What Audera checks

Requests every external link found on the page and confirms that each one responds successfully. Broken links to references, prescribing information hosts or corporate sites undermine credibility and can leave mandatory information unreachable. A separate finding is raised for each external URL that returns an error status or does not respond at all.

When a page is captured but its content cannot be parsed into the structured elements the other checks read, those checks silently skip rather than fail. This check makes that state visible: a finding is raised when analysis failed entirely, and a review item when only part of the page could be analysed. It resolves automatically on the next scan that analyses cleanly.

The most fundamental check: requests the page and confirms it responds. A page that returns an error or does not respond at all is invisible to patients and healthcare professionals, and every other check is moot for it. A 2xx success or a 3xx redirect (which the browser follows to a real page) passes. A page that was reachable before and has just gone unreachable is first raised as a review ("confirming on next scan") rather than condemned outright — a single transient blip should not be a hard failure; only a second consecutive unreachable scan escalates it to a fail (in place, same finding). A page that is unreachable from its very first scan, in isolation on an otherwise-healthy site, fails immediately.

Checked once per scan of a live site rather than per page: fetches the robots.txt file at the root of the site and inspects it. A finding is raised when the file is missing or unreachable, when a CMS returns an HTML page at the robots.txt URL instead of a real file (a soft-200), or when it contains a global Disallow rule for all crawlers, a common leftover from staging that removes the entire site from search engines. The finding is attached to the homepage of the site.

Raised once per scan rather than per page: when an overwhelming majority of a site's pages come back unreachable in the same scan, the cause is almost never each page being individually down — it is a WAF, bot-management product or rate-limiter blocking automated access to the whole site. Rather than flooding the findings list with one "page unreachable" finding per page, Audera collapses the situation into a single actionable finding on the homepage that points at allowlisting our scanner. The individual page findings stay on record as evidence, but their alerts are held under this one so the picture stays clear. It resolves automatically on the next scan that reaches the site again.

Checked once per scan of a live site: connects to the host and inspects its SSL/TLS certificate. An expired, hostname-mismatched, untrusted or otherwise invalid certificate triggers browser security warnings that stop visitors at the door, so it is raised as a critical finding, and a certificate expiring within the next 14 days is raised at high severity as an early warning. A host whose certificate cannot be inspected at all is also flagged.

Compares the analytics and tag-management scripts detected on the page (such as Google Analytics, Google Tag Manager or Adobe Analytics) against the approved baseline version of the page. A finding is raised in two situations: no analytics tags are detected at all, or the set of analytics vendors differs from the baseline. Missing tags mean campaign and traffic data silently stops being collected, while unexpected new tags can indicate an unapproved deployment or a privacy concern.

Watches the Google Search Console verification meta tag and compares it with the approved baseline version of the page. A finding is raised when the tag that was present at baseline disappears, or when its value changes. Losing the verification tag can silently revoke access to Search Console data for the domain, and a changed tag often indicates an unexpected deployment or template change.

Inspects the canonical URL and the hreflang alternate entries of the page and flags any that point to a different registrable domain than the page itself. Comparison is on the registrable domain so www/non-www and same-site subdomains are not flagged, and a sister-domain allowlist built from the client's other monitored markets permits legitimate cross-border hreflang. A canonical that points to a different path on the same host is surfaced separately, and remaining cross-domain hreflang entries are raised for review rather than as a hard failure.

A leaked page is one that was never meant to carry a live link — CMS author archives, tag and date archives, attachment pages, or half-built templates. Audera stops content-checking a leaked page (there is nothing to fix on it) and instead probes it each scan, keeping this finding open while the page still returns 200 and resolving it automatically once it is taken down or redirected.

Detects a robots noindex directive (meta tag or X-Robots-Tag header) on a live production page. Noindex is routinely used to keep staging and preview sites out of search engines, and when it leaks into a production deployment the page disappears from search results, often unnoticed until traffic collapses. Because some live pages are intentionally noindexed (thank-you, print, internal search) and every client handles that differently, a noindex is raised for REVIEW on any live page rather than failed outright — confirm it is intentional, or disable this check for the page / dismiss the finding. Staging and development environments are ignored.

