Web-Check: 40+ Website Checks in One OSINT Dashboard

There's a certain routine every developer or ops person goes through when investigating a domain they don't control. First, a WHOIS lookup. Then DNS — dig A, MX, TXT. Then SSL certificate check, probably in the browser. Then curl for headers. Then nmap for ports, maybe. Then Shodan to see what's exposed. Then BuiltWith or Wappalyzer for the tech stack. Each tool is separate, each result is in a different format, and by the time you've correlated everything, ten minutes are gone.

Web-Check collapses this entire workflow into one URL input and one dashboard. Enter a domain, get 40+ data points back simultaneously — DNS records, SSL chain analysis, open ports, HTTP security headers, tech stack, WHOIS info, redirect chains, firewall detection, TLS cipher suites, threat intelligence, and more. MIT licensed, 32,000+ GitHub stars, built by Alicia Sykes. Self-host it in one Docker command.

What Web-Check is

Web-Check is an open-source all-in-one OSINT and website inspection tool. Built with React (frontend) and Node.js serverless functions (backend checks). MIT licensed. 32,000+ GitHub stars at github.com/Lissy93/web-check. Latest release: v2.1.0 (2026). Available as a live hosted version at web-check.xyz, self-hostable via Docker, deployable to Vercel/Netlify/Railway with one click, or installable as an npm package.

It's not a security scanner in the Nessus or Burp Suite sense — it doesn't probe for vulnerabilities or attempt exploitation. It's a passive reconnaissance and information-gathering tool: it queries public data sources, reads publicly accessible headers and records, and presents what any browser or curl command could find, just organized and all at once.

The checks — what it actually does

Web-Check runs 40+ checks in parallel, organized into logical groups:

Network and DNS

• IP info — IP address, ASN, hosting provider, organization
• DNS records — A, AAAA, MX, NS, TXT, CNAME, SOA — all record types at once
• DNS server — which DNS provider is being used (Cloudflare, Route53, etc.)
• DNSSEC — whether DNS Security Extensions are properly implemented
• Traceroute — hop-by-hop path analysis to the server
• Associated hostnames — other domains resolving to the same IP
• Server location — geographic location of the hosting server on a map

Security

• SSL chain — full certificate chain: validity, issuer, expiration, signature algorithm
• TLS configuration — protocol versions supported (TLS 1.0/1.1/1.2/1.3), cipher suites, handshake simulation
• HTTP security headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• HSTS — whether HTTP Strict Transport Security is implemented and configured correctly
• Firewall detection — Cloudflare, AWS WAF, Akamai, and other WAF detection
• Security.txt — whether the site publishes a security contact file
• Threat intelligence — checks against threat intel feeds for malicious activity
• Malware and phishing detection — Safe Browsing API check
• Block detection — whether the site is blocked by major filters
• Open ports — common port scan (80, 443, 21, 22, 25, 8080, etc.)

Content and technology

• Tech stack — frameworks, CMS, analytics, CDN, server technology detected from headers and HTML
• Cookies analysis — cookie names, flags (HttpOnly, Secure, SameSite), and compliance indicators
• HTTP headers — full raw header dump with analysis
• Crawl rules — robots.txt content and directives
• Sitemap — sitemap.xml detection and parsing
• Linked pages — outbound links from the homepage
• Social tags — Open Graph and Twitter Card metadata for social sharing previews
• Screenshot — visual screenshot of the site as it renders

Domain and performance

• WHOIS — domain registrar, registration date, expiration, registrant info
• Domain info — TLD, registrar, domain age
• Redirect chain — full HTTP redirect chain with status codes at each hop
• TXT records — SPF, DKIM, DMARC, Google verification, and other TXT record analysis
• Email configuration — MX records, SPF, DMARC, DKIM setup analysis
• Archive history — Wayback Machine snapshot history
• Global ranking — traffic rank estimate
• Server status — response time and availability
• Lighthouse metrics — performance, accessibility, SEO scores
• Carbon footprint — estimated CO2 per page load

The use cases

Web-Check is useful in more situations than you'd initially think:

Security auditing your own sites — before deploying to production, run Web-Check against the domain. Immediately see if your CSP is missing, if TLS 1.0 is still enabled, if HSTS is properly configured, if security headers are present. Takes 30 seconds instead of running five separate tools.

