01 · Product name
Web-Check
Free public report of DNS, TLS, headers, and WHOIS for one URL.
Published by Alicia Sykes.
In short
Web-Check is a free website report by Alicia Sykes. The public app is at web-check.xyz, and the about page says you can also deploy your own copy. That page says the app is free without restriction, the code is MIT, and a report draws on 44 checks, including DNS, TLS, headers, and WHOIS. The same page says the hosted service is rate-limited and that you should not scan a host you do not have permission to scan. A row is a lead from that lookup. It is not an exploit.
Product pricing strategy
02
Free
Web-Check is free. The about page says the app is free to use without restriction, that the code is open source under the MIT license, and that the managed instances are meant to stay available. It also says running the hosted app costs the maintainer money, and it points at GitHub sponsorship as optional support, including small monthly amounts. Sponsorship is not a seat price. The page does not sell a credit pack. It does say the hosted service may be rate-limited, and that someone who needs more bandwidth should deploy their own instance. The about page links an API and a self-hosting guide. This listing does not quote an API fee, because the about page does not print one.
Utility and features
03
Web-Check puts a stack of public lookups on one page. You type a URL. The report that came back for https://owasp.org on 16 Oct 2026 finished 43 lookups in under 20 seconds, with two jobs skipped. It showed the domain created on 21 September 2001, name servers fay.ns.cloudflare.com and west.ns.cloudflare.com, AS16509, a server location in Walnut, California, a Let's Encrypt certificate, and a cookie named owasp-locale missing the Secure flag. Those are the kinds of facts the about page says the tool collates: DNS, TLS, headers, WHOIS, and the security headers already on the response.
- One URL, many public lookups. DNS, WHOIS, TLS, headers, cookies, and related checks land on one report. The about page says there are 44 checks.
- Hosted or self-hosted. web-check.xyz is the public app. The about page says you can deploy your own copy when you need the uptime or the bandwidth.
- A finding is the response. A missing cookie flag or a name server is what that lookup returned. It is not an exploit and it is not a scope document.
The about page is plain about cost and use. The app is free to use without restriction. The code is MIT, copyright Alicia Sykes, and you may run your own instance. The hosted copy is rate-limited, uptime is not guaranteed, and the page asks you not to scan hosts you do not have permission to scan and not to use the tool to attack or disrupt a service. Analytics on the managed instance are described as a self-hosted Plausible install that records the URL visited. A skipped job is a skipped job. A header is what the server sent. Neither one is a vulnerability write-up.
- 1
Open https://web-check.xyz/ and submit a URL you are allowed to look up. Read the finished job count before you quote a row.
- 2
Start with domain dates, name servers, the certificate, and the security headers. Note any job the report says it skipped.
- 3
If the hosted app rate-limits you, stop. The about page says to deploy your own instance rather than hammer the public one.
- 4
Write the date next to any header or WHOIS date you keep. Both change.
Caveats
04
Web-Check collates public lookups. A header is what that server sent. A WHOIS date is what the registry returned. A missing Secure flag on a cookie is a flag, not a proof that the cookie was stolen. Two jobs skipped on the owasp.org report, so a finished page can still be incomplete.
The about page tells you not to scan hosts you do not have permission to scan and not to use the tool to attack or disrupt a service. The hosted app is rate-limited. Sponsorships mentioned on the about page are optional support, not a plan that changes the results. Confirm anything you will brief by requesting the header or the DNS record yourself.
Screenshots
05
Potential use cases
06
- You have written permission to look at one public site and you want the DNS and header picture without running your own scanners. Submit the URL on web-check.xyz and wait until the report says the lookups finished. Record the name servers, the certificate issuer and expiry, and any cookie flag the report calls out. Pivot a surprising address to Shodan or an InternetDB lookup, still without scanning it yourself. A skipped job is missing data, not a clean bill of health.
- A renewal or a migration is coming and someone claims the domain has always been on the current name servers. Run Web-Check and read the created, updated, and expiry dates next to the name servers. The owasp.org report showed a 2001 creation date and Cloudflare name servers on the day it was captured. Your target will show its own dates. Quote those dates, and do not treat a WHOIS privacy stand-in as the registrant's name.
- The public app rate-limits a batch you are allowed to run. Stop using the hosted instance. The about page says to deploy your own copy when you need the bandwidth, and it says uptime of the managed service is not guaranteed. Self-hosting is the workaround they publish. It is not a reason to rotate addresses against the public app.
Hard cases
The case where the first result is easy to over-read.
The report looks like a vulnerability list
A cookie warning and a header grade read like findings. They are observations about the response. Before anyone files them, open the response and see the header yourself, and check whether the cookie is actually set on a path you care about. Do not turn the report into a scan of ports or a login attempt because a row mentioned them. The about page's fair-use note is the boundary.
Questions
Is Web-Check free?
Yes. The about page says it is free to use without restriction, the code is MIT, and sponsorship is optional. The hosted app may rate-limit you.
Does a Web-Check finding mean the site is vulnerable?
No. It means a public lookup returned that row. A missing header is a missing header. Confirm it before you treat it as a defect, and do not scan a host you are not allowed to scan.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Web-Check
https://web-check.xyz/Documentation
About Web-Check
https://web-check.xyz/aboutDocumentation
Web-Check repository
https://github.com/Lissy93/web-check