Run your own copy

The checker on this site is a single Cloudflare Pages Function — about 200 lines, no database, no dependencies. Copy it into your own project and it is yours: your rate limits, your logs, your schedule, no shared queue.

What you need

• Node 18 or newer, and a terminal
• A free Cloudflare account (Pages free tier: 100,000 function requests per day)
• Optional: your own domain. The *.pages.dev subdomain works fine
• No API keys, no database, no build step

1. Make a project

mkdir my-checker && cd my-checker
mkdir -p functions/api public
echo '<!doctype html><title>checker</title><p>POST /api/check</p>' > public/index.html

2. Drop in the function

Save this file as functions/api/check.js. It is plain JavaScript — Cloudflare runs it at the edge.

Open the source Copy to clipboard

MIT licensed — use it, change it, ship it commercially. No attribution required, though a link back is appreciated.

3. Deploy

npx wrangler login
npx wrangler pages project create my-checker --production-branch main
npx wrangler pages deploy public --project-name my-checker --branch main

You get a URL like https://my-checker.pages.dev. That is the whole deployment.

4. Prove it works

curl -s -X POST https://my-checker.pages.dev/api/check \
  -H 'content-type: application/json' \
  -d '{"url":"example.com"}'

A GET on the same path returns usage notes. A private address (127.0.0.1, 169.254.169.254) must be refused — the function blocks loopback, private, link-local and .internal hosts so it cannot be used as an SSRF proxy.

5. Run a list, one domain at a time

This script checks sequentially with a pause between requests and writes a CSV. Keep it serial: parallel checks look like an attack from the other end and get you blocked by the firewall you are trying to assess.

Open the script Copy to clipboard

ENDPOINT=https://my-checker.pages.dev ./check-domains.sh domains.txt results.csv

domains.txt is one host per line. DELAY=2 raises the pause. The output has three verdicts and one rule: unknown is not a pass.

6. Protect it (optional but sensible)

Cloudflare dashboard → your zone (or the pages.dev project) → Security → WAF → Rate limiting rules:

• Path equals /api/check
• 10 requests per minute per IP
• Action: Block, for 60 seconds

If you are on *.pages.dev without a zone, put a shared secret in the function instead — add a header check against a value in env and call it with curl -H "x-key: …".

What this cannot do

• It cannot prove a site is safe. Most hosts strip X-Powered-By; roughly none of the sites tested advertised a version. "Unknown" is the normal answer.
• It cannot see a restart. A server can be on the fixed version and still be running old workers. Only the owner can check that.
• It does not test exploitability. No payloads, no path discovery, no version-specific probes. It is a header and title reader.
• It is not a scanner. If you need authenticated, credentialed scanning of an estate, that is a different product (and a different conversation with the site owner).

A note on etiquette and the law

One GET per domain is what a browser does, and passive version reading is broadly tolerated — but "broadly tolerated" is not "permission". Check sites you own or have written authorisation for, respect robots.txt and rate limits, and do not point this at third parties to build a list of targets. The ownership checkbox in the public UI is not decoration: it is the boundary that keeps a defensive tool defensive.