---
title: Free tools
description: 64 free public tools for one-off DNS, network, web, SSL/TLS, email and performance checks — no account needed — and which monitor type each one turns into.
canonical: https://watchfor.io/docs/tools
---

# Free tools

64 free public tools for one-off DNS, network, web, SSL/TLS, email and performance checks — no account needed — and which monitor type each one turns into.

Alongside continuous monitoring, WatchFor offers a toolbox of **64 free public
tools** for quick, one-off checks — no sign-up required. Use them to diagnose
something right now, or to try a check before turning it into a monitor. The
same toolbox is available inside the dashboard under **Toolbox**, where runs
use your plan's higher limits.

Browse them all on the [free tools hub](/free-tools).

## How they work

- Checks that need a network vantage point (ping, traceroute, port, DNS, SSL,
  HTTP…) run from a real WatchFor [probe location](/docs/reference/probe-locations)
  — the same fleet that runs your monitors — normally the one nearest to you.
  On paid plans you can pick the location. DNS propagation fans out to every
  region at once.
- **Calculators** run entirely in your browser; nothing is uploaded.
- **Limits** are per tool, with a combined cap for anonymous use. Signing in
  gives you your plan's limits, which are higher — see [pricing](/pricing).
  That per-tool plan allowance is **shared with the API**: 25 of the
  fleet-backed tools are also [live diagnostics](/docs/api/diagnostics) over
  REST, MCP and A2A, and a run there spends the same slot as a run here. The
  API adds one more, `dns-health`, the DNS health grade this site shows on
  DNS Propagation (it spends that tool's allowance), and every graded check
  returns the same WatchFor Grade as the page.
- Several tools also have **focused landing pages** — one record type, one
  question — that run the same engine with a preset: the DNS record lookups
  (A, AAAA, CNAME, MX, NS, TXT, SOA, SRV, CAA, reverse/PTR), SSL expiry,
  TLS versions, security headers, HSTS, HTTP status, domain expiry, sitemap
  validation, gzip, and the crontab / epoch / CIDR / SLA calculators. They
  share their parent's allowance and are listed under it in the hub.
- Most tools produce a **shareable link** that re-runs the check with the same
  input, and some offer a downloadable map or image of the result.

## Grades

Eleven tools end in a **WatchFor Grade**: one A+ to F scale and one method,
explained on [/grades](/grades).

- A grade starts at **A+** and every finding can only **cap** it — the worst
  finding sets the letter, and nothing adds points back.
- The findings are listed under the letter, worst first, each with what it
  means and the exact fix (for security headers, a ready-to-paste line for
  nginx, Apache, Caddy and Cloudflare).
- Every grade names its **rules version** (for example `headers-2026.10`), shown on
  the result and on the tool page next to the full rule table.
- If we could not measure — the server did not answer from our locations, the
  run timed out, the location lacks the capability — there is **no grade**,
  never an F.

Graded tools: [SSL/TLS Grade](/ssl-grade-checker),
[Security Headers Checker](/security-headers-checker),
[Mail Server Checker](/mail-server-checker),
[Core Web Vitals Checker](/core-web-vitals-checker),
[CDN Checker](/cdn-checker), [Email Health](/email-policy-checker),
[DNS Health Checker](/dns-health-checker),
[MCP Server Checker](/mcp-server-checker),
[PHP Version Checker](/php-version-checker),
[Software Exposure Checker](/software-exposure-checker) and the
[Smart Website Checker](/smart-website-audit). The Smart Website Checker and
the CDN Checker are composite grades: weighted sections add up to a score, and
a serious finding still caps it ([audit rubric](/docs/reference/audit-grade)).
On the SSL/TLS grade, a certificate browsers do not trust is an **F**,
labelled "Not trusted". Over the API, MCP and A2A every graded check returns
the same grade as a `grade` object ([live diagnostics](/docs/api/diagnostics#watchfor-grades-in-the-result)).

