A Free Website and Security Check-Up Kit: 15 Tools for Site Owners and IT Teams

By Muhammad Wasim, Software Engineer and developer of ToolSphare

Websites rarely fail dramatically. More often, something small goes wrong quietly: an SSL certificate expires over a weekend, a DNS change never propagates, a redirect loop breaks the checkout, or an email domain without proper records starts landing in spam. Small businesses and solo developers usually find out when a customer complains.

A regular check-up prevents most of this, and it does not need expensive monitoring software. Below is the free kit I use, built into ToolSphare. Every tool runs in the browser, and none needs a sign-up.

Part 1: Domain and DNS

WHOIS Domain Lookup

Start with the domain itself. The WHOIS lookup runs real-time WHOIS and RDAP queries to show the registrar, expiry date, domain age and status. Domain expiry is one of the most avoidable outages, so note the date somewhere you will see it.

DNS Record Lookup and Propagation Checker

After changing hosting or email providers, use the DNS lookup checker to inspect A, AAAA, MX, CNAME, TXT, NS and SOA records. It queries public DNS-over-HTTPS resolvers, which helps confirm whether a change is visible.

Domain Age Checker

When evaluating a domain to buy or a site to partner with, the domain age checker summarises registration dates, registrar, DNS, SSL and other website details in one report.

Part 2: HTTPS and HTTP behaviour

SSL Certificate Checker

The SSL certificate checker shows certificate health, days until expiry, the issuing certificate authority and handshake details. Free certificates such as Let's Encrypt renew automatically only if renewal is configured correctly, so this is worth checking monthly.

HTTP Status and Redirect Chain Checker

Redirect chains slow pages down and can confuse search engines. The HTTP status checker shows response codes such as 200, 301, 404 and 500, along with headers and each hop in the redirect chain.

HTTP Security Headers Checker

Security headers are a cheap, effective layer of protection. The security headers checker audits HSTS, Content-Security-Policy, X-Frame-Options and related headers so you can see what is missing.

Part 3: Email authentication

DMARC and SPF Record Generator

If your domain has no SPF or DMARC records, attackers can more easily spoof emails from it, and legitimate mail is more likely to land in spam. The DMARC and SPF generator creates and validates the DNS TXT records you need. Start with a monitoring policy and tighten it once reports look clean.

Part 4: Passwords, keys and secrets

Password Generator

Weak and reused passwords remain one of the most common ways accounts get compromised. Use the strong password generator to create random passwords with your chosen length and character sets, and store them in a password manager.

Password Strength Checker

To test an existing password without sending it anywhere, the password strength checker runs locally in the browser.

TOTP 2FA Code Generator

For developers testing two-factor authentication, the TOTP generator produces time-based codes from a Base32 secret in the browser. Use it with test secrets, not your personal accounts.

RSA Key Pair Generator

The RSA key generator creates 2048-bit or 4096-bit public and private key pairs in standard PEM formats, useful for development and testing.

Bcrypt Hash Generator

When building a login system, the bcrypt generator creates and verifies bcrypt password hashes with a configurable cost factor, so you can check your application's hashing logic.

File Hash Generator

Before installing software or sharing a large file, compare its checksum. The file hash generator computes SHA-256, MD5, SHA-1 and SHA-512 hashes locally in your browser.

Part 5: Safe content

HTML Sanitizer

If you accept HTML from users (comments, rich-text fields, CMS imports), unsafe markup can carry scripts. The HTML sanitizer strips dangerous tags and event handlers with a live preview, helpful for testing what your own sanitisation should remove.

Text Encryptor

To share a short secret note with a colleague, the AES-256 text encryptor encrypts and decrypts text client-side with a passphrase you share separately.

A monthly 15-minute check-up

1. WHOIS: confirm the domain expiry date is comfortably far away.
2. SSL checker: confirm the certificate is valid and renewing.
3. DNS lookup: confirm MX, SPF and DMARC records are present.
4. Status checker: test the homepage and checkout for redirect chains or errors.
5. Security headers: compare against last month and fix anything new.

Record the results in a simple spreadsheet so you can spot changes over time.

Responsible use

These tools are for checking and protecting systems you own or are authorised to manage. Generate keys and test 2FA with test data, keep real secrets in proper secret managers, and never use any tool to access accounts or systems that are not yours.

Frequently asked questions

Do I need command-line skills to use these tools?
No. They give you the same kind of information as tools like dig, whois and openssl, but in a simple web form.

How often should I run these checks?
Monthly is a sensible baseline for small sites, plus an immediate check after any hosting, DNS or certificate change.

Is it safe to generate keys in a browser?
For development and testing, yes. For production keys that protect real systems, follow your organisation's key-management policy and generate keys in controlled environments.

About ToolSphare

I am Muhammad Wasim, a software engineer with MindSphare IT in Pakistan. ToolSphare is a free, no-sign-up toolbox that I build and run on my own server infrastructure, and I use these exact tools to monitor it. Suggestions are welcome at [email protected].

Explore all the security and webmaster tools at ToolSphare.