Domain Security Scanner: SSL, DMARC, Subdomains, Tech Stack

Full domain security audit in one call: SSL/TLS, DNS, SPF/DKIM/DMARC, security headers, WHOIS, blacklist, tech stack — PLUS subdomain-takeover risk and public S3-bucket exposure detection, which no other domain-audit tool checks. Returns a 0-100 health score + fix list. No API key, no login.

Domain Intelligence Lookup

obicodes/domain-intel

Full domain intelligence in one call. Get WHOIS registration data, DNS records, SSL certificate status, IP geolocation, ASN, mail provider detection, and an actionable email security score (SPF, DMARC, MX). Built for developers, security teams, agencies, and growth teams.

Security Headers Checker

s3nafps/security-headers-checker

Check public URLs for common HTTP security headers including HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Export a simple website security header report as JSON or CSV.

Subdomain Finder — Certificate Transparency (crt.sh)

bgfc97/crtsh-subdomain-finder

Discover subdomains of any domain from public Certificate Transparency logs (crt.sh). Attack-surface mapping and recon with first/last-seen dates. No key, no proxy.

🛡️ Subdomain Finder, Attack Surface & SSL OSINT Scanner

unrivaled_fortress/ssl-certificate-checker

SSL Labs-style certificate inspector: paste domains, get issuer, validity dates, days-to-expiry, SANs, TLS version, cipher and a security grade (A+→F) for every host. No API key, no proxy.

Lighthouse Batch Audits & Regression Alerts

peerless_columbine/lighthouse-batch-audit-monitor

Audit public pages with Lighthouse13.5.0, export raw and HTML reports, and compare persistent category baselines.

Catch SEO disasters before Google does: watches robots.txt, XML sitemaps and key pages for Disallow: /, noindex, canonical and status changes, sitemap URL drops and errors. Diffs vs last run, Slack/webhook alerts, HTML report.

NF Vulnerability Scanner — All-in-One Website Security Audit

nativefoundation-inc/vuln-scan-actor

The most comprehensive all-in-one website vulnerability scanner on Apify. Multi-engine security testing — active scanning, CVE detection, server misconfig checks, plus SPF/DMARC email-spoofing checks and leaked-secret scanning. Structured JSON report with severities and priority grades.

For a list of domains, returns DNS records, SPF/DMARC email authentication, TLS certificate expiry, security-header score, CDN/cloud provider and server stack hints. Built for lead qualification, vendor due diligence and AI agents.

Scan HTTP security headers for any URL. Returns A+ to F grade, per-header pass/weak/missing status (CSP, HSTS, X-Frame-Options), and Nginx/Apache/Express/Cloudflare fix snippets. Use for security audits, compliance checks, vendor review. Input: url or urls[]. Output: JSON grade report.