Site Health Check
Site Health Check runs four real diagnostics against any public domain — a live TLS handshake to read the certificate chain and negotiated protocol, DNS lookups across three public resolvers to catch propagation issues, an inspection of the six HTTP security headers browsers rely on, and a robots.txt/sitemap validation that spot-checks the URLs it finds. Results come back in plain English with a pass/warn/fail badge per panel and one combined score, plus a technical-details toggle for anyone who wants the raw values. Free, unlimited, no signup — built for freelancers and agencies who need to hand a client a clear, screenshot-friendly health report in under a minute.
This check runs server-side — ForgePlug briefly connects to the domain you enter to read its certificate, DNS records, response headers, and robots.txt/sitemap. We don't store anything beyond a 5-minute result cache (to avoid re-running the same check for everyone hitting a trending domain) and a short-lived snapshot used to compare a re-check later.
What a site health check actually checks — and why it matters
Four independent diagnostics, one plain-English report.
A domain can look fine in a browser and still be quietly broken in ways that only show up at the worst moment: a certificate that expires the morning of a product launch, a DNS change that hasn't finished propagating to half your visitors, security headers that were never configured, or a sitemap full of dead links search engines keep re-crawling. None of these show up by just loading the homepage — you have to check the actual protocol-level details.
TLS/SSL: the handshake, not just the padlock
Browsers show a padlock as long as a certificate is valid right now — they don't warn you three weeks before it expires. This tool opens a real TLS handshake on port 443 and reads the certificate chain directly: issuer, expiry date, whether the chain is complete, which protocol version was negotiated (flagging deprecated TLS 1.0/1.1), and which cipher suite is in use.
DNS: three vantage points, not one
A single DNS lookup only tells you what one resolver currently has cached. Querying Cloudflare, Google, and Quad9 at the same time reveals whether a recent change has actually finished propagating, or whether some visitors are still being routed to the old server.
HTTP security headers: the browser's second line of defense
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy don't affect how a site looks — they affect what a browser will and won't allow if something else goes wrong. Most sites never explicitly set them, which means the protection is simply off.
Robots.txt & sitemap: the crawler's-eye view
A typo in robots.txt (an accidental Disallow: /) or a sitemap that 404s doesn't break the site for humans — it breaks it for search engines, silently, for weeks before anyone notices traffic dropping.
Run all four together and you get one combined pass/warn/fail badge — capped at warn if any single panel fails, and fail if two or more do — that's easy to hand to a client or a teammate without a wall of protocol jargon.
Frequently Asked Questions
Everything you need to know about ForgePlug's Site Health Check
What exactly does the combined Site Health Check look at?
Is this really free, and is there a limit?
Why does this tool need a server? Aren't ForgePlug's tools all browser-based?
What do you do with the domain I check?
Can I check an internal or private server?
What does the overall pass/warn/fail badge mean?
Tool Overview
A closer look at Site Health Check — how it works, who it's for, and where it fits in your workflow.
A domain can look perfectly fine in a browser tab and still be quietly broken in ways nobody notices until it's too late: a certificate that expires the morning of a launch, a DNS record still propagating to half the internet, security headers that were never configured, or a sitemap full of links search engines keep re-crawling into dead ends. None of that shows up by loading the homepage — it only shows up by checking the protocol-level details directly.
Site Health Check runs four real diagnostics against any public domain, in parallel. It opens an actual TLS handshake on port 443 to read the live certificate chain, protocol version, and cipher suite — not a cached or approximated result. It queries DNS records from three independent public resolvers to catch propagation in progress. It fetches the domain and inspects the six HTTP response headers browsers use for defense-in-depth. And it fetches robots.txt, follows every declared sitemap, and spot-checks the URLs inside for a working 200 OK response.
Unlike almost every other ForgePlug tool, this one can't run entirely in your browser — a browser can't open a raw TLS socket, query an arbitrary DNS resolver, or read another site's headers without hitting CORS. So a small, rate-limited server component does exactly those three things and nothing else: it connects to the domain you enter, reads the result, and forgets it after a short cache window.
Results come back as a pass/warn/fail badge per panel plus one combined score, each with plain-English explanations instead of jargon — built for the moment a freelancer or agency needs to hand a client a clear, screenshot-friendly report in under a minute, not a security audit that takes an afternoon to interpret.
Key Features
Everything you get with this tool, at a glance.
Real TLS Handshake
Reads the live certificate chain, expiry, protocol version, and cipher suite on port 443.
3-Resolver DNS Check
Compares A, AAAA, MX, TXT, and NS records across Cloudflare, Google, and Quad9.
6 Security Headers
Checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
Robots.txt & Sitemap Validation
Flags an accidental Disallow: / and spot-checks up to 20 sitemap URLs for broken links.
Parallel, Rate-Limited Checks
All four panels run at once — a slow domain never blocks the others from finishing.
Copy or Export the Report
Copy a plain-text summary or export a screenshot-ready image to send a client.
How to Use Site Health Check
Get from zero to done in four quick steps — no account, no learning curve.
Enter a domain
Type a public domain, e.g. example.com — no scheme, path, or bare IP address needed.
Run the check
All four panels — TLS, DNS, headers, robots/sitemap — run in parallel server-side.
Read the plain-English results
Each panel shows a pass/warn/fail chip and 1-3 sentences explaining what was found and why it matters.
Dig into the technical details (optional)
Expand "show technical details" on any panel for the raw certificate, DNS, header, or sitemap data.
Copy or export the report
Use Copy report for a plain-text summary, or Export as image for a screenshot to send a client.
Practical Examples
Real input and output pairs so you know exactly what to expect.
Certificate expiring soon
Input
TLS panel on a domain 9 days from expiry
Output
Warn — "Your certificate expires in 9 days — renew it before then to avoid a browser warning."
DNS still propagating
Input
A record differs between Cloudflare and Google right after a DNS change
Output
Warn — "A record(s) differ between resolvers — DNS changes still appear to be propagating."
Missing security headers
Input
A response with no Content-Security-Policy or Permissions-Policy header
Output
Warn — "2 of 6 recommended security headers are missing: content-security-policy, permissions-policy."
Accidental Disallow: /
Input
robots.txt with User-agent: * / Disallow: / and no Allow rule
Output
Fail — "robots.txt disallows all crawlers with no matching Allow rule — nothing can be indexed."
Guides & Articles
Learn how to get the most out of this tool with our in-depth guides.
Was this tool helpful?
Your feedback helps us improve Site Health Check for everyone.
Share this tool