## All-in-one

| Tool | What it does | Continuous version |
| --- | --- | --- |
| [Smart Website Checker](/smart-website-audit) | A combined audit of a site — uptime, performance, security, reputation and configuration in one run, ending in a letter grade ([rubric](/docs/reference/audit-grade)). | Several [monitor types](/docs/monitors) |

## Performance

| Tool | What it does | Continuous version |
| --- | --- | --- |
| [Core Web Vitals Checker](/core-web-vitals-checker) | Real-browser Core Web Vitals (LCP, CLS, TBT, TTFB) and the Lighthouse score, ending in a [performance grade](/grades#core-web-vitals) A+ to F. Lab data from one run, not Google's field data. | [Core Web Vitals monitor](/docs/monitors/performance#core-web-vitals-browser) |

## DNS

| Tool | What it does | Continuous version |
| --- | --- | --- |
| [DNS Lookup](/dns-checker) | Resolve a name and inspect its records, against the probe's own resolver, a listed public resolver or any public IP. TTLs are shown for SOA, CAA, SRV, PTR, TLSA, HTTPS and SVCB records. | [DNS monitor](/docs/monitors/network#dns) |
| [DNS Health Checker](/dns-health-checker) | A [DNS health grade](/grades#dns-health) A+ to F for the zone: nameservers and their networks, lame delegation, parent/child agreement, SOA, DNSSEC and CAA, each finding with its fix, then what every location answers. Same check and allowance as DNS Propagation, opened on the grade. | [DNS monitor](/docs/monitors/network#dns) |
| [DNS Propagation](/dns-propagation-checker) | How a record has propagated across resolvers worldwide, on a map, with the same DNS health grade above it. | [DNS monitor](/docs/monitors/network#dns) |
| [Whois Lookup](/whois-lookup) | Registration, registrar and expiry details for a domain (RDAP). | [Domain expiry monitor](/docs/monitors/certificates#domain-expiry) |
| [Domain Expiry Checker](/domain-expiry-checker) | Days until a domain expires, straight from the registry, with the status flags that say whether it can still be renewed. | [Domain expiry monitor](/docs/monitors/certificates#domain-expiry) |
| Record lookups: [A](/a-record-lookup) · [AAAA](/aaaa-record-lookup) · [CNAME](/cname-lookup) · [MX](/mx-lookup) · [NS](/ns-lookup) · [TXT](/txt-record-lookup) · [SOA](/soa-record-lookup) · [SRV](/srv-record-lookup) · [CAA](/caa-record-lookup) · [Reverse DNS](/reverse-dns-lookup) | The DNS Lookup engine opened on one record type, with a page about that record. | [DNS monitor](/docs/monitors/network#dns) |

## Network

| Tool | What it does | Continuous version |
| --- | --- | --- |
| [Ping](/ping-test) | Reachability and round-trip time to a host. | [Ping monitor](/docs/monitors/network#ping-icmp) |
| [Traceroute](/traceroute-online) | The hop-by-hop path packets take, with per-hop latency and loss. | [Network path (MTR) monitor](/docs/monitors/network#network-path-mtr) |
| [Port Checker](/port-checker) | Whether a TCP port is open and accepting connections. | [TCP monitor](/docs/monitors/network#tcp) |
| [Blacklist Check](/blacklist-checker) | Whether an IPv4 address is listed on Spamhaus ZEN, SpamCop or Barracuda (a domain is checked through the address it resolves to). | [Blacklist monitor](/docs/monitors/security#blacklist-rbl) |
| [What Is My IP](/whats-my-ip) | Your public IPv4 and IPv6, geolocation, ASN and reverse DNS. | — |
| [IP Address Lookup](/ip-lookup) | Any IP's ASN and network, BGP prefix, registry country and reverse DNS — answered from public routing data, no connection to the address. | — |
| [NTP Server Test](/ntp-test) | Query a time server: stratum, clock offset and delay per sample, leap indicator, version. | [NTP monitor](/docs/monitors/performance#ntp) |

