Checks

Uptime

We request your site every minute from several locations. It only counts as down once a second location confirms it, so a single network hiccup never wakes you up.

API assertion

Calls an API endpoint with the method, headers and body you choose, and checks the status, response headers, JSON values and response time against your rules.

Ping

Pings your server and alerts you on packet loss or slow round trips, even when nothing is served over HTTP.

TCP ports

Checks that services other than your website, such as databases, mail or SSH, accept connections on their ports.

IPv6 & HTTP/2

Checks that your site works over IPv6 and supports HTTP/2. A broken IPv6 setup makes your site unreachable for many mobile visitors.

Third-party status

Follows the status pages of the services your site depends on, so you know when a problem comes from a provider rather than from your own site.

Application health

Reads the health results your application reports about itself, such as disk space, queues or database connections, and alerts you when one fails or the app stops reporting.

Lighthouse

Runs Google Lighthouse on your site and tracks its performance, accessibility, best practices and SEO scores. A sudden drop after a deploy is flagged even while the score is still green.

Performance

Watches the response times measured by the uptime check and alerts you when your site is consistently over budget or suddenly much slower than usual, with a breakdown showing which phase is slow.

Page weight & caching

Weighs your page and everything it loads, and checks compression and caching. Heavy pages are slow on mobile networks and cost your visitors data.

Core Web Vitals

Shows how fast your site feels to real Chrome users (LCP, INP and CLS over the last 28 days) against Google's thresholds, and warns when a metric is getting worse.

Green hosting

Checks with the Green Web Foundation whether your host runs on renewable energy, and estimates the CO₂ emitted by each visit to your page.

SSL certificate

Verifies that your SSL certificate is valid, trusted, matches your domain and is not about to expire, so visitors never see a browser security warning.

Mixed content

Finds pages served over HTTPS that still load images, scripts or styles over plain HTTP. Browsers block or flag these, breaking the page or the padlock.

Port scan

Scans your server for open ports. Databases, caches and admin panels reachable from the internet are a common way in for attackers.

Exposed files

Looks for files that should never be public, such as .env files, Git folders, backups and debug tools. One leaked file can hand over your database password.

Security headers

Checks the HTTP headers that tell browsers to protect your visitors, such as Content-Security-Policy, HSTS and X-Frame-Options.

Third-party scripts

Warns when your pages start loading scripts from a host never seen before, the typical sign of a card skimmer or a compromised tag manager.

Cookie security

Checks that your cookies carry the Secure, HttpOnly and SameSite flags, so session cookies cannot be stolen or sent along with forged requests.

TLS configuration

Inspects how your server sets up HTTPS: the certificate chain, the hostname match and whether outdated protocols such as TLS 1.0 and 1.1 are still accepted.

New certificates

Watches public Certificate Transparency logs and alerts you when a certificate is issued for a new hostname or by a new authority, which can reveal a phishing site or a forgotten server.

security.txt

Checks your /.well-known/security.txt file, which tells security researchers how to report a vulnerability to you.

Google Safe Browsing

Asks Google Safe Browsing whether your site is flagged for malware or phishing. A flag shows a red warning page to visitors in most browsers.

Information disclosure

Looks for software versions in your headers and pages, and for error pages showing stack traces. Both tell attackers exactly which exploits to try.

CORS

Checks your CORS headers. A server that trusts any origin while allowing credentials lets any website read your users' data.

Vulnerable JavaScript libraries

Detects the JavaScript libraries on your homepage and their versions, and reports those with known security vulnerabilities.

Domain expiry

Reads your domain registration and warns you well before it expires. A lapsed domain takes your site and email offline, and can be bought by someone else.

DNS blocklists

Checks whether your server's IP address appears on spam and malware blocklists. A listing can send your email to spam or get your site blocked.

DNS changes

Compares your DNS records with the previous run and tells you what changed. Unexpected changes can mean a hijack or a migration gone wrong.

DNS hardening

Reviews your DNS setup for weak spots: DNSSEC, CAA records, nameservers that disagree or are down, and CNAMEs pointing to targets that no longer exist.

Domain lock

Checks that your domain has a transfer lock and alerts you when its registrar or nameservers change, the first visible sign of a domain hijack.

Subdomain takeover

Checks every subdomain we know of for DNS records pointing at services that no longer exist. Anyone could claim those services and serve content on your subdomain.

Look-alike domains

Generates look-alike versions of your domain and alerts you when one is newly registered. They are often set up for phishing your customers.

Email authentication

Checks your SPF and DMARC records, which stop others from sending email in your name. Even domains that send no email need them.

Mail server TLS

Checks that your mail servers encrypt incoming email with STARTTLS, publish MTA-STS and TLS-RPT, and have matching reverse DNS so your mail is not marked as spam.

Broken links

Crawls your site and follows every link, image and script to find the ones that return an error. Broken links frustrate visitors and hurt your search ranking.

Sitemap

Validates your XML sitemap and the URLs it lists, so search engines can discover every page you want indexed.

Search indexing

Catches settings that hide your site from search engines, like a robots.txt blocking everything or a noindex tag left over from staging. It also flags missing pages that answer 200 instead of 404.

Redirects & canonical

Follows your redirects to find loops and long chains, and checks that www and non-www versions and your canonical tag point to one address so search ranking is not split.

SEO meta tags

Checks the tags search engines and social networks read from your page: title, description, Open Graph, headings, viewport, language and structured data.

Cookie consent

Checks that tracking waits for consent: a first visit must not receive tracking cookies, and tracker scripts should come with a consent manager, as GDPR requires.

Keyword

Checks that your page contains, or does not contain, the text you choose. Useful to catch error messages or a page that loads but shows the wrong content.

Content change

Compares the visible text of your page with the previous run and alerts you when it changes a lot, which catches defacements and pages replaced by an error or parking page.