Page indexing. Record indexed and non-indexed totals, reasons, trend changes, and examples for the groups that affect intended pages.
Sitemaps. Record submitted files, last read state, and the relationship between submitted and discovered pages.

Search Console's ordinary report export is limited to the rows shown, and Google documents a maximum of 1,000 representative examples for several reports. Performance tables also omit some data for privacy and internal limits. Treat the export as valuable evidence, not a complete census. Larger properties may need the Search Console API or bulk export for fuller performance analysis.

Do not label every “Not indexed” group as a defect. Google explicitly notes that duplicates, alternates, redirects, blocked pages, and intentionally noindexed URLs can be legitimate. The audit question is whether the affected URL was intended to be a separate canonical search result.

3. Configure and run a reproducible crawl

Screaming Frog's default Spider mode is designed as a quick start, but the configuration still determines the evidence. Confirm these settings before pressing Start:

Start URL and host boundary. Use the preferred canonical origin and decide whether subdomains or external CDN hosts belong in scope.
Robots behavior. A normal crawl should respect the intended rules. If you test a second configuration that ignores them, label it clearly because it answers a different question.
Rendering. Start with HTML for a conventional server-rendered site. Use JavaScript rendering when important links, content, canonicals, or directives depend on client rendering.
Includes and excludes. Prevent session URLs, internal search, calendar loops, filter explosions, and private routes from consuming the crawl.
Sitemaps and external URL sources. Add the XML sitemap and Google-derived URLs when you need to find pages that are known elsewhere but not linked by the crawl.
Storage and speed. Choose settings the machine and server can sustain, then preserve them for the validation crawl.

After the crawl finishes, run Crawl Analysis so filters that depend on post-crawl calculations populate. Export the internal HTML inventory and the reports needed for redirect chains, canonicals, directives, response codes, crawl depth, inlinks, and sitemap membership. An issue count on the right side of the interface is not the deliverable. The affected URLs, source URLs, intended behavior, and fix owner are.

4. Connect Search Console or join the exports

The licensed integration can pull Search Analytics and optional URL Inspection data into the crawl. As verified on August 4, 2026, Screaming Frog documents the interface path as Configuration > API Access > Google Search Console. Focus URL Inspection on important templates because the API has a daily property quota and the crawler queries discovered URLs in crawl order unless you narrow the scope.

A manual join is equally valid for a small audit. Keep one row per observed URL, preserve each raw value, and create a consistent normalized key:

raw_url
normalized_url
crawl_status
indexability
declared_canonical
crawl_depth
internal_inlinks
in_sitemap
gsc_clicks
gsc_impressions
gsc_index_group
google_selected_canonical
decision
owner

Normalize only known presentation variants such as the canonical host, protocol, default port, and a documented trailing-slash rule. Do not strip meaningful parameters or merge paths because they look similar. Keep redirects and canonical targets in separate columns so the audit can reveal where variants converge.

5. Reconcile the URL sets

Observed state	Likely question	First check
Crawlable 200 + indexable + GSC performance	Is a valuable page technically stable?	Protect status, canonical, content, links, and search intent before changing it
GSC performance + missing from crawl	Is the page orphaned, redirected, blocked, outside scope, or represented by another variant?	Test the raw GSC URL, final response, inlinks, canonical, and crawl configuration
Crawlable indexable page + no performance row	Is it new, low demand, weakly linked, excluded from the export, or not selected for search?	Check launch date, Page indexing, intent, internal links, and a URL Inspection sample
Non-200 or non-indexable + GSC performance	Did a valuable URL change, or is historical/canonical data still being reported?	Inspect the date trend, redirect target, selected canonical, and replacement page
In sitemap + not internally discovered	Is the sitemap compensating for an orphan?	Find the intended hub, category, or contextual link path
Internally discovered + canonical points elsewhere	Are links promoting a duplicate?	Compare content, canonical intent, sitemap membership, and internal destinations

The most useful bucket is often “GSC evidence but missing from the crawl.” It can expose orphan pages, old URLs that still receive search activity, pages reachable only through a sitemap, or a crawler configuration that excluded an important section. The opposite bucket is not automatically bad. A live page with no Performance row may simply have no reported impressions during the selected period.

6. Prioritize impact before issue count

Do not sort the final backlog by the number of warnings. Score each finding across four dimensions:

Business and search value. Does the URL generate leads, sales, impressions, clicks, or support an important user journey?
Technical severity. Does the defect block fetching, indexing, canonical selection, navigation, or a final destination?
Pattern reach. Is this one stale page or a shared template, navigation component, routing rule, or sitemap generator?
Confidence. Do the crawl, Search Console, live page, and intended policy agree on the diagnosis?