## Web

| Tool | What it does | Continuous version |
| --- | --- | --- |
| [Software Exposure Checker](/software-exposure-checker) | Read the software versions a page reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries from their script URLs — and grade them A+ to F: what you reveal, what is outdated or past end of life, and which known CVEs (NVD, retire.js, CISA's exploited list) may apply, with the config that hides each version ([software exposure grade](/grades#software-exposure)). One plain GET; distribution builds are capped at C with a verify note. | — |
| [PHP Version Checker](/php-version-checker) | Read the PHP version a site announces in `X-Powered-By` or `Server` and grade it A+ to F against php2shell (CVE-2026-109618, CVE-2026-109619), known CVEs, CISA's exploited list and the branch's end of life, with the exact version to install ([PHP version grade](/grades#php-version)). Plain GET requests only; a hidden version is not graded. | — |
| [MCP Server Checker](/mcp-server-checker) | Test a Model Context Protocol server: handshake, protocol version, capabilities and tool inventory, ending in an [MCP server grade](/grades#mcp-server) A+ to F. Open servers are not penalised for being open. | [MCP server monitor](/docs/monitors/mcp) |
| [SSL Certificate Check](/ssl-checker) | Whether the certificate verifies (name, trust, dates), its issuer, SANs and days until expiry — or, when the handshake fails, the reason. | [SSL / TLS monitor](/docs/monitors/certificates#ssl--tls-certificate) |
| [SSL/TLS Grade](/ssl-grade-checker) | Grade a server's TLS configuration A+ to F — protocols, ciphers, forward secrecy, post-quantum readiness, HSTS and certificate — with the exact reasons. | [SSL / TLS monitor](/docs/monitors/certificates#ssl--tls-certificate) with the grade option |
| [HTTP Headers](/http-header-checker) | Inspect the response headers a URL returns. | [Website monitor](/docs/monitors/web) |
| [Security Headers Checker](/security-headers-checker) | Audit HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy and cookie flags, ending in a [security headers grade](/grades#security-headers) A+ to F with a fix for nginx, Apache, Caddy and Cloudflare under each finding. | [Website monitor](/docs/monitors/web) |
| [HSTS Checker](/hsts-checker) | Strict-Transport-Security max-age, includeSubDomains, preload — and whether the site qualifies for the browser preload list. | [Website monitor](/docs/monitors/web) |
| [HTTP Status Checker](/http-status-checker) | The status code a URL returns from a real probe location, with timing and headers. | [Website monitor](/docs/monitors/web) |
| [Redirect Checker](/redirect-checker) | Follow every redirect hop — status, Location, timing — to the final URL, with loops, downgrades and temporary redirects flagged. | [Website monitor](/docs/monitors/web) |
| [WebSocket Tester](/websocket-tester) | Open a ws:// or wss:// connection: handshake time, ping/pong, and an optional message, with the first message the server sends matched against a pattern. | [WebSocket monitor](/docs/monitors/performance#websocket) |
| [SSL Expiry Checker](/ssl-expiry-checker) | Days until the certificate a host serves expires, with issuer and chain trust. | [SSL / TLS monitor](/docs/monitors/certificates#ssl--tls-certificate) |
| [TLS Version Checker](/tls-version-checker) | Which protocol versions a server accepts (SSL 3.0 to TLS 1.3), the cipher it negotiates and any weak suites it still accepts, graded. | [SSL / TLS monitor](/docs/monitors/certificates#ssl--tls-certificate) with the grade option |
| [API Tester](/api-tester) | Send a one-off HTTP request (any method, headers, body) and inspect status, headers and body. | [API monitor](/docs/monitors/api) |
| [CDN Checker](/cdn-checker) | Global CDN analysis: provider (60+ recognised), edge per region, cache behaviour and a health grade. | [CDN monitor](/docs/monitors/performance#cdn) |
| [Sitemap Checker](/sitemap-checker) | Validate that `sitemap.xml` is present and well-formed. | [Sitemap monitor](/docs/monitors/performance#sitemap) |
| [Sitemap Validator](/sitemap-validator) | The same check, framed around validity: location, XML format, URL count and a sample fetch for broken entries. | [Sitemap monitor](/docs/monitors/performance#sitemap) |
| [Brotli Checker](/brotli-checker) | Whether responses are served with Brotli compression. | [Brotli monitor](/docs/monitors/performance#brotli-compression) |
| [Gzip Compression Test](/gzip-test) | Whether a site serves gzip, and Brotli: the `Content-Encoding` it returns to a request offering only gzip, and to one offering only Brotli. It doesn't measure sizes; the page shows the curl commands for that. | [Brotli monitor](/docs/monitors/performance#brotli-compression) |