On a staging or development environment, checks that the page is kept out of search engines. A non-production page Google can crawl leaks pre-launch content, competes with production for the same keywords, and can expose embargoed or unapproved claims. The page is treated as protected when the environment has HTTP basic-auth credentials, or the page sends a meta robots / X-Robots-Tag noindex. When none of those are present the page is publicly indexable and raised for REVIEW — confirm it is intended, add credentials or a noindex, or disable this check. Production (live) environments are handled by the noindex-leak check instead.

Surfaces when the visible copy of a live page has materially changed since the approved baseline while the job code and the date of preparation have both stayed exactly the same. In most approval workflows a material copy change requires re-approval, which produces a new job code or an updated date of preparation, so unchanged compliance artefacts alongside changed copy suggest the page was edited outside the approval process. The change is measured as a word-level diff (so carousels, tokens and timestamps do not trigger it), and the result is raised for review; the check runs on live environments only and passes whenever the change is trivial or either compliance artefact also changed.

Applies only to legal pages (terms and conditions, privacy policy and cookie policy) and checks that they display a last-updated date. Privacy regulations and good practice expect these documents to show when they were last revised, so visitors can tell whether the terms they are reading are current. A finding is raised when a legal page has no detectable last-updated date.

Watches every live page for any change in content compared with the snapshot accepted as the baseline. The page content is hashed on each scan, and when the hash no longer matches the baseline a finding is raised, noting whether the main heading also changed. This is the core drift alarm: it signals that something on an approved page is different, and it stays active until the change is reviewed and the new state is accepted as the baseline.

When the linked EMA source or manual fallback says the product is under additional monitoring, Audera expects the promotional site to be behind a healthcare-professional gate. This site-level check raises a review finding on the anchor page when additional monitoring is expected but the site is configured as public.

Compares the linked medicine's additional-monitoring status at the regulator source against the last known value. When the regulator adds or removes the black triangle, this critical finding is raised so the site's triangle usage can be reviewed against the new requirement. The change originates outside the agency's control, so it is surfaced even between site deployments.

Looks for the adverse event reporting statement on the page, the standard wording that tells readers how to report side effects, for example via the MHRA Yellow Card scheme or the drug safety contact of the marketing authorisation holder. Pharmaceutical promotional material is generally required to carry this statement wherever a product is promoted, and regulators treat its absence seriously. A finding is raised when no adverse event reporting wording is detected in the page content.

Verifies that the black triangle (the symbol marking a medicine under additional regulatory monitoring) is used consistently. A finding is raised for review in either direction: the site is configured as promoting an additionally monitored product but no black triangle signal is detected at all, or a black triangle is detected when the site is not flagged for additional monitoring. A soft consistency finding is also raised when a text-rendered triangle is applied inconsistently across many mentions of the medicine name. Because the symbol can be rendered as text, inside a logo image, or alongside an "additional monitoring" statement, this check is best effort and always asks for human confirmation rather than asserting a definite failure.

Checks that a date of preparation, or date of revision, is present on the page. Industry codes such as the ABPI Code require promotional material to state when it was created or last revised, so reviewers and inspectors can tell whether the material is current. A finding is raised when no date of preparation can be detected on the page; the age of the date is not judged, only its presence.

Runs when an Important Safety Information section is present and measures how much safety text it actually contains. If the ISI text is shorter than 400 characters the section may have been truncated, collapsed, or only partially rendered in the captured page, a real failure mode where the heading survives but the content does not. Because legitimately short ISIs exist, the finding is raised for review rather than as a definite failure.

Confirms that an Important Safety Information section is present on the page. The ISI carries the safety warnings, contraindications and other risk information that must accompany product promotion, and its absence from a product page is one of the most serious findings Audera raises. A finding is created whenever no ISI section is detected in the page content.

Validates candidate job codes found on the page against the expected format configured for the site, or inherited from the client. Each company uses a defined job code structure, and a code that does not match it usually means a typo, a code from the wrong market, or placeholder text that survived to production. The check only runs when a format is configured and code-like strings are detected on the page; the finding lists every candidate that fails to match.

Checks that a job code (the unique approval reference, sometimes called a Veeva code, Zinc code or item code) is present on the page. The job code ties the live page back to its certified version in the approval system; without one there is no evidence the content was approved. A finding is raised when no job code can be detected on the page.

Checks whether a page shows more than one distinct job code (approval reference). A single code is expected; a second code — for instance a different reference inside the terms of use or a legal block — can be legitimate, but it can also signal mismatched or leftover content. A low-severity finding is raised when two or more distinct codes are detected so the team can confirm both are correct.

