Free tools to check the security and health of your website

Sitemap Validator

Fetch and validate a domain's sitemap.xml structure, then spot-check a sample of listed URLs for reachability. Free, instant.

Structured Data Validator

Validate a page's JSON-LD structured data: correct syntax, and required fields for common schema.org types. Free, instant.

SEO Meta Tag Analyzer

Audit a page's title, meta description, canonical link, and Open Graph/Twitter tags against SEO best practices. Free, instant.

WordPress Exposed Endpoints Scanner

Scan a WordPress site for commonly-exposed REST API endpoints: media library and the ?rest_route= bypass. Free, instant.

Favicon & Manifest Checker

Check whether a site serves a favicon, an Apple touch icon, and a valid web app manifest. Free, instant site health check.

Email Verifier

Verify an email address syntax and confirm its domain can receive mail via MX records. Free, instant — not an SMTP mailbox check.

Password Breach Checker

Check if your password has appeared in a known data breach, using Have I Been Pwned k-anonymity. Your password never leaves your browser.

Blacklist Checker

Check if a domain's IP is listed on well-known spam blacklists (DNSBL). Free, instant — not exhaustive or authoritative.

CORS Policy Checker

Test a site's CORS configuration for overly permissive or credential-leaking cross-origin access — free, instant, no signup.

CSP Analyzer

Get a directive-by-directive breakdown of a site's Content-Security-Policy: what's missing, what's weak, and how to fix it. Free.

HTTP/2 & HTTP/3 Support Checker

Check whether a domain negotiates HTTP/2 and advertises HTTP/3 support — a real protocol test, not just a header guess. Free.

IP & ASN Lookup

Resolve a domain's IP address and look up its ASN, hosting provider, and network registry. Free, instant, no signup.

Open Redirect Checker

Test a domain's common redirect parameters for unvalidated open redirects — a favorite vector for phishing links. Free, instant.

Subdomain Finder

Discover subdomains that have had a public SSL certificate issued, using Certificate Transparency logs. Free, instant.

TLS Cipher & Protocol Scanner

See exactly which TLS protocol versions a server accepts — including outdated ones that create a downgrade attack surface. Free, instant.

Cookie Scanner

Scan the cookies a site sends: check for the Secure, HttpOnly, and SameSite attributes, with a plain-English explanation of what each risk means.

DNS Lookup

Instant DNS lookup: A, AAAA, MX, TXT, and NS records for any domain, with a plain-English explanation of each record type.

DNSSEC Checker

Check whether DNSSEC is enabled and correctly configured for a domain: DS and DNSKEY records, and full signature validation.

SPF/DKIM/DMARC Checker

Check whether your domain's email is protected: SPF record, DKIM (common selectors), and DMARC policy, with plain-English explanations.

Hash Generator & Identifier

Generate and identify MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes right in your browser. Nothing is sent to a server, results are instant.