Web-Check

Give Web-Check one URL, and it collects what can be learned about that website from the outside and puts it on one page. It runs in the browser, so it is an easy way to start checking your own site’s settings.

This review is for people who manage a website for themselves or their company. After reading it, you can do the following:

• Check your site’s certificate, DNS, and security headers in one go
• Spot settings you forgot to configure
• Run Web-Check yourself to check internal sites

##What Web-Check is for

According to the official site, Web-Check runs 44 checks in 7 categories. These are the ones administrators look at most:

It also looks up vulnerabilities that Shodan links to the host, data breaches recorded by Have I Been Pwned, and whether the site is on common malware and phishing lists.

##Try it safely: check your own domain

1. Open web-check.xyz in your browser.
2. Enter a domain you manage and run the check.
3. Go through the result cards. Start with HSTS, HTTP Security, and Email Configuration. These three often reveal settings you forgot.

##Reading the results

##Run it yourself for internal sites

The hosted Web-Check checks sites from its operator’s servers. For URLs you don’t want to enter there, such as internal sites, run it in your own environment. With Docker, start it with this command and open http://localhost:3000:

docker run -p 3000:3000 lissy93/web-check

When you run it yourself, environment variables change how it behaves. For example, hosts listed in API_BLOCKED_HOSTS can’t be scanned, and API_DISABLED_CHECKS turns off specific checks such as ports or traceroute.

##Cautions

##Read next

• cd ../nmapNmaplook at open ports and services in detail
• cd ../zapZAPtest your own web app for vulnerabilities
• cat ~/guides/lab-setup.mdHow to set up a safe test lab