From is-it-up
to is-it-recoverable.

Probes a URL and asserts the status code and a maximum response time, following redirects the way a real browser would. The baseline heartbeat for any site or endpoint.

A scripted HTTP request with assertions on status, body, a json-path value and latency. Confirms a real user journey still returns what it should — not just a 200.

Inspects the live certificate and warns well before it expires — no 3 a.m. surprises. Reads even invalid or expired certs so it can tell you why.

Confirms plain http:// requests are redirected to https://. Catches the classic misconfiguration where a page stays reachable unencrypted.

Grades transport security: weak protocols and ciphers, hostname/SAN mismatches, incomplete chains, weak or missing HSTS. One letter for how hardened you really are.

Checks your header policy — HSTS, Content-Security-Policy, nosniff, framing protection, Referrer and Permissions-Policy. Signature-pack driven, so the policy grows without a redeploy.

Inspects Set-Cookie hardening: Secure over HTTPS, HttpOnly on session cookies, an explicit SameSite, tight scope. Catches sessions that could be stolen or leaked.

Probes cross-origin sharing: reflected or wildcard Allow-Origin, credentialed wildcards, trusted null origins — the misconfigurations that let any site read your API.

Classifies a path’s auth posture from its WWW-Authenticate challenge. Flags endpoints that should require auth but don’t, and Basic auth sent over plaintext HTTP.

Signature-pack-driven probe for leaked paths — .env files, .git directories, backups, config dumps. Confirms a real leak by content signature, not a bare 200, so SPAs don’t false-alarm.

A TCP-connect scan of a curated port set; flags reachable sensitive or admin services — databases, management consoles — that aren’t on your allow-list.

Resolves and validates SPF and DMARC for a mail domain — the records that stop others spoofing your email and keep your own messages out of spam.

Actually sends a message and confirms receipt via the provider’s activity API inside a time window. The truest test of "can we send mail right now?"

Audits the full posture: SPF without +all, an enforcing DMARC policy, optional DKIM selectors, plus CAA, MTA-STS and TLS-RPT. The deep dive behind the basic check.

Checks registration expiry via RDAP and warns before it lapses — because an expired domain is an instant, total outage, and a hijack risk.

Resolves the CNAME chain and flags dangling delegations pointing at unclaimed third-party services — GitHub Pages, S3, Heroku, Azure, Fastly. A common hijack route.

Detects insecure http:// sub-resources on an HTTPS page, and independently validates the certificates of external sub-resources. Catches "padlock but not really secure".

Flags cross-origin scripts and styles missing SRI, outdated client-side JS libraries, and login forms submitting over plain HTTP. Guards against tampered or stale third-party code.

Probes for user enumeration, an exposed debug.log, an open xmlrpc and version disclosure — the most common WordPress leaks — all confirmed by content signature.

Compares the last backup heartbeat against a freshness window, so a silently-failed job becomes a visible alert instead of a nasty discovery mid-incident.

Restores an artifact into a throwaway database and asserts real integrity — expected tables exist, each has the expected rows, the artifact isn’t stale. Proves it is restorable.

Scans your deployed container image via Trivy and surfaces CVEs at or above a severity threshold you choose. Turns "which images have known criticals?" into a monitored answer.

Checks the domain against DNS domain-blocklists and flags any listing — an early warning that deliverability and trust are at risk.