Everything WebInspect can tell you about a site, an API, or a network.
A field guide to the three inspectors and every report they produce — what each section means, how to read it, how to export it, and how your data is handled. No account needed to start, and every scan runs fresh.
What WebInspect does
WebInspect analyzes any website, API or network endpoint and returns a full report — HTTP behavior, security posture, TLS, DNS, cache, compression, performance timing, SEO signals and the detected tech stack. Every scan runs server-side, so you see the target exactly as the open internet does, not filtered through your browser or extensions.
You don’t need an account to start, and inspection results aren’t saved unless you choose to publish a report. Each scan runs fresh against live infrastructure, and the report lives in your browser session. It’s built for the people who need the truth about a target quickly: developers shipping and debugging, SREs chasing latency and reliability, security engineers auditing headers and transport, and SEO analysts checking what crawlers actually see.
Website
End-to-end analysis of any URL — headers to tech stack.
API
Compose a request, then read the response as a contract.
Network
DNS, IP, TLS, CDN and email infrastructure for a host.
Every report section, explained
Enter any public URL and the Website Inspector fans out into the sections below. Each is graded and cross-linked so you can move from a symptom to its cause.
Overview
The headline read on a URL: final status, resolved address, protocol, content type and size. It's the at-a-glance verdict every deeper section builds on.
Redirect chain
Every hop from the URL you entered to the resource that actually answered. See status codes, scheme upgrades and any loops or unnecessary detours costing latency.
Response & request headers
The full header exchange in both directions, formatted and grouped. Spot missing directives, unexpected values and the story the server tells about itself.
Security headers
HSTS, CSP, X-Frame-Options, Referrer-Policy and friends — present, missing or misconfigured. Each is graded so you know what's hardening the site and what's exposed.
Cookies
Every Set-Cookie parsed into flags — Secure, HttpOnly, SameSite, path, domain and expiry. Weak or over-scoped cookies surface immediately.
Cache
Cache-Control, ETag, Age and validators interpreted into plain behavior: what's cacheable, for how long, and whether revalidation is set up correctly.
Compression
Which encoding the server negotiated — gzip, Brotli or none — with the transfer versus decoded size so you can see exactly how much bandwidth is being saved.
Performance
Connection timing broken down: DNS, TCP, TLS handshake, time to first byte and total transfer. The waterfall shows where the milliseconds actually go.
TLS
The negotiated certificate and cipher: issuer, validity window, key and protocol version. Expiring, mismatched or weak configurations are flagged.
DNS
The records behind the hostname — A, AAAA, CNAME, MX, TXT and more — with the resolution path that maps the name to the server that answered.
CORS
Cross-origin behavior read from the Access-Control headers: which origins, methods and headers are allowed, and whether credentials cross boundaries.
SEO
Title, meta description, canonical, robots directives, Open Graph and structured data — the signals search engines and social platforms read first.
Tech
The detected stack: server software, frameworks, CDNs, analytics and CMS fingerprinted from headers and response signatures. Know what powers the page.
AI Insights
A heuristic read across every collected signal, rolled into an advisory score with prioritized, plain-language recommendations for what to fix first.
Compose a request, read the response
Build a request from its parts, send it server-side, and get an analysis of the response as an API surface — not just a body dump.
Constructing a request
Method
Choose the verb — GET, POST, PUT, PATCH, DELETE and more. It sets the intent and shapes which of the other fields matter.
URL
The full endpoint you're calling. Query strings can be typed inline or managed as structured params below.
Headers
Add request headers as key/value pairs — Accept, Content-Type, custom tokens — exactly as they'll be sent on the wire.
Params
Query parameters managed as discrete rows, kept in sync with the URL so nothing gets double-encoded or lost.
Body
The payload for methods that carry one — JSON, form data or raw text — with the content type inferred or set explicitly.
Auth
Attach credentials — bearer token, basic auth or an API key header — layered onto the request without storing anything after the scan.
