Everything WebInspect can tell you about a site, an API, or a network.
A field guide to the three inspectors and every report they produce — what each section means, how to read it, how to export it, and how your data is handled. No account, nothing stored, every scan runs fresh.
What WebInspect does
WebInspect analyzes any website, API or network endpoint and returns a full report — HTTP behavior, security posture, TLS, DNS, cache, compression, performance timing, SEO signals and the detected tech stack. Every scan runs server-side, so you see the target exactly as the open internet does, not filtered through your browser or extensions.
There's no account and nothing is stored. Each scan runs fresh against live infrastructure, and the report lives only in your session. It's built for the people who need the truth about a target quickly: developers shipping and debugging, SREs chasing latency and reliability, security engineers auditing headers and transport, and SEO analysts checking what crawlers actually see.
Website
End-to-end analysis of any URL — headers to tech stack.
API
Compose a request, then read the response as a contract.
Network
DNS, IP, TLS, CDN and email infrastructure for a host.
Every report section, explained
Enter any public URL and the Website Inspector fans out into the sections below. Each is graded and cross-linked so you can move from a symptom to its cause.
Overview
The headline read on a URL: final status, resolved address, protocol, content type and size. It's the at-a-glance verdict every deeper section builds on.
Redirect chain
Every hop from the URL you entered to the resource that actually answered. See status codes, scheme upgrades and any loops or unnecessary detours costing latency.
Response & request headers
The full header exchange in both directions, formatted and grouped. Spot missing directives, unexpected values and the story the server tells about itself.
Security headers
HSTS, CSP, X-Frame-Options, Referrer-Policy and friends — present, missing or misconfigured. Each is graded so you know what's hardening the site and what's exposed.
Cookies
Every Set-Cookie parsed into flags — Secure, HttpOnly, SameSite, path, domain and expiry. Weak or over-scoped cookies surface immediately.
Cache
Cache-Control, ETag, Age and validators interpreted into plain behavior: what's cacheable, for how long, and whether revalidation is set up correctly.
Compression
Which encoding the server negotiated — gzip, Brotli or none — with the transfer versus decoded size so you can see exactly how much bandwidth is being saved.
Performance
Connection timing broken down: DNS, TCP, TLS handshake, time to first byte and total transfer. The waterfall shows where the milliseconds actually go.
TLS
The negotiated certificate and cipher: issuer, validity window, key and protocol version. Expiring, mismatched or weak configurations are flagged.
DNS
The records behind the hostname — A, AAAA, CNAME, MX, TXT and more — with the resolution path that maps the name to the server that answered.
CORS
Cross-origin behavior read from the Access-Control headers: which origins, methods and headers are allowed, and whether credentials cross boundaries.
SEO
Title, meta description, canonical, robots directives, Open Graph and structured data — the signals search engines and social platforms read first.
Tech
The detected stack: server software, frameworks, CDNs, analytics and CMS fingerprinted from headers and response signatures. Know what powers the page.
AI Insights
A heuristic read across every collected signal, rolled into an advisory score with prioritized, plain-language recommendations for what to fix first.
Compose a request, read the response
Build a request from its parts, send it server-side, and get an analysis of the response as an API surface — not just a body dump.
Constructing a request
Method
Choose the verb — GET, POST, PUT, PATCH, DELETE and more. It sets the intent and shapes which of the other fields matter.
URL
The full endpoint you're calling. Query strings can be typed inline or managed as structured params below.
Headers
Add request headers as key/value pairs — Accept, Content-Type, custom tokens — exactly as they'll be sent on the wire.
Params
Query parameters managed as discrete rows, kept in sync with the URL so nothing gets double-encoded or lost.
Body
The payload for methods that carry one — JSON, form data or raw text — with the content type inferred or set explicitly.
Auth
Attach credentials — bearer token, basic auth or an API key header — layered onto the request without storing anything after the scan.
POST https://api.example.com/v1/orders
Content-Type: application/json
Authorization: Bearer <token>
{
"items": [{ "sku": "WI-2026", "qty": 2 }],
"currency": "USD"
}What each response section means
JSON Analyzer
The response body parsed and mapped — shape, types, depth and nullability — so you can read the schema of an unfamiliar payload at a glance.
Security
Auth handling, transport, CORS exposure and header hygiene evaluated for the endpoint, calling out anything that leaks data or weakens the boundary.
REST best practices
How the endpoint measures against REST conventions: status-code correctness, method semantics, content negotiation and consistent, predictable resource design.
GraphQL
When a GraphQL endpoint is detected, introspection and query-shape analysis surface the schema, operations and common pitfalls behind the single resolver.
WebSocket
For upgradeable endpoints, the handshake, subprotocol and connection behavior are inspected so you can confirm the real-time channel negotiates cleanly.
OpenAPI
Discovered or supplied OpenAPI documents are parsed into a readable contract — paths, operations and models — to compare spec against live behavior.
Performance
End-to-end request timing with the same connection-level breakdown as the website report, tuned to how an API client experiences the round trip.
Reproduce it anywhere
Every request you compose can be exported as cURL, a Postman collection or an OpenAPI document — the fastest way to move a one-off inspection into your own scripts or test suite.
Below the application layer
Give it a hostname or an IP. A hostname is resolved and analyzed through DNS first; an IP is inspected directly for its transport, ownership and reputation.
DNS analysis
Full record inventory for the hostname — A, AAAA, MX, TXT, NS, CNAME and SOA — resolved live and presented with the authority behind each answer.
Propagation
How the current records look across resolvers, so you can tell whether a recent DNS change has fully rolled out or is still catching up.
