Free tools · Security · no sign-up

DNS & email security check

Enter a domain; A/AAAA/CNAME/NS/MX/TXT/CAA records plus SPF, DMARC, MTA-STS, DKIM and DNSSEC evaluated with fixes.

How to read it

SPF: who may send mail for your domain. Should end in -all (hard) or ~all (soft); +all allows everyone. More than 10 DNS lookups make the record invalid.
DMARC: what to do when SPF/DKIM fail: p=none only monitors; quarantine and reject protect. Cloudflare → Email → DMARC Management is a free way to receive rua= reports.
DKIM: Common selectors plus those of the provider recognised from SPF/MX are tried (e.g. Hostinger: hostingermail-a/b/c, Zoho, Fastmail, Proton, iCloud). Not found does not mean missing; your provider may use another selector.
MTA-STS: forces inbound mail to arrive over TLS; recommended when you have MX records.
DNSSEC: whether DNS answers were validated as signed (resolver's AD flag). Cloudflare → DNS → Settings → DNSSEC.
CAA: which certificate authorities may issue certificates; without it, any CA can.

Other tools (15)

AI visibility

llms.txt generator

Describe your site once; get a valid llms.txt to put at your root so AI assistants know what you are and where to look.

AI crawler check

Enter a domain; see which of 200+ AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended…) your robots.txt allows or blocks, and if you have an llms.txt.

AI bot blocker generator

Pick the AI bots to block; get the robots.txt block, a Cloudflare WAF expression, nginx, Caddy and .htaccess rules ready to paste.

How AI sees your page

Enter a URL; see the page as an AI assistant reads it: clean Markdown, heading tree, word count, links and images without alt text.

SEO

Meta tag & social preview

Enter a URL; check title, description, canonical, robots, hreflang and Open Graph, and preview the Google, X, LinkedIn and WhatsApp cards.

Structured data check

Enter a URL; every JSON-LD block is parsed, flattened and checked for the required and recommended fields of its @type.

Redirect chain check

Enter a URL; follow every hop, catch loops, 302s that should be 301s, missing http→https and www inconsistencies.

robots.txt & sitemap check

Enter a domain; robots.txt syntax is checked and every sitemap is fetched: URL counts, lastmod coverage, size limits and broken XML.

IndexNow key check

Enter a domain and key; we fetch the key file the way Bing does and tell you exactly what is wrong if it fails. Or generate a new key.

SERP snippet preview

Type a title, description and URL; see the Google desktop and mobile snippet with pixel widths and truncation warnings.

Security

Security headers check

Enter a domain; HTTPS redirect, HSTS, CSP, clickjacking, nosniff, referrer policy, exposed .env/.git files, security.txt, SPF and DMARC, each with a fix.

Infrastructure

HTTP response check

Enter a URL; status, response time, server, Cloudflare and cache status, compression, HSTS and HTTP/3 in one table with plain-language notes.

Page weight analyzer

Enter a URL; count scripts, styles, images and preloads, find render-blocking resources and measure the first 30 by size.

Domain info (RDAP)

Enter a domain; registrar, creation and expiry dates, days left, status codes explained, name servers and DNSSEC from the registry's RDAP.

Content

Readability analyzer

Paste text; words, sentences, syllables, average sentence length, Flesch Reading Ease (EN) or Ateşman (TR), and the most frequent words.

Have this run every week, automatically

The seops Cloudflare security and usage module schedules this check for every site you run and tells you when something changes. One site is free.

무료로 시작 · 카드 불필요 라이브 데모 열기 →