POST https://api.example.com/v1/orders
Content-Type: application/json
Authorization: Bearer <token>
{
"items": [{ "sku": "WI-2026", "qty": 2 }],
"currency": "USD"
}What each response section means
JSON Analyzer
The response body parsed and mapped — shape, types, depth and nullability — so you can read the schema of an unfamiliar payload at a glance.
Security
Auth handling, transport, CORS exposure and header hygiene evaluated for the endpoint, calling out anything that leaks data or weakens the boundary.
REST best practices
How the endpoint measures against REST conventions: status-code correctness, method semantics, content negotiation and consistent, predictable resource design.
GraphQL
When a GraphQL endpoint is detected, introspection and query-shape analysis surface the schema, operations and common pitfalls behind the single resolver.
WebSocket
For upgradeable endpoints, the handshake, subprotocol and connection behavior are inspected so you can confirm the real-time channel negotiates cleanly.
OpenAPI
Discovered or supplied OpenAPI documents are parsed into a readable contract — paths, operations and models — to compare spec against live behavior.
Performance
End-to-end request timing with the same connection-level breakdown as the website report, tuned to how an API client experiences the round trip.
Reproduce it anywhere
Every request you compose can be exported as cURL, a Postman collection or an OpenAPI document — the fastest way to move a one-off inspection into your own scripts or test suite.
Below the application layer
Give it a hostname or an IP. A hostname is resolved and analyzed through DNS first; an IP is inspected directly for its transport, ownership and reputation.
DNS analysis
Full record inventory for the hostname — A, AAAA, MX, TXT, NS, CNAME and SOA — resolved live and presented with the authority behind each answer.
Propagation
How the current records look across resolvers, so you can tell whether a recent DNS change has fully rolled out or is still catching up.
IP & ASN
The address the name resolves to, plus its autonomous system, network owner and geographic hint — who actually hosts the endpoint.
TLS deep inspection
The full certificate chain, cipher suites, protocol versions and key details — a level below the website report, aimed at the transport itself.
Protocols
Which application and transport protocols the host negotiates — HTTP versions, ALPN offers and QUIC support where it can be established.
CDN detection
Fingerprints edge and CDN providers from headers, IP ranges and TLS signals, revealing whether traffic is served from an edge network and by whom.
Blacklists
Checks the host and its address against reputation and blocklist sources so deliverability or trust problems show up before they bite.
Email infrastructure
MX, SPF, DKIM and DMARC records read together to assess how mail for the domain is routed and how well it's protected against spoofing.
Take the report with you
Any inspection can leave the tool in the shape you need — human-readable, machine-readable, or a runnable request.
A print-ready report of the full inspection.
JSON
The complete structured result for tooling.
Markdown
Readable report for docs, tickets or PRs.
CSV
Tabular rows for spreadsheets and analysis.
cURL
The exact request as a runnable command.
Postman
A collection you can import and replay.
OpenAPI
A spec document describing the request.
RawHeaders
The unformatted header exchange, verbatim.
RawDNS
Untouched DNS records as resolved.
RawTLS
The raw certificate and TLS handshake data.
RawHTTP
The full HTTP request and response text.
What we keep, and for how long
Inspection results are returned to your browser and are not saved on our servers unless you publish a report or use an AI feature. A few things are recorded so the free service can work: each inspection is logged in a usage ledger (the tool and the time, with your account ID or a salted hash of your IP address — not the target) to enforce the free allowance, and AI requests are logged together with the prompt and response for 90 days.
Usage analytics — pages viewed, inspections run, browser and approximate location — are collected only if you accept analytics cookies in the cookie banner, and you can withdraw that at any time from “Cookie settings” in the footer. Raw IP addresses are never written to the database, only salted hashes.
Published reports are stored until the expiry you choose, then deleted 30 days later. You can delete a report yourself at any time, and a free account can download its data or be deleted from Account settings.
Automatic deletion
Analytics are deleted after 13 months, AI prompts and responses after 90 days and expired reports 30 days after expiry. The full details are in the Privacy Policy.
