Every check, explained

Web Check runs 40 checks across 7 categories. Each one is documented below: what it looks at, why it matters, and the standards behind it.

Web Check gathers the data. Interpreting it is still your job.

All checks

IP Info
The IP address the domain currently resolves to
SSL Certificate
Certificate issuer, validity dates and the chain of trust
Server Security
DNS Records
A, AAAA, MX, NS, CNAME and other records held for the domain
Domain Email
Cookies
Cookies set on arrival, and how tightly each one is scoped
Security Privacy
Crawl Rules
The crawl rules the site publishes for search engine bots
SEO
Headers
Every HTTP response header the server sends back
Server Security
Quality Metrics
Lighthouse scores for performance, accessibility, SEO and best practice
SEO Performance
Server Location
Where in the world the server is physically hosted
Server
Associated Hosts
Other hostnames Shodan has seen on the same IP address
Server
Redirect Chain
The full chain of redirects before the final page loads
SEO Performance
TXT Records
TXT records, including domain verification and policy entries
Domain Email
Server Status
Whether the site is up, and how quickly it responded
Server Performance
Open Ports
Which common ports are open and reachable on the host
Server Security
Traceroute
The network path packets travel to reach the server
Server
Carbon Footprint
Estimated CO2 from the data needed to load the page
SEO Performance
Server Info
Operating system, ASN and the network the host sits on
Server
Vulnerabilities
CVEs Shodan links to the services running on the host
Server Security
Whois Lookup
Registrar, registration dates and nameservers, from WHOIS
Domain
Domain Info
Ownership and contact details published against the domain
Domain Privacy
DNSSEC
DNSSEC records proving DNS answers have not been tampered with
Security Domain
HSTS
Whether browsers are told to only ever connect over HTTPS
Security
DNS Server
Which nameservers answer for the domain, and whether they support DoH
Domain
Tech Stack
Frameworks, analytics and services the site is built with
Server Privacy
Sitemap
The pages a site lists in its own sitemap
SEO
Security.txt
The security.txt file, and who it says to contact about vulnerabilities
Security
Linked Pages
Internal and external links found in the page's anchor tags
SEO
Social Tags
Open Graph and Twitter tags used when the site is shared
SEO
Social Presence
Social accounts the site claims, and whether they link back
Security
Email Configuration
MX, SPF, DKIM and DMARC records for sending and receiving mail
Email
Firewall
Which web application firewall, if any, sits in front of the site
Server Security
HTTP Security
Protective headers such as CSP, X-Frame-Options and nosniff
Security
Archive History
How the site has changed over time, via the Wayback Machine
SEO
Global Ranking
Tranco rank, if the site is in the global top million
SEO
Block Detection
Whether privacy, malware and parental-control resolvers block the site
Security Email
Malware & Phishing
Whether the site appears on common malware and phishing lists
Security Privacy
TLS Connection
The version, cipher suite and details of a live TLS handshake
Server Security
TLS Security Audit
SSL Labs' grade for the server's TLS configuration
Security
TLS Client Compatibility
Whether Chrome, Safari, Java and older Android can still connect
Security
Screenshot
A full-page render of the site, as a browser sees it
SEO
Subdomains
Subdomains that have appeared in public Certificate Transparency logs
Domain