Web-Check

Comprehensive, on-demand open source intelligence for any website
🌐 web-check.xyz

Kindly supported by:

NinjaPear API to get a full B2B profiles from any URL

Hostinger Deploy Web-Check with one click on Hostinger

Warp Built for coding with multiple AI agents

Contents

• About

• Usage

• Community

• License

About

Get an insight into the inner-workings of a given website: uncover potential attack vectors, analyse server architecture, view security configurations, and learn what technologies a site is using.

The aim is to help you easily understand, optimize and secure your website.

Screenshot

A hosted version can be accessed at: web-check.as93.net

Mirror

The source for this repo is mirrored to CodeBerg, available at: codeberg.org/alicia/web-check

Status

Build & Deploys:
Repo Management & Miscellaneous:

See web-check.xyz/about for the full list of checks, and what each one does

Usage

Deploying - Option #1: Netlify

Click the button below, to deploy to Netlify 👇

Deploying - Option #4: Render

Click the button below, to deploy to Render 👇

Run docker run -p 3000:3000 lissy93/web-check, then open localhost:3000

Deploying - Option #6: From Source

Install the prerequisites listed in the Developing section, then run:

git clone https://github.com/Lissy93/web-check.git  # Download the code from GitHub
cd web-check                                        # Navigate into the project dir
yarn install                                        # Install the NPM dependencies
yarn build                                          # Build the app for production
yarn start                                          # Start the app (API and GUI)

Configuring

By default, no configuration is needed.

But there are some optional environmental variables that you can set to give you access to some additional checks, or to increase rate-limits for some checks that use external APIs.

API Keys & Credentials:

| Key | Value | | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | GOOGLE_CLOUD_API_KEY | A Google API key with the PageSpeed Insights and Safe Browsing APIs enabled (get here). Runs the quality and Safe Browsing checks | | SHODAN_API_KEY | A Shodan API key (get here). Runs the host names, server info and vulnerabilities checks | | CLOUDMERSIVE_API_KEY | A Cloudmersive API key (get here). Adds the Cloudmersive website scan to the threats check | | TRANCO_API_KEY | A Tranco API key (get here). Raises the Tranco rate limit for the rank check | | TRANCO_USERNAME | Your Tranco account email, used with the key above | | GITHUB_TOKEN | A GitHub token (get here). Raises the GitHub rate limit for the social presence check | | CERTSPOTTER_TOKEN | A CertSpotter API token (get here). Raises the CertSpotter rate limit for the subdomains check |

Configuration Settings:

| Key | Value | | -------------------------- | -------------------------------------------------------------------------- | | PORT | Port to serve the API, when running server.js (e.g. 3000) | | API_ENABLE_RATE_LIMIT | Enable rate-limiting for the /api endpoints (e.g. true) | | PUBLIC_API_TIMEOUT_LIMIT | The timeout limit for API requests, in milliseconds (e.g. 25000) | | API_CORS_ORIGIN | Enable CORS, by setting your allowed hostname(s) here (e.g. example.com) | | API_DISABLED_CHECKS | Comma-separated list of checks to disable (e.g. trace-route,ports) | | API_ENABLED_CHECKS | If set, only these checks will run (e.g. get-ip,ssl,dns,headers) | | API_BLOCKED_HOSTS | Hosts that must never be scanned (e.g. lan.example.com,192.168.0.0/16) | | CHROME_PATH | The path the Chromium executable (e.g. /usr/bin/chromium) | | DISABLE_GUI | Disable the GUI, and only serve the API (e.g. false) | | PUBLIC_API_ENDPOINT | The endpoint for the API, either local or remote (e.g. /api) |

All values are optional.

You can add these as environmental variables. Either put them directly into an .env file in the projects root, or via the Netlify / Vercel UI, or by passing to the Docker container with the --env flag, or using your own environmental variable management system

Note that values prefixed with PUBLIC_ are read by the frontend at build time, so you need to rebuild after changing them

Developing

1. Clone the repo, git clone [email protected]:Lissy93/web-check.git
2. Cd into it, cd web-check
3. Install dependencies: yarn
4. Start the dev server, with yarn dev

Community

Contributing

Contributions of any kind are very welcome, and would be much appreciated. For Code of Conduct, see Contributor Covenant.

To get started, fork the repo, make your changes, add, commit and push the code, then come back here to open a pull request. If you're new to GitHub or open source, this guide or the git docs may help you get started, but feel free to reach out if you need any support.

Huge thanks to these wonderful people, who sponsor me on GitHub, their support helps cover the costs required to keep Web-Check and my other projects free for everyone. Consider joining them, by sponsoring me on GitHub if you're able.

_Lissy93/Web-Check is licensed under MIT © Alicia Sykes 2023 - 2026._

^{For information, see TLDR Legal > MIT}

The MIT License (MIT)
Copyright (c) Alicia Sykes <[email protected]>
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sub-license, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished
to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANT ABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NON INFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

© Alicia Sykes 2026
Licensed under MIT

^{Thanks for visiting :)}