Answers to the common questions
The honest details behind the numbers — why a value reads the way it does, and what the tool can and can't see.
Why does the HTTP version sometimes say HTTP/2 even though the site is HTTP/3-capable?
The inspector reports the highest protocol version it can actually negotiate from the server it runs on. HTTP/3 rides on QUIC over UDP, and many hosting and server environments block or drop outbound UDP. When that happens the connection falls back to HTTP/2 (or HTTP/1.1) and we report what was truly negotiated — not what the site advertises. A site can be HTTP/3-capable for browsers on the open internet and still show HTTP/2 here.
Why is DNSSEC reported as “unknown” for some domains?
DNSSEC status depends on the resolver returning signed records and setting the Authenticated Data (AD) flag. Some resolvers, zones, or intermediate caches don't expose enough signal to confirm a validated chain of trust. Rather than guess, we mark those cases as unknown. Unknown means “we couldn't verify it,” not “it's insecure” — a domain may still be signed even when our vantage point can't prove it.
Can I use the API programmatically?
The inspectors are UI-driven and there is no public authenticated API tier documented here. If you want to reproduce or automate a request, use the export formats instead: every inspection can be exported as cURL, a Postman collection, or an OpenAPI document, which you can run in your own scripts or tooling. Those exports capture the exact request that was analyzed.
How are the AI Insights scored?
AI Insights apply heuristic scoring across the signals collected during a scan — security headers, TLS configuration, cache and compression posture, and performance timings — and roll them into a single 0–100 style score with prioritized recommendations. The score is advisory: it's a fast read on relative health, not a guarantee, an audit, or a compliance certification. Treat it as a starting point for investigation.
Is my scan data stored?
Inspection results are not saved on our servers: each scan runs fresh and the report lives in your browser session, so it is gone when you close or reload the page — unless you publish it as a report, which is stored until the expiry you choose (and you can delete it yourself at any time). Each inspection is logged in a usage ledger (tool and time, with your account ID or a salted hash of your IP address — not the target) to enforce the free allowance. AI requests are logged with their prompt and response for 90 days. Usage analytics are collected only if you accept analytics cookies. Raw IP addresses are never stored. See the Privacy Policy at /privacy for every detail and retention period.
Why did a scan time out?
Scans run server-side against live infrastructure, so they're bounded by a time budget. A timeout usually means the target was slow to respond, sitting behind aggressive rate limiting or a bot-protection layer, or unreachable from our server's network vantage point. Retrying often succeeds — and if a specific report section timed out, the others it doesn't depend on may still have completed.
Does it work on localhost or private IPs?
No. Scans execute from our servers, not from your machine, so anything only reachable inside your local network — localhost, 127.0.0.1, or private ranges like 10.x, 172.16–172.31.x, and 192.168.x — isn't visible to us and can't be inspected. Point the inspectors at a publicly resolvable hostname or public IP.
How fresh are the results?
Every result is live. Nothing is cached or served from a prior run — each scan opens a new connection and re-collects headers, TLS, DNS, and timing at that moment. That's why two scans seconds apart can differ slightly: you're seeing the target's real, current behavior, including load-dependent timings and edge-node variation.
Can I scan a site that's behind authentication?
Only the publicly reachable surface. The inspectors don't log in, hold sessions, or send credentials, so pages gated behind a login return whatever the server shows to an anonymous visitor — typically a redirect or a login page. You can still inspect the auth endpoint itself (its headers, TLS, and redirect behavior), just not the protected content beyond it.
What's the difference between the three inspectors?
The Website Inspector analyzes an HTTP resource end to end — headers, security, cookies, cache, TLS, DNS, SEO, and detected tech. The API Inspector lets you compose an exact request (method, headers, params, body, auth) and reads the response as an API surface: JSON shape, REST and GraphQL conventions, and best practices. The Network Inspector works below the application layer — DNS, IP and ASN, TLS internals, protocols, CDN, blacklists, and email infrastructure for a hostname or IP.