Investigating suspicious domains — a link arrives in a phishing report or a suspicious email. Web-Check shows you who hosts it, what ASN it's on, whether it's detected as malicious, what its SSL cert says, whether it shares IPs with known-bad infrastructure. OSINT without leaving a single tool.

Competitive and technical reconnaissance — understand what tech stack a competitor or client site uses, who hosts them, whether they're behind a CDN, what their certificate setup looks like. All passive, all from public data.

Pre-acquisition due diligence — buying a domain or acquiring a web property? WHOIS history, archive history, domain age, associated hostnames, email configuration — all in one report.

Debugging infrastructure issues — DNS misconfiguration, redirect loops, missing security headers, expired certificates. Web-Check surfaces all of these in one pass instead of requiring you to remember which tool checks which thing.

Email deliverability investigation — SPF, DKIM, DMARC presence and configuration visible at a glance. The email configuration check identifies common misconfigurations that cause deliverability problems.

Self-hosting

The simplest self-hosted deployment is a single Docker command:

docker run -p 3000:3000 lissy93/web-check

Navigate to http://localhost:3000 and it's running. For a persistent deployment with Docker Compose:

services:
  web-check:
    image: lissy93/web-check:latest
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - PORT=3000
      # Optional: API keys for enhanced checks
      # - SECURITY_TRAILS_API_KEY=your_key
      # - SHODAN_API_KEY=your_key
      # - GOOGLE_CLOUD_API_KEY=your_key

Put Traefik in front for HTTPS and a custom domain. The tool works fully without any API keys — most checks run against public data. Optional API keys enhance some checks: SecurityTrails for more DNS history, Shodan for richer port/exposure data, Google Cloud for Lighthouse and Safe Browsing checks.

For one-click cloud deployment, the repo includes buttons for Vercel, Netlify, Railway, and Render — useful if you don't want to run a server but want your own instance rather than using the public web-check.xyz.

Privacy considerations

When using the public hosted version at web-check.xyz, your queried domains are sent to the server. For sensitive investigations — auditing internal infrastructure, researching domains you don't want associated with your IP, competitive intelligence — self-hosting is the right choice. The self-hosted instance makes all queries from your own server's IP, not from a shared Vercel edge or the public web-check.xyz infrastructure.

Limitations

Web-Check is passive reconnaissance — it only reads publicly accessible information. It doesn't probe for application vulnerabilities (SQLi, XSS, authentication bypass), scan for CVEs in running software, or attempt any active exploitation. For that, you need Burp Suite, Nuclei, or a dedicated DAST scanner.

Some checks require the server running web-check to have specific tools installed: chromium for screenshots and Lighthouse, traceroute for traceroute analysis, dns utilities for DNS checks. The Docker image includes these; the Vercel deployment skips some checks that require them.

The tech stack detection is heuristic-based — it reads headers, HTML patterns, and script sources. It won't identify every technology, particularly custom-built or intentionally obscured stacks.

Who it's for

Good fit:

• Developers who want a quick, comprehensive view of any domain's public posture
• Security engineers running preliminary recon or auditing their own infrastructure
• DevOps teams who want a self-hosted internal tool for site health and security checks
• Incident responders investigating suspicious domains in phishing reports
• Anyone who runs multiple manual checks on domains regularly and wants them in one place

Not the right fit:

• Teams needing active vulnerability scanning — use Nuclei, Burp Suite, or OpenVAS instead
• Continuous monitoring at scale — Web-Check is on-demand, not a monitoring platform
• Bulk domain analysis — the tool is designed for single-domain inspection, not batch processing

My take

Web-Check is one of those tools that you try once for a specific purpose and then keep reaching for. The value isn't in any single check — you could run each one manually — it's in having all 40+ checks run simultaneously and presented in a clean dashboard. The time savings compound quickly when you're doing this kind of investigation regularly.

The self-hosted Docker deployment is trivially easy, and running your own instance makes sense for any serious use: you control what domains you query, from what IP, with no query history on a shared server. The optional API key integration is well thought out — the tool is fully useful without any keys, and the keys just add depth to specific checks rather than being required for basic functionality.

32,000+ GitHub stars for a passive recon tool is a strong signal — this is not niche. Every developer or ops person who discovers it bookmarks it, and most eventually self-host it.