This started as a handful of bookmarks I kept sending to clients. It's turned into the list I use myself.
I've checked every tool here in September 2026 and written down what you actually get for free. A few have changed since I first wrote this, so there's a section on the ones that aren't worth bothering with any more.
There's no affiliate links and nothing is sponsored.
ð§ How to use this page
You don't need all of these, just a handful that suit your site. The table below is the map, and the sections underneath have the detail.
If you'd rather skip to the practical bit, there's a testing routine at the end telling you what to run and when, plus a quick-reference table of every tool and its free limits.
| Category | What it answers | Tools |
|---|---|---|
| Performance and Core Web Vitals | Is my site fast, and fast for real visitors? | PageSpeed Insights, WebPageTest, GTmetrix, DebugBear, SpeedVitals, Yellow Lab Tools, CrUX Vis, Lighthouse |
| SEO and search visibility | Can search engines crawl, understand and index this? | Search Console, Bing Webmaster Tools, Rich Results Test, Schema Markup Validator, Ahrefs Free, Screaming Frog, httpstatus.io |
| Accessibility | Can everyone actually use this site? | WAVE, axe DevTools, Accessibility Insights, WebAIM Contrast Checker |
| SSL and certificates | Is my HTTPS set up properly, not just switched on? | Qualys SSL Labs, Hardenize |
| Security headers and configuration | Am I sending the headers that protect visitors? | Security Headers, Mozilla HTTP Observatory, CSP Evaluator |
| Malware and reputation scanning | Has my site been hacked or blocklisted? | Sucuri SiteCheck, Google Safe Browsing, urlscan.io, Cloudflare URL Scanner |
| Code and markup validation | Is my HTML and CSS actually valid? | W3C Nu Html Checker, W3C CSS Validator |
| Email deliverability | Do my contact form and newsletter emails reach the inbox? | Mail-Tester, MXToolbox, Learn and Test DMARC, dmarcian, EasyDMARC |
| DNS and domain health | Have my DNS changes propagated, and is the zone sane? | whatsmydns.net, DNSChecker, intoDNS, DNSViz, Dig Web Interface |
| Uptime monitoring | Will I find out before my client does? | UptimeRobot |
| Cross-browser and responsive | Does it hold up outside my own browser? | Responsively App, Browserling, Chrome DevTools |
| Privacy and tracking | What is my site leaking about its visitors? | Blacklight |
| Sustainability and page weight | How heavy is this page, really? | Website Carbon Calculator, Ecograder |
| Images and assets | Can I make this 400KB hero image smaller? | Squoosh, TinyPNG |
| Technology detection | What is this site built