Web Check takes one URL and runs around 50 checks against it in parallel, then lays the results out as a dashboard of cards: IP and server location, DNS records and DNSSEC, SSL certificate chain and TLS cipher suites, HTTP security headers and HSTS, cookies, redirects, open common ports, a traceroute, the tech stack, trackers, carbon footprint, archive history, block-list and threat-feed status, mail configuration, robots.txt, sitemap, security.txt and a screenshot from headless Chromium. It is the afternoon of terminal commands a sysadmin would run on a new domain, done in about a minute and readable by someone who has never typed dig.
It is built and maintained by Alicia Sykes, who also makes Dashy and a long list of privacy tools, and it is one of the most starred OSINT projects on GitHub: about 35,300 stars, 43 contributors and a 2.3 release in October 2026, with the last push the day before our scan. The code is MIT-licensed. There is a free hosted version at web-check.xyz, so you do not have to run anything to try it.
Self-hosting is the better fit for regular use or for checking hosts on your own network. It runs as a Node server, a Docker container, or serverless functions on Netlify or Vercel. No configuration is needed; optional keys for Google, Shodan, Cloudmersive and a few others switch on extra checks.
- Repository: github.com/Lissy93/web-check
- Licence: MIT (MIT License)
- Language: TypeScript. Stars: 35.3K. Forks: 2,914. Last push: Oct 27, 2026.
- Scan: safe, Oct 28, 2026, commit a16d6e8
Who it is for
Site owners and sysadmins auditing their own domains, developers checking headers and certificates after a deploy, security teams doing a first pass on infrastructure they are responsible for, and journalists or researchers verifying who hosts a site and how it is set up.
Getting started
1. Try it without installing anything
open https://web-check.xyz2. Or run your own copy with Docker, then open localhost:3000
docker run -p 3000:3000 lissy93/web-check3. Or build from source (Node 22.22.3+ or 24.16+, and yarn)
git clone https://github.com/Lissy93/web-check.git && cd web-check && yarn install && yarn build && yarn startA self-hosted instance has no login, and anyone who can reach it can make your server send requests, port scans and traceroutes to any host they type in. Keep it on localhost or a VPN, or put it behind a reverse proxy with auth, and use API_BLOCKED_HOSTS and API_DISABLED_CHECKS to fence it in. Only scan sites you own or have permission to test.
Safety scan
We cloned Lissy93/web-check at commit a16d6e8 on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits, no install hooks and no committed binaries across 395 files. The network hosts the scan lists are the services the checks call or link to (Shodan, SSL Labs, crt.sh, URLhaus, the Wayback Machine and others) plus documentation links.
- yarn.lock pins 1,355 packages with 15 known advisories, none critical and 13 high. They sit almost entirely in deployment and install tooling: toml and node-forge come from the Netlify and local dev servers, extract-zip unpacks the Chromium download at install time, and basic-ftp is only reachable through Puppeteer's proxy-autoconfig support. The zod advisory is a memory exhaustion case in Astro's validation. None is a path a visitor to the app can reach in normal use.
- The pattern a reader should know about is the app's purpose: its server makes requests to whatever host you give it, including internal ones. SECURITY.md says so plainly and lists the controls (blocked hosts, enabled and disabled checks, rate limiting, CORS origin, GUI off). Checks that call third-party APIs skip private IPs, localhost and .local hosts, and chromium and traceroute run without a shell.
- Six workflows. Two use pull_request_target, one to label PRs through the API and one to tag releases after a merge; neither checks out the pull request's code, and PR titles reach shell steps only through environment variables. The 14 third-party action uses are pinned to tags rather than commits. Docker images are built in CI, scanned with Trivy and published with signed provenance and an SBOM.
- Security policy with a written threat model, Dependabot, CodeQL, licence and contributing guide present; no code of conduct.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 6 workflows. 2 use pull_request_target, none check out the pull request head. 14 of 14 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often pixelflare.cc, en.wikipedia.org, developer.mozilla.org, github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 15 advisories across 1,355 pinned packages: 0 critical, 13 high, 1 moderate, 1 low. yarn.lock: 1,355 packages, 15 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (15 of 15)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-c475-qrg2-pj4r | high | basic-ftp@5.3.1 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
| GHSA-7pqw-9j4j-h8q3 | high | extract-zip@2.0.1 | extract-zip allows arbitrary file writes through symlink archive entries |
| GHSA-jmr9-qjv8-65gv | high | extract-zip@2.0.1 | extract-zip unvalidated symlink path traversal |
| GHSA-7pqw-9j4j-h8q3 | high | extract-zip@1.7.0 | extract-zip allows arbitrary file writes through symlink archive entries |
| GHSA-jmr9-qjv8-65gv | high | extract-zip@1.7.0 | extract-zip unvalidated symlink path traversal |
| GHSA-86w9-cpqp-85rv | high | node-forge@1.4.0 | node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements |
| GHSA-4qx8-w7c3-pj3p | high | toml@4.3.0 | toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() |
| GHSA-9j65-hcg3-gc64 | high | toml@4.3.0 | toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() |
| GHSA-9qmh-m7c6-f92p | high | toml@4.3.0 | toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() |
| GHSA-h895-cgqg-jf52 | high | toml@4.3.0 | toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.1.11 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-mrhx-c7xc-m3w5 | high | zod@3.25.76 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.6.5 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-6pq8-jhm2-2vcw | moderate | qs@6.16.0 | qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own to… |
| GHSA-gcqx-w48m-w2h4 | low | deepmerge@4.3.1 | deepmerge mergeObject() allows prototype poisoning of returned objects |
Workflows worth a look
- .github/workflows/label-pr.yml: pull_request_target
- .github/workflows/tag.yml: pull_request_target
By the numbers
| Stars | 35.3K |
|---|---|
| Forks | 2,914 |
| Contributors | 43 |
| Commits | 833 |
| Open issues | 2 |
| Open pull requests | 0 |
| Releases | 4 |
| Latest release | 2.3.0 |
| Licence | MIT |
| Main language | TypeScript |
| Project age | 3 years |
| Last push | Oct 27, 2026 |
| Tracked files | 395 |
| Lines of code | 33.7K |
| Checkout size | 21 MB |
Lines by language: TypeScript 11.6K, JSON 11.5K, YAML 5,113, JavaScript 4,342, Markdown 466, SCSS 437.
Questions
Is Web Check free?
Yes. The code is MIT-licensed, the hosted version at web-check.xyz is free to use, and self-hosting costs only whatever your server or Netlify or Vercel plan costs. A few checks need free or paid keys from third parties such as Shodan or Google, and simply skip themselves when no key is set.
Is it legal to run Web Check on someone else's website?
Most checks read public information any browser or DNS lookup would see, but the port scan and traceroute actively probe the server, and some hosts and jurisdictions treat unrequested scanning as hostile. Use it on sites you own or are authorised to test, turn off the ports and trace-route checks otherwise, and do not load test or attack the public web-check.xyz instance.
Does Web Check store the sites I scan?
Not on a self-hosted copy: there are no accounts and no database, results go straight back to your browser, and screenshots are deleted as soon as they are sent. The target is passed to the third-party services the checks use, such as Shodan or SSL Labs, so they see what you looked up. On web-check.xyz you are also trusting the public instance's operator.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.