You've been there. You're debugging a production issue, checking out a competitor's stack, or investigating a suspicious domain — and you find yourself juggling six browser tabs: one for DNS lookup, one for SSL check, one for WHOIS, one for headers, one for port scan, and a terminal window for traceroute. By the time you've pieced it all together, you've lost 20 minutes and half your sanity.
What if you could just type a domain name and see everything — IP, SSL chain, DNS records, open ports, HTTP headers, server location, cookies, redirects, technology stack, even carbon footprint — all in a single dashboard, in under 30 seconds?
That's exactly what Web-Check does. Built by developer Alicia Sykes (Lissy93), this open-source OSINT tool has quietly amassed over 34,200 GitHub stars and 2,800 forks, making it one of the most popular security tools in the open-source ecosystem. And after spending a few hours with it, I can tell you: those stars are earned.
The dashboard is a grid of interactive cards, each one a different dimension of the target website. Here's what you get when you punch in a domain:
Network Intelligence: IP address, server location (with map), ISP, autonomous system details, traceroute with hop-by-hop latency. This alone replaces three separate tools.
SSL/TLS Deep Dive: Full certificate chain, expiration dates, issuer details, supported cipher suites, protocol versions, forward secrecy assessment. It even simulates TLS handshakes with different client profiles to catch compatibility issues.
DNS Records: A, AAAA, MX, NS, CNAME, TXT, SOA, and CAA records — all rendered in a clean, sortable table. DNSSEC validation, DNS-over-HTTPS and DNS-over-TLS support detection included.
Security Posture: HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options), WAF detection, threat intelligence lookup against known malware/phishing databases, and security.txt validation.
Web Architecture: Technology stack fingerprinting (React, Next.js, WordPress, Nginx, Cloudflare — you name it), robots.txt analysis, sitemap extraction, Open Graph and Twitter card metadata, cookie inspection with Secure/HttpOnly/SameSite flags.
Performance & SEO: Lighthouse-powered quality metrics across performance, accessibility, best practices, and SEO. Plus: open ports scan, redirect chain visualization, associated hostnames, and even a carbon footprint estimate.
That's over 20 distinct analysis categories from a single input. For developers, it's like having a full security audit team and a network operations center condensed into one React app.
Web-Check is built with TypeScript and uses an interesting stack: the frontend leans on React with Svelte components where it makes sense, bundled through Astro and Vite. The backend is a Node.js API server that fires off parallel requests to gather data from multiple sources simultaneously — DNS resolvers, WHOIS servers, SSL handshake endpoints, geolocation databases, Shodan, and more.
The architecture is refreshingly straightforward:
User enters URL → Frontend calls parallel API endpoints → Each endpoint handles one check → Results stream back → Dashboard renders cards
What makes this design elegant is how each check is an independent module. You can extend it by adding new API endpoints without touching existing ones. The project structure is clean enough that a developer can navigate it in minutes — 646 commits spread across well-organized directories: api/, src/, public/, .github/.
Under the MIT license, it's truly free for any use — commercial, educational, self-hosted. No strings attached.
Here's what I appreciate most about Web-Check: it's privacy-respecting by design. Unlike commercial alternatives that funnel your domain queries through their cloud (and probably log them for analytics or, worse, sales intelligence), Web-Check processes everything locally when self-hosted. The data stays on your machine.
The security features aren't just for scanning other sites — they're invaluable for auditing your own deployments. One scan can tell you if you're missing critical security headers, if your SSL certificate is about to expire, if DNSSEC is properly configured, or if any ports are accidentally exposed. I've caught missing X-Content-Type-Options headers and weak TLS cipher suites on my own projects using Web-Check — issues that could have gone unnoticed for months.
For teams, the tool serves as an excellent pre-flight check before launching new services. Run a Web-Check scan as part of your deployment pipeline and flag regressions in security posture automatically.
Getting Web-Check running takes about two minutes:
Option 1: Netlify (Instant) Click the "Deploy to Netlify" button from the README. It provisions a live instance with zero configuration. Perfect for quick access.
Option 2: Docker (Recommended for Self-Hosting)
docker pull ghcr.io/lissy93/web-check:latest
# or use docker-compose
docker-compose up -d
You'll want to set a few API keys in your .env file for full functionality: Google Maps API key (for server location maps), Shodan API key (for threat intelligence), and WhoAPI key (for WHOIS lookups). Most features work without them, but the experience is richer with all keys configured.
Option 3: Build From Source
git clone https://github.com/lissy93/web-check.git
cd web-check
yarn install
yarn dev
Development server starts on localhost:5173. For production, yarn build && yarn start.
There's also a public live demo at web-check.as93.net if you want to try before deploying.
Web-Check isn't just a cool tool — it fills a genuine gap in every developer's workflow. Here's where it shines:
At 34.2k stars and growing, Web-Check has clearly struck a nerve. It's the kind of tool that makes you wonder: "Why didn't I have this years ago?" Alicia Sykes has built something genuinely useful — the kind of open-source project that becomes part of your daily toolkit and stays there.
Go give it a star, deploy your own instance, and start scanning. Your next security blind spot might be one domain name away from discovery.