Web-Check: type in a URL, get a full website checkup

Figuring out what’s running behind a website and whether it’s configured soundly usually means bouncing between several different online checking tools. Web-Check pulls all those checks into a single page: enter a URL and you get the target site’s IP ownership, DNS records, SSL certificate chain, security response headers, open ports, tech stack, and performance profile. The project is written in TypeScript by developer Alicia Sykes, and GitHubDaily recommended it in January 2025.

Core features

• Network intelligence: looks up IP ownership and various DNS records (including TXT), scans open ports, runs a traceroute to inspect routing, and locates the server’s region.
• Security checks: lists the certificate chain and TLS cipher suites, checks whether security headers like HSTS and CSP are in place, and can identify whether the target site has a WAF.
• Domain information: queries Whois and associated hostnames, verifies mail configuration like SPF/DKIM/DMARC, and shows DNSSEC status.
• Tech-stack identification: uses the Wappalyzer fingerprint database to determine what technologies a site runs, and also lists cookies, sitemaps, and internal links.
• Quality assessment: calls Lighthouse to score performance, accessibility, best practices, and SEO, totaling roughly a hundred metrics.
• Threat and background info: cross-checks malware and phishing blocklists, detects DNS hijacking, and includes Tranco ranking, Wayback archive history, and a carbon-footprint estimate.

Typical use cases

• Site-owner self-audits: check whether your own site’s security headers are all in place, whether the TLS configuration has weaknesses, and where performance or SEO is lagging, then harden it item by item.
• Recon before authorized testing: before formal testing begins, gather baseline infrastructure information about the target (IP, open ports, tech stack, firewall) to map out the potential attack surface.
• OSINT investigation: combine Whois, associated domains, archive history, and other clues to map an organization’s public footprint on the internet.

Quick start

The fastest way is to open the officially hosted instance at web-check.as93.net and just type in a URL. Self-hosting is a single Docker command—once started, visit port 3000 on your own machine:

docker run -p 3000:3000 lissy93/web-check

It works out of the box with no API key required; if you want enhanced checks like PageSpeed or Shodan, configure the optional keys as needed. Source deployment is also supported—see the repo for the steps, which require Node.js 22.12 or later.

Summary

This suits site administrators, ops engineers, security researchers, and developers who want a quick read on a site’s technical makeup. The project is open source under MIT, and the README promises it will always remain free and open. Two notes: some deep checks require configuring optional third-party keys before they’ll activate, and any key used client-side should be scoped to minimum privilege; when dependencies like chromium or traceroute are missing from the system, the corresponding checks are automatically skipped. Overall, it consolidates scattered website-diagnostic capabilities into a single, self-hostable report—a solid helper for routine troubleshooting and self-checks.