WebAudit tools
12 tools that run in your browser. Nothing to install, nothing uploaded.
Checks you run against a site you own or are responsible for — DNS propagation across independent resolvers, certificate transparency, canonical and indexability, mixed content, blocklist status, and the registrar codes that quietly lock a domain. Every one of them queries public infrastructure that already publishes the answer, so none need credentials or an agent installed. They are also careful about what a check can prove: three resolvers disagreeing is conclusive evidence of a change still in flight, three agreeing is not proof the rest of the world has caught up, and a blocklist that fails to answer is reported as unknown rather than as clean.
- DNS Blacklist (RBL) CheckerCheck an IP against the major blocklists — and see which refused to answer.
- Broken Link CheckerCheck the links on a page and find the ones that no longer resolve.
- Canonical & hreflang CheckerCheck whether a page can actually be indexed — and what it says about itself.
- Certificate Transparency SearchEvery hostname anyone has ever certified for a domain — already public.
- CMS & Version DetectorIdentify what built and serves a page — with the evidence for each finding.
- Multi-Resolver DNS PropagationCompare three public resolvers — conclusive when they disagree, honest when they agree.
- Domain Status (EPP) Code DecoderWhat your domain's EPP status codes mean — and whether it is locked against transfer.
- Full Email Deliverability AuditMX, SPF, DKIM and DMARC for a domain — with the one that cannot be checked said so.
- Mixed Content CheckerFind the HTTP resources that quietly remove the padlock from an HTTPS page.
- RDAP Domain Lookup (modern WHOIS)The modern replacement for WHOIS — structured, and honest about redaction.
- SSL Error Message DecoderWhat a certificate error actually means — which is rarely what people assume.
- Website IP Address LookupWhich addresses a domain resolves to, and what the reverse lookup says.
Checks that run against public infrastructure
Everything here queries something already published: DNS records, certificate transparency logs, the RDAP registry, the HTTP response your server hands anyone who asks. That means no credentials, no verification step and no agent to install — and it also means these are checks anyone can run against your site, which is a useful way to think about the results. Certificate transparency in particular is a public log of every certificate ever issued for a domain, so the hostnames it reveals, including staging and internal names somebody certified once, are visible to anyone who looks.
What each check can actually prove
The value of an audit tool is in knowing the strength of its evidence. Resolvers returning different records prove a change is still propagating; agreement does not prove the whole internet has caught up, because caches expire on their own schedule. A blocklist that fails to answer is unknown, not clean, and reporting it as a pass would be the more damaging error. A canonical tag is a hint search engines may overrule, so a correct one is necessary and not sufficient. Each tool states which of these it is giving you rather than rendering every result as a green tick.
Mixed content and the padlock that quietly disappears
A single HTTP resource on an HTTPS page is enough to change how the page is treated. Browsers block active mixed content — scripts, stylesheets, iframes — outright, which is why a page occasionally loses its layout or its behaviour with nothing obviously wrong in the markup. Passive mixed content such as an image is usually loaded with the padlock downgraded or removed. The common sources are predictable: a hardcoded http:// in an old template, a third-party embed that has not been updated, a legacy CDN path, or a redirect chain that passes through HTTP on its way to the final URL.
Registrar status codes are worth reading before a transfer
EPP status codes on a domain decide whether it can be transferred, updated or renewed, and they are the reason a transfer fails days after it was started with no useful explanation. clientTransferProhibited is the normal, protective lock most registrars apply by default and which you must lift deliberately before moving a domain. serverHold means the domain is not resolving at all, whatever its DNS says. pendingDelete and redemptionPeriod indicate an expiry already in progress, with a recovery window that shrinks and gets more expensive by the day. Checking these first turns a mysterious failure into a known step.
Frequently asked questions
Do I need to own the site to run these checks?
No — every one of them queries something already public: DNS records, certificate transparency logs, the RDAP registry, or the HTTP response the server returns to anyone. No credentials, no verification step, no agent to install. That cuts both ways and is worth sitting with: these are checks anyone can run against your site, including the hostnames certificate transparency reveals for staging and internal names somebody certified once.
Does agreement between resolvers mean propagation is complete?
No, and this is the most over-claimed result in the category. Disagreement proves a change is still in flight. Agreement proves only that these resolvers agree — your ISP’s resolver, a corporate resolver, or a cache on your own machine can serve the old record until its TTL expires. An honest global propagation check would need resolvers on every continent, which is why nothing here is labelled as one.
A blocklist did not respond. Am I listed or not?
Unknown, and it is reported that way. A blocklist that times out or refuses the query has told you nothing, and rendering that as a pass would be the more damaging error — it is the result people act on by doing nothing. Re-run it later, and where a listing matters, check directly with the list operator, since several throttle automated queries from shared infrastructure.
Why did my domain transfer fail with no explanation?
Usually an EPP status code. clientTransferProhibited is the protective lock most registrars apply by default and which has to be lifted deliberately before a transfer will proceed. Others matter too: serverHold means the domain is not resolving whatever its DNS says, and pendingDelete or redemptionPeriod indicate an expiry already under way, with a recovery window that shrinks and gets more expensive daily. Checking the codes turns a silent failure into a known step.