## Email

| Tool | What it does | Continuous version |
| --- | --- | --- |
| [Email Health](/email-policy-checker) | SPF and DMARC for a domain in one view, with an [Email Health grade](/grades#email-health) A+ to F. DKIM needs a selector, so check it with the DKIM Checker. | [Email policy monitor](/docs/monitors/email#email-policy-spf--dmarc--dkim) |
| [SPF Checker](/spf-record-checker) | A domain's SPF record, its policy and a count of the lookups the record itself makes (includes are counted, not followed). | [Email policy monitor](/docs/monitors/email#email-policy-spf--dmarc--dkim) |
| [DKIM Checker](/dkim-record-checker) | A domain's DKIM key for a selector: the record, key type, key size, and whether it is live or revoked. | [Email policy monitor](/docs/monitors/email#email-policy-spf--dmarc--dkim) |
| [DMARC Checker](/dmarc-record-checker) | Check a domain's DMARC policy and alignment settings. | [Email policy monitor](/docs/monitors/email#email-policy-spf--dmarc--dkim) |
| [Email Header Analyzer](/email-header-analyzer) | Paste raw headers: delivery path with per-hop delays, SPF/DKIM/DMARC verdicts and alignment — analyzed in your browser. | — |
| [SPF & DMARC Generator](/spf-dmarc-generator) | Build ready-to-publish SPF and DMARC records with provider presets and a lookup counter. | — |
| [SMTP Server Test](/smtp-test) | Open a real SMTP session on port 25, 465 or 587: banner, STARTTLS, reverse DNS match and an open-relay probe. No message is sent. | [SMTP monitor](/docs/monitors/email#smtp) |
| [Mail Server Checker](/mail-server-checker) | Enter a domain: its MX, SMTP submission, IMAP and POP3 servers are found and each graded A+ to F — TLS versions and ciphers, certificate, STARTTLS, plain-text login, open relay, reverse DNS, MTA-STS, TLS-RPT and DANE — with reachability from three regions. No login, no message sent. | [IMAP](/docs/monitors/imap#mail-server-grade), [POP3](/docs/monitors/pop3#mail-server-grade) and [SMTP](/docs/monitors/email#smtp) monitors |

## Calculators

Everything here runs client-side in your browser.

| Tool | What it does | Related |
| --- | --- | --- |
| [Uptime / Downtime Calculator](/uptime-calculator) | Turn an uptime percentage (99.9%…) into allowed downtime per day, month and year. | [Reports](/docs/reports) |
| [Error Budget Calculator](/error-budget-calculator) | SLO error budgets, burn rates and exhaustion projections. | [Glossary: SLO](/docs/reference/glossary) |
| [Cron Expression Tester](/cron-expression-tester) | Explain any cron expression and preview its next runs in your timezone. The tester also accepts `@daily`-style aliases and `7` for Sunday; cron job monitors don't. | [Cron job monitor](/docs/monitors/heartbeat) |
| [JSON Formatter & JSONPath](/json-formatter) | Format, validate and query JSON with JSONPath. API monitor assertions use dot paths (`checks.0.name`), not brackets or `..`. | [API monitor assertions](/docs/monitors/api) |
| [Timestamp Converter](/unix-timestamp-converter) | Unix epoch to human dates and back; seconds and milliseconds auto-detected. | — |
| [Subnet Calculator](/subnet-calculator) | IPv4 CIDR math: masks, ranges, binary breakdowns and subnet splitting. | — |
| [IPv6 Subnet Calculator](/ipv6-subnet-calculator) | 128-bit prefixes, address counts, `ip6.arpa` and address classification. | — |
| [Bandwidth Calculator](/bandwidth-calculator) | Transfer times for any size and speed, or the bandwidth a deadline needs. | — |
| [Chmod Calculator](/chmod-calculator) | Unix permissions: rwx checkboxes to octal, symbolic and the `chmod` command. | — |
| Landings: [Crontab Generator](/crontab-generator) · [Epoch Converter](/epoch-converter) · [CIDR Calculator](/cidr-calculator) · [SLA Calculator](/sla-calculator) | The cron, timestamp, subnet and uptime calculators opened for those questions, each with its own introduction and FAQ. | — |

> **Info**
>
> Like a tool? Every "continuous version" above is a [monitor type](/docs/monitors)
> — turn a one-off check into continuous monitoring with alerting, incidents
> and a status page in a couple of clicks. AI agents can run these same
> checks on demand through
> [live diagnostics](/docs/api/diagnostics) over the
> [REST API and MCP server](/docs/api).

---

Canonical page: https://watchfor.io/docs/tools · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt