---
title: 3 a.m., no browser, one curl: WatchFor in your terminal
description: Ping, DNS, TLS grades, CDN cache checks and a full website audit from your terminal: curl https://watchfor.io. When to reach for it, and why there's coffee.
canonical: https://watchfor.io/blog/watchfor-in-your-terminal
---

# 3 a.m., no browser, one curl: WatchFor in your terminal

2026-10-19 · WatchFor Team · Networking · networking, devops, cli, dns, ssl, email

Ping, DNS, TLS grades, CDN cache checks and a full website audit from your terminal: curl https://watchfor.io. When to reach for it, and why there's coffee.

It is 3:12 in the morning. Your phone says the checkout is down. You are
already SSH'd into the box that serves it, the logs look fine, and the
question you actually need answered is not *what does this server think* but
*what does the rest of the internet see*.

The tools for that question live in a browser. The browser lives on a laptop
in the other room. And the terminal you have open right now can't render a
dashboard, but it has had `curl` for decades.

So we put our free tools there:

```bash
curl https://watchfor.io/tls/checkout.example.com
```

Ten seconds later you know the certificate was renewed at midnight with the
wrong hostname on it. You go back to bed an hour earlier than you would
have.

That is the whole idea. The rest of this post is what it can do, when it is
worth reaching for, and one joke we couldn't resist.

## The tradition

None of this is a new trick. [wttr.in](https://wttr.in) put the weather in
the terminal, `ifconfig.me` made "what is my IP" a one-liner, and
[dns.toys](https://www.dns.toys) turned DNS itself into a toy box of
utilities. We love these tools because they respect the most valuable thing
an engineer has during an incident: the context they are already in.

WatchFor's version answers with the same probe fleet that runs our
monitoring, from the location nearest you, with the same free tools and the
same anonymous limits as [the website](/free-tools). No signup, no install,
no API key.

## One URL scheme

Every command has the same shape:

```bash
curl https://watchfor.io/<command>/<target>
```

`curl https://watchfor.io` prints the help with every command and an example
you can paste straight away. `curl https://watchfor.io/<command>` explains one
command.

![curl https://watchfor.io/tls/github.com — an A+ grade with protocols, certificate details and HSTS in one screen](/blog/watchfor-in-your-terminal-tls.webp)

## When to reach for it

### Something is down and you need the outside view

Your server can reach itself. That proves very little. Ask from somewhere
else:

```bash
curl https://watchfor.io/ping/203.0.113.10        # does it answer at all?
curl https://watchfor.io/tcp/shop.example.com:443  # is the port open?
curl https://watchfor.io/mtr/shop.example.com      # where on the path does it die?
```

`mtr` is the one people underrate. When "the site is slow for some
customers", a hop-by-hop path with loss per hop turns an argument into a
screenshot you can send to your provider.

![curl https://watchfor.io/mtr/1.1.1.1 — six hops, loss and latency per hop](/blog/watchfor-in-your-terminal-mtr.webp)

If you'd rather see everything at once, `audit` runs the
[Smart Website Audit](/smart-website-audit) and fits the whole verdict on
one screen: domain, HTTPS, certificate, DNS and email, each with a pass,
warning or fail:

```bash
curl https://watchfor.io/audit/shop.example.com   # also: site/…, check/…
```

### After a CDN rollout or a cache-rule change

This is the one we are proudest of. A CDN that quietly stops caching looks
perfectly healthy from your laptop: one request, one `200`, done. It takes
many locations asking the same URL a few times each to see what your
visitors actually get:

```bash
curl https://watchfor.io/cdn/www.cloudflare.com
```

![curl https://watchfor.io/cdn/www.cloudflare.com — grade A+, 20 of 20 locations, 95% cache hits, and every edge with its HIT or MISS and time to first byte](/blog/watchfor-in-your-terminal-cdn.webp)

*Twenty locations, three requests each: which edge served it, whether it was
a cache HIT, and how long the first byte took. Run it after you change cache
rules, move a path behind the CDN or add a `Set-Cookie` header somewhere it
doesn't belong.*

Why that last one matters is the whole story of
[why your CDN stopped caching](/blog/why-your-cdn-stopped-caching).