Priority = value x severity x pattern reach x confidence

Critical: valuable URL unavailable, blocked, wrongly canonicalized, or removed without a valid replacement
High: repeatable template or navigation defect affecting intended pages
Investigate: evidence conflicts or the intended page job is unclear
Ignore: intentional state with no harmful discovery, index, or user impact

A missing meta description across 2,000 archive pages may be less urgent than one accidental noindex on the primary service page. A large redirect count may be expected history, while five redirecting links in the global navigation deserve a quick component fix.

Turn findings into fixable tickets

Each ticket should name the evidence, rule, shared source, sample URLs, owner, risk, rollback path, and validation method. “Fix 404s” is not enough. “Update the footer component so its four old routes link directly to final 200 destinations, then re-crawl every template using that footer” is testable.

Use the template-level technical SEO fixes when the diagnosis points to shared code. Use the on-page audit when one representative page needs content, heading, media, and internal-link review rather than a sitewide crawl fix.

What not to do

Do not export every issue and call it an audit. Filters report conditions. They do not know the page's job or business value.
Do not assume Screaming Frog is Google. A desktop crawl and Google's stored view differ in timing, discovery sources, rendering, and processing.
Do not treat missing Performance data as zero demand. The selected period, canonical aggregation, export limits, privacy filtering, and a new page can all affect the row set.
Do not force 100% index coverage. Legitimate duplicate, redirected, noindexed, and utility URLs should not all become canonical search results.
Do not change crawl settings between baseline and validation without recording it. Different scope can create a false improvement.
Do not request indexing before the fix is live. First verify the response, rendered output, directives, canonical, and internal links.

Validate the implementation in two stages

Stage one is immediate technical validation. Repeat the same scoped crawl, compare it with the saved baseline, and test representative affected URLs. Confirm the first response, final response, rendered directive, canonical, inlinks, sitemap membership, and template behavior. Make sure a falling issue count was caused by the fix rather than an exclusion or failed crawl.

Stage two is Google validation. Use URL Inspection on a small set of critical representatives. Compare Google's indexed view with the live test, then request indexing only when appropriate. Monitor the relevant Page indexing group and Performance pages over the following crawls. Search Console data can lag, so deployment success and Google processing are separate checkpoints.

Finding:
Affected pattern:
Baseline crawl file:
Search Console evidence:
Expected behavior:
Implementation owner:
Deployment date:
Same-config re-crawl result:
URL Inspection live result:
Google indexed-view follow-up:
Final decision: RESOLVED / MONITOR / REOPEN

Sources checked

Screaming Frog crawl configuration, Search Console integration, crawl analysis, and Google reporting and inspection behavior were verified against official documentation on August 4, 2026.

Need the crawl and Google evidence reconciled for you?

I can turn the URL sets into a prioritized implementation plan with affected patterns, owners, and validation checks, without handing over an unfiltered tool export.

<a href="https://floxolab

Coder Legion - Recent posts tagged console

How to Change the WAF Web Console Listening Port When SafeLine Stays on 9443

The misconfiguration

What to compare before you call it a port change

The screen that confirms the fix

What this check does not claim

Why does the console still open on 9443 after I edited the environment file?

Is the application port the same as the web console port?

What does MGT_PROXY change if it is not the listen port?

Which screen confirms the console port is the one I intended?

Do I need a new administrator password after correcting the port?

Why I Change the WAF Web Console Listening Port Before Turning Protection On

Set the console port before the first launch

Keep that port off the public site path

Clear the host, secrets, and login gates

Name the protection you are actually turning on

How do I change the WAF web console listening port?

Is the web console port the same as the application listen port?

What should I verify before I turn protection on?

Does a different console port require MGT_PROXY?

How do I know the protection decision worked?

What Access an SEO Audit Actually Needs | FloxoLab

What an audit actually needs

How to grant read-only access safely

Search Console: the Restricted role

GA4: the Viewer role

What you should never hand over for an audit

The "no access, no service" red flag

When backend access is legitimate

Access closeout checklist

The bottom line

Sources checked

SEO Automation with n8n: What to Automate Safely

Start with the native option

Use a three-level safety model

What is generally safe to automate

Scheduled Search Console exports

Period comparisons with noise controls

Technical monitoring

Evidence packaging

What should not run without review

A safe weekly n8n workflow

Step 1: choose equivalent periods

Step 2: query only the data you need

Step 3: label preliminary data

Step 4: normalize before comparing

Step 5: prevent duplicate alerts

Step 6: notify, then wait for a decision

Example review logic

Add failure handling before trusting the report

Cloud or self-hosted n8n?

A practical launch checklist

Sources checked

Technical SEO Audit with Screaming Frog and Search Console

Know what each dataset can prove

1. Define the scope and protect the baseline

2. Export the Google evidence before the crawl

3. Configure and run a reproducible crawl

4. Connect Search Console or join the exports

5. Reconcile the URL sets

6. Prioritize impact before issue count

Turn findings into fixable tickets

What not to do

Validate the implementation in two stages

Sources checked