Owner-initiated, one site at a time
A check runs only when someone types in a website and confirms it's theirs (or one they manage). It reads that one site, once: the homepage, the sitemap, and up to 20 of the site's own pages its homepage links to. It is not a crawler and it never scans sites nobody asked about.
What a check does
- Reads your robots.txt and honours any rule that names WhatsNotWorkingBot. General rules for all bots don't apply: like Google's PageSpeed check, this is a one-off visit you asked for, not crawling.
- Loads your homepage like a browser would and reads the headers and HTML it returns, plus once more asking for a compressed copy, and up to 5 of your own script files it loads (checked for exposed keys).
- Reads your sitemap and up to 20 pages on your own site that the homepage links to (titles, headings, phone numbers), skipping anything a WhatsNotWorkingBot rule disallows.
- Opens one SSL handshake to read your certificate, and visits http:// once to see if it redirects to https://.
- Looks for a published /.well-known/security.txt contact file (a public standard).
- Looks up public DNS records for your domain: SPF, DMARC, DKIM keys at common names, MTA-STS, mail and name servers, CAA, and a few common subdomain names (to spot abandoned ones). DNSSEC is checked through a public DNS resolver (Cloudflare 1.1.1.1).
- Asks the public domain registry (RDAP, through rdap.org, which forwards to your domain's registry) for its expiry date and lock status.
- Only with a commercial licence configured: checks your domain and servers against the Spamhaus blacklists.
- Asks Google PageSpeed Insights to run Lighthouse on your homepage (Google loads it once).
- Opens a few more secure handshakes (nothing sent) to see which TLS versions and ciphers your server accepts.
What it never does
- No logins, no submitting forms, no guessing passwords or hidden URLs.
- No following links to other websites, other subdomains or non-standard ports. If your homepage redirects to a different domain, the check stops there.
- No probing for files or version numbers. Software hints come only from what your site already tells every visitor.
Our bot
Requests identify themselves as Mozilla/5.0 (compatible; WhatsNotWorkingBot/1.0; +https://whatsnotworking.com/about; owner-requested check). To keep it off your site, add User-agent: WhatsNotWorkingBot / Disallow: / to robots.txt.
Run a free check