Cross-checks the superscript citation markers in the page body against the numbered entries in the references section. A finding is raised for review when superscript numbers point to no reference entry, meaning a claim has no supporting citation, or when reference entries exist that no superscript points to, which is often a sign that copy was deleted without updating the bibliography. Clinical claims on pharma sites must be traceable to their cited sources, so both directions are flagged. Text-based cross-checking of markers against references is included on all tiers; Pro and Agency plans additionally use AI vision review to spot reference markers baked into page imagery (charts, figures, infographics).

Confirms that the page links to prescribing information (PI or SmPC) and that each of those links actually resolves. Promotional pages for prescription medicines must provide direct access to prescribing information, so both a missing link and a broken one are critical failures. A finding is raised when no PI or SmPC link is detected on the page, and a separate finding is raised for each PI link that returns an error or cannot be reached.

Tracks the linked medicine's EMA EPAR Product information last-updated date. When the source date advances, this informational review finding is raised so the site's prescribing and safety content can be checked against the new product information. The finding remains reviewable, but carries only the configured info-severity health weight.

Disease-awareness and corporate sites are typically unbranded, so the promotional checks (safety information, prescribing information link, adverse-event statement) start switched off for them. This check guards that assumption in two ways: (1) when a product name configured on one of the client's product sites appears in this site's visible page text, a review item is raised; (2) when an external link points directly to a product site's domain — or that domain appears in a link's URL-decoded query string (covering common /exit?url= interstitial patterns) — a review item is raised. Interstitials whose target is not URL-borne (e.g. JS-only redirects, POST forms) are not detected in v1. Both signals require product names / domains to be configured on the client's product sites.

When a UK product page promotes a medicine under additional monitoring, Audera requires the adverse-event reporting statement to link to the MHRA Yellow Card scheme. The generic adverse-event check still owns pages with no AE wording at all; this check only raises when AE wording exists but the Yellow Card link is missing.

Scans the page for signs of a cookie consent banner or consent management platform. Sites serving UK and EU visitors are expected to obtain consent before setting non-essential cookies, so a page carrying analytics or marketing tags with no visible consent mechanism is a compliance risk. Consent evidence is drawn from every render stage the scan saw — the content render and, on gated sites, the pre-traversal gate render where the banner often lives — and a positive on either counts as present. Detection covers only what our renders saw: a banner injected purely by JavaScript after our capture window, or behind a CMP iframe, may not appear. Because consent banners vary widely across vendors and bespoke builds, this check is best effort: when no consent signals are found it raises a finding for review rather than a definite failure.

Checks the site homepage for signs of a healthcare professional gate, the self-certification step that keeps promotional content intended for HCPs away from the general public. Gate presence is assessed on the site's homepage; interior pages captured behind an untraversed gate are covered by the per-page gate-capture signal. The check runs on the homepage only, and is skipped when the scan traversed an automated gate this run or when the homepage itself is set up as the HCP gateway page type. A configured gate that failed to traverse is flagged, since the captured content and screenshot would then show the gate instead of the page behind it. When a gate is expected but the capture was dominated by a cookie banner or other blocking overlay, the gate is unassessable rather than confirmed missing, so a review-level holding finding is raised instead of a failure. Otherwise, if no gating signals are detected in the captured HTML a finding is raised for review, since gates rendered purely by JavaScript may not appear in the static snapshot.

Tracks brand logos located on the page by the vision review. For each logo that comes from a real image file, the source file is re-fetched on every scan and its bytes compared to the last-seen version. Brand marks on pharma sites are approved material, so a changed logo image can indicate an unapproved rebrand, a swapped asset, or a broken/replaced file. A changed logo raises a finding for review. Logos that are not backed by a stable image file (CSS backgrounds, inline SVG, marks baked into artwork) are re-assessed by the AI review rather than this cheap per-scan check.

Finds registered trademark and trademark symbols in the page text and checks that each one is rendered as a superscript. Brand guidelines, and most approved artwork, specify superscripted marks, so a full-size symbol usually means the page markup has drifted from the approved layout. A single finding for review lists every occurrence on the page that is not superscripted. Detection currently covers marks in the page text; finding marks rendered inside imagery (logos, banners, figures) is on our roadmap.