IP & ASN
The address the name resolves to, plus its autonomous system, network owner and geographic hint — who actually hosts the endpoint.
TLS deep inspection
The full certificate chain, cipher suites, protocol versions and key details — a level below the website report, aimed at the transport itself.
Protocols
Which application and transport protocols the host negotiates — HTTP versions, ALPN offers and QUIC support where it can be established.
CDN detection
Fingerprints edge and CDN providers from headers, IP ranges and TLS signals, revealing whether traffic is served from an edge network and by whom.
Blacklists
Checks the host and its address against reputation and blocklist sources so deliverability or trust problems show up before they bite.
Email infrastructure
MX, SPF, DKIM and DMARC records read together to assess how mail for the domain is routed and how well it's protected against spoofing.
Take the report with you
Any inspection can leave the tool in the shape you need — human-readable, machine-readable, or a runnable request.
A print-ready report of the full inspection.
JSON
The complete structured result for tooling.
Markdown
Readable report for docs, tickets or PRs.
CSV
Tabular rows for spreadsheets and analysis.
cURL
The exact request as a runnable command.
Postman
A collection you can import and replay.
OpenAPI
A spec document describing the request.
RawHeaders
The unformatted header exchange, verbatim.
RawDNS
Untouched DNS records as resolved.
RawTLS
The raw certificate and TLS handshake data.
RawHTTP
The full HTTP request and response text.
Stateless by design
WebInspect keeps nothing. There are no accounts, no saved history and no database of what you scanned — each report is generated on demand and discarded when your session ends. The only telemetry is anonymous usage analytics, and even there raw IP addresses are never stored: an address is reduced to a short, salted hash prefix used purely to estimate unique traffic. There is no way to reconstruct the original IP, or the target you inspected, from what's kept.
What we store
A short salted hash prefix for anonymous counting — never raw IPs, never scan results, never the URLs you entered.
Answers to the common questions
The honest details behind the numbers — why a value reads the way it does, and what the tool can and can't see.
Why does the HTTP version sometimes say HTTP/2 even though the site is HTTP/3-capable?
The inspector reports the highest protocol version it can actually negotiate from the server it runs on. HTTP/3 rides on QUIC over UDP, and many hosting and server environments block or drop outbound UDP. When that happens the connection falls back to HTTP/2 (or HTTP/1.1) and we report what was truly negotiated — not what the site advertises. A site can be HTTP/3-capable for browsers on the open internet and still show HTTP/2 here.
Why is DNSSEC reported as “unknown” for some domains?
DNSSEC status depends on the resolver returning signed records and setting the Authenticated Data (AD) flag. Some resolvers, zones, or intermediate caches don't expose enough signal to confirm a validated chain of trust. Rather than guess, we mark those cases as unknown. Unknown means “we couldn't verify it,” not “it's insecure” — a domain may still be signed even when our vantage point can't prove it.
Can I use the API programmatically?
The inspectors are UI-driven and there is no public authenticated API tier documented here. If you want to reproduce or automate a request, use the export formats instead: every inspection can be exported as cURL, a Postman collection, or an OpenAPI document, which you can run in your own scripts or tooling. Those exports capture the exact request that was analyzed.
How are the AI Insights scored?
AI Insights apply heuristic scoring across the signals collected during a scan — security headers, TLS configuration, cache and compression posture, and performance timings — and roll them into a single 0–100 style score with prioritized recommendations. The score is advisory: it's a fast read on relative health, not a guarantee, an audit, or a compliance certification. Treat it as a starting point for investigation.
Is my scan data stored?
No. WebInspect is stateless by design — there's no account, no scan history, and no database of your results. Each scan runs fresh and the report lives only in your browser session. When you close or reload the page, that report is gone. Analytics store only a short salted hash prefix derived from the request IP, never the raw IP or the target you scanned.
Why did a scan time out?
Scans run server-side against live infrastructure, so they're bounded by a time budget. A timeout usually means the target was slow to respond, sitting behind aggressive rate limiting or a bot-protection layer, or unreachable from our server's network vantage point. Retrying often succeeds — and if a specific report section timed out, the others it doesn't depend on may still have completed.
Does it work on localhost or private IPs?
No. Scans execute from our servers, not from your machine, so anything only reachable inside your local network — localhost, 127.0.0.1, or private ranges like 10.x, 172.16–172.31.x, and 192.168.x — isn't visible to us and can't be inspected. Point the inspectors at a publicly resolvable hostname or public IP.
How fresh are the results?
Every result is live. Nothing is cached or served from a prior run — each scan opens a new connection and re-collects headers, TLS, DNS, and timing at that moment. That's why two scans seconds apart can differ slightly: you're seeing the target's real, current behavior, including load-dependent timings and edge-node variation.
Can I scan a site that's behind authentication?
Only the publicly reachable surface. The inspectors don't log in, hold sessions, or send credentials, so pages gated behind a login return whatever the server shows to an anonymous visitor — typically a redirect or a login page. You can still inspect the auth endpoint itself (its headers, TLS, and redirect behavior), just not the protected content beyond it.
What's the difference between the three inspectors?
The Website Inspector analyzes an HTTP resource end to end — headers, security, cookies, cache, TLS, DNS, SEO, and detected tech. The API Inspector lets you compose an exact request (method, headers, params, body, auth) and reads the response as an API surface: JSON shape, REST and GraphQL conventions, and best practices. The Network Inspector works below the application layer — DNS, IP and ASN, TLS internals, protocols, CDN, blacklists, and email infrastructure for a hostname or IP.