Run the screenshot browser somewhere that can reach the protected site, connect it to the authorized VPN or private network, and schedule the browser script to run. Playwright can navigate to the page and save an image; GitHub Actions can start that script on a recurring schedule. A hosted runner does not automatically use the VPN connection on your laptop, so private access must be configured explicitly.
How the scheduled capture works
There are three separate jobs: the scheduler starts a workflow, the workflow establishes network access, and a browser opens the page and saves its screenshot. The browser must have actual network reachability to the protected site before navigation begins.
As an Amazon Associate I earn from qualifying purchases.
- Schedule: Choose a workflow scheduler, such as GitHub Actions, or a scheduler on a machine you control.
- Network: Run on a self-hosted machine already connected to the VPN, or configure an approved private-network connection for a hosted runner.
- Capture: Start Playwright, navigate to the target, wait for the page state you need, and save the image.
- Store: Give each run a timestamped filename and decide where the image should be retained or reviewed.
The VPN vendor, target login method, readiness condition, cadence, and storage destination depend on your environment; there is no universal end-to-end configuration for an unspecified VPN and site.
Choose where the browser runs
| Approach | Best suited to | Trade-off |
|---|---|---|
| Self-hosted runner on a connected machine | A site reachable only from an existing office, home, or VPN-connected network. | You maintain the machine. It needs sufficient resources for the workflow and connectivity to GitHub Actions. |
| Hosted runner with private-network access | Teams that prefer managed workflow execution. | You must deliberately configure a permitted private-network path and limit access to what the workflow needs. GitHub documents private networking options, including WireGuard overlays: GitHub-hosted runners and private networking. |
Self-hosted runner
Install a GitHub Actions self-hosted runner on a machine that can already reach the site through the approved VPN or private network. It can be an existing server or computer; a dedicated mini PC is not required. Keep it powered and connected when scheduled jobs are due, and ensure it has the resources and network access its workflow needs. See GitHub’s self-hosted runner documentation.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Hosted runner
GitHub-hosted runners have public internet access by default, not an automatic route through your local VPN. Configure an approved private-network connection before the capture step. For example, Tailscale documents a GitHub Action that joins a workflow to a tailnet; later steps can access devices according to the permissions assigned to that workflow identity or tag. Follow the access controls in Tailscale’s GitHub Action documentation and your organization’s network policy. Do not expose the protected site publicly just to make the workflow work.
Build a Playwright capture script
The following Node.js script opens a page, waits for a site-specific readiness condition, and saves a timestamped PNG. Replace the example URL and readiness selector with values appropriate to your site. If no reliable selector exists, use a different readiness condition that reflects when the page is useful to capture.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
import { chromium } from 'playwright';
const targetUrl = process.env.TARGET_URL;
if (!targetUrl) throw new Error('Set TARGET_URL');
const browser = await chromium.launch({ headless: true });
try {
const page = await browser.newPage({ viewport: { width: 1440, height: 1000 } });
await page.goto(targetUrl, { waitUntil: 'domcontentloaded', timeout: 60000 });
// Replace this with an element that indicates the page is ready for capture.
await page.locator('body').waitFor({ state: 'visible', timeout: 30000 });
const stamp = new Date().toISOString().replace(/[:.]/g, '-');
await page.screenshot({ path: `screenshots/site-${stamp}.png`, fullPage: true });
} finally {
await browser.close();
}Install Playwright and its browser on the runner before using the script; for a Node project, the basic setup is npm install playwright followed by npx playwright install chromium. Ensure the screenshots directory exists or create it in the script. Playwright’s Page API documents navigation and screenshot options, including full-page capture: Page API.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the capture state deliberately
- Viewport or full page: The example uses
fullPage: true. Omit it to capture only the visible viewport. - Readiness: Replace the sample body selector with a meaningful page element when possible. An arbitrary delay can be used for a site that renders asynchronously, but it is less reliable than waiting for a known state.
- Authentication: Use the site’s approved authentication mechanism. Do not commit passwords, cookies, VPN credentials, or tokens to the repository or print them in workflow logs. Store secrets using the scheduler or network provider’s documented secret controls.
- Repeatability: Keep the browser version, operating system, viewport, and capture settings stable if you compare images across runs. Playwright notes that rendering can vary with the host OS, browser version, settings, hardware, power source, and headless mode; use the same environment as the baseline for visual comparisons: Playwright visual comparisons.
Schedule the job with GitHub Actions
After the script works on the selected runner, a workflow can invoke it periodically. This example runs hourly and saves the generated files as a workflow artifact. For a private site, configure the network connection before running the capture step; the placeholder comments are not a VPN configuration.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
name: Scheduled website screenshot
on:
schedule:
- cron: '0 * * * *'
workflow_dispatch:
jobs:
capture:
# Use your connected self-hosted runner, or configure approved private
# networking on a hosted runner before the capture step.
runs-on: self-hosted
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 22
- run: npm ci
- run: npx playwright install chromium
# Add the approved VPN/private-network connection step here if needed.
- name: Capture page
run: node capture.mjs
env:
TARGET_URL: ${{ secrets.TARGET_URL }}
- uses: actions/upload-artifact@v4
with:
name: website-screenshot-${{ github.run_id }}
path: screenshots/*.pngSet TARGET_URL as a repository or environment secret, or use a non-secret workflow variable if the URL itself is not sensitive. The workflow’s example artifact is a way to retrieve run output, not a permanent image archive; choose a retention or storage policy that meets your needs. For a hosted runner, change runs-on as appropriate and add the network provider’s approved connection setup before browser navigation. GitHub documents hosted-runner private connectivity at its private-network guide.
Handle authentication and sensitive pages safely
- Use a dedicated, least-privilege account if the site requires login, and grant the workflow only the access it needs.
- Prefer the VPN or private-network provider’s documented authentication and secret-handling approach. Do not paste credentials into source files or command lines that may be logged.
- Check whether the site uses a login redirect, multi-factor challenge, or session expiry. A successful browser launch does not mean the workflow is authenticated.
- Restrict access to screenshot artifacts: images can contain internal data even when the URL itself is not secret.
- Do not bypass site security controls. If the workflow identity is not authorized to access the target, obtain the required permission rather than weakening the network boundary.
Keep captures reliable and useful
Use a stable environment
Visual differences can come from the rendering environment as well as from changes to the site. Keep the runner, browser version, viewport, device scale, and capture settings consistent when comparing runs. Avoid changing browser dependencies without updating the comparison baseline.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Choose a useful cadence and retention policy
Set the schedule to match how often the page can meaningfully change and how quickly someone needs to notice. Hourly in the example is only a configurable cron expression, not a requirement. Decide whether to retain every image, only recent captures, or selected results, and account for the sensitivity and storage cost of the screenshots.
Confirm what a successful run means
A workflow can finish successfully while capturing a login page, an error message, or a partially rendered screen. Validate the output visually at first, then make the script check for page-specific evidence of success before saving or flagging a run. Record failures without leaking credentials or private page contents into logs.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Navigation times out or cannot resolve the host | The runner cannot reach the private network, DNS is unavailable, or the route is not established yet. | Verify network connection occurs before Playwright starts navigation; test DNS and reachability from that same runner using approved methods. |
| Hosted workflow can reach public sites but not the target | The hosted runner has not been connected to the private network. | Configure the network provider’s supported hosted-runner integration and least-privilege permissions; a laptop’s VPN session is not inherited. |
| Runner is offline or the job never starts | A self-hosted machine is powered down, disconnected, or not communicating with GitHub Actions. | Check runner service status, connectivity, and that the machine is available for the workflow. |
| Screenshot shows login, challenge, or access denied | Authentication is missing or expired, or the workflow identity lacks access. | Confirm the approved session/authentication path and permissions; do not try to bypass access controls. |
| Screenshot is blank or incomplete | The page’s meaningful content loaded after the script captured, or the chosen readiness condition was insufficient. | Wait for a site-specific selector or state, inspect workflow output, and adjust the readiness condition rather than relying on an arbitrary short delay. |
| Images differ between otherwise similar runs | The browser or host rendering environment changed, or the page itself varies. | Pin and stabilize browser/runtime and viewport settings; compare under the same environment used for the baseline. |
| Artifact has no image | The script failed before saving, or its output path does not match the artifact pattern. | Check the script exit status, create the output directory, and align the saved filename and artifact path. |
Or skip the browser setup
ScreenshotNeo offers a one-request screenshot API and an MCP server for AI agents. It can capture public pages, but an ordinary remote screenshot endpoint cannot reach a site available only through your VPN unless that service has an authorized network path to the target. Confirm private-network reachability before using it for a protected site.
For a page the API can reach, this cURL request returns an image:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpReplace the example URL with the page to capture and provide your API key. See the ScreenshotNeo API documentation for request options. Cookie banners, popups, and chat widgets are removed before the shot; bot checks, blank pages, and failed loads are never billed. Its MCP server lets AI agents take screenshots. The Free plan includes 1,000 screenshots per month with no card, and paid plans start at $5 for 3,000. Learn more at ScreenshotNeo, or sign up free.
Recommended Free Tools
Frequently Asked Questions
Can a hosted GitHub runner use the VPN connected to my computer?
No. A hosted runner needs its own deliberately configured private-network connection; it does not inherit your computer’s VPN session.
Do I need a dedicated mini PC for a self-hosted runner?
No. An existing machine can work if it has sufficient resources, stays available for scheduled runs, reaches the protected site, and communicates with GitHub Actions.
Can I use a screenshot API for a VPN-only site?
Only if the service has an authorized network path to that site. A remote API should not be assumed to have access to your VPN or private network.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