### Before a certificate renewal, not after it

```bash
curl https://watchfor.io/ssl/example.com   # chain, hostnames, days left
curl https://watchfor.io/tls/example.com   # A+ … F, and what caps the grade
```

With certificate lifetimes heading towards
[47 days](/blog/47-day-ssl-certificates), "when does it expire" stops being a
yearly question.

### Right after a DNS change

You changed a record and someone asks if it is live yet. "It depends on the
TTL" is true and unhelpful:

```bash
curl https://watchfor.io/dns/example.com
curl https://watchfor.io/propagation/example.com   # the same answer worldwide?
curl https://watchfor.io/mx/example.com
```

![curl https://watchfor.io/propagation/github.com — the same DNS answer checked from 20 locations around the world](/blog/watchfor-in-your-terminal-propagation.webp)

*Every location asks for the record on its own, so a stale answer somewhere
shows up as the odd one out.*

More on why "propagation" is mostly caching in
[DNS propagation myths](/blog/dns-propagation-myths).

### When your mail lands in spam

Nine times out of ten it's authentication:

```bash
curl https://watchfor.io/email/example.com   # SPF + DMARC in one grade
curl https://watchfor.io/spf/example.com     # lookups counted against the limit of 10
curl "https://watchfor.io/dkim/example.com?selector=google"
```

![curl https://watchfor.io/email/github.com — grade A with SPF, DMARC and what caps the grade](/blog/watchfor-in-your-terminal-email.webp)

The [why emails go to spam](/blog/why-emails-go-to-spam) post explains what
each of those records actually promises.

### The 3 a.m. maths

The calculators are there because nobody should do subnet maths while
paged:

```bash
curl https://watchfor.io/subnet/10.0.0.0/22
curl "https://watchfor.io/cron/*/15_*_*_*_1-5"  # quoted: * is a shell glob; _ = space
curl https://watchfor.io/chmod/640
curl https://watchfor.io/uptime/99.95           # what your SLA actually allows
```

## In scripts and CI

The same URLs have modes for machines:

- `?json` returns the full result with honest HTTP status codes: `200` when
  the check passed, `422` when it found a problem, `429` when you hit a
  limit.
- `?plain` drops the colour for logs; `wget` gets plain text automatically.
- `/ip` prints your public IP and nothing else.

```bash
# Fail the pipeline when the certificate check fails
curl -fsS "https://watchfor.io/ssl/example.com?json" >/dev/null

# Your public IP, for an allow-list or a log line
MY_IP=$(curl -s https://watchfor.io/ip)
```

One honest caveat: these are free tools with anonymous limits (around 60
checks an hour per IP). For production monitoring that runs every minute
and pages you, use a monitor or the REST API, which have keys, higher
limits and alerting.

## Why every example says https://

You might wonder why we don't just write `curl watchfor.io/ping/1.1.1.1`.
Plain `http://` gets a redirect to HTTPS, and `curl` doesn't follow
redirects unless you add `-L`. And `-L` would still send that first request
unencrypted, which means anyone on the network between you and us could
answer it instead. A monitoring company teaching people to trust
unencrypted answers would be a strange look. So: `https://`, every time.

## The fun part

At some point during building this, someone asked for coffee.

```bash
curl https://watchfor.io/coffee
```

![curl https://watchfor.io/coffee — an ASCII teapot and HTTP 418 I'm a teapot](/blog/watchfor-in-your-terminal-coffee.webp)

HTTP status `418 I'm a teapot` comes from
[RFC 2324](https://www.rfc-editor.org/rfc/rfc2324), the Hyper Text Coffee Pot
Control Protocol, published on 1 April 1998. We implemented it faithfully: we
cannot brew coffee. `tea`, `teapot` and `brew` give the same answer, because
we checked.

There are a few more. We'll let you find them.

## Fair use

The terminal runs real checks from real servers, so the rules are the same
as on the website: only check systems you own or are allowed to test, and
don't use it to scan or load-test anyone else's. Every run is logged with the
time, your IP address, the tool and the target, so misuse can be traced, and
abusive addresses are blocked. The full rules are in section 12 of our
[Terms of Service](/legal/terms).

## Try it

```bash
curl https://watchfor.io
```

Every command, with examples to copy, is also on the
[terminal page](/terminal). And when one of those 3 a.m. checks turns out to
be something you want watched every minute from twenty locations, that is
what the rest of WatchFor is for.

---

Canonical page: https://watchfor.io/blog/watchfor-in-your-terminal · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt