Free web security tools

Every tool here is free, needs no account and runs from CertMoni's own servers, never by proxying someone else's scanner. Type a host name, press the button, read the result. Each result is also available as JSON from the public API, so you can build the same checks into your own dashboards.

• Security headers

  Grades a site's HTTP response headers A+ to F on the same scale securityheaders.com uses, with the missing headers and how to add them.

• TLS certificate report

  The full picture of one certificate: chain, trust, expiry, protocols, HSTS, revocation, CAA and Certificate Transparency, with a grade and a link you can share.

• DNS lookup

  Any record type, including ANY, through a DNSSEC-validating resolver, with each record explained in plain English.

• Domain lookup

  Registrar, status, dates, name servers and DNSSEC for any domain straight from the registry over RDAP, the successor to WHOIS.

• HTTP Observatory

  MDN's HTTP Observatory: twelve tests, a score out of 100 and a letter grade, run on our servers with the open-source scanner.

• Public API

  Every tool as JSON with CORS enabled. Free within fair-use limits; yearly query allowances are coming soon.

Why we give these away

CertMoni is a paid certificate monitoring service. The checks behind these tools are the same ones we run every day for our customers, so publishing them costs us little and shows you exactly how we work. Results are cached for a few minutes and each visitor gets a fair share of scans, which keeps the tools fast for everyone and stops them being used to hammer other people's servers. Private network addresses are refused: the tools only look at hosts that are already on the public internet.

What the tools do not do

They do not log in, post forms, crawl beyond the front page or send anything other than a single request a browser would also send. Nothing is stored except the result itself, for the cache period, keyed by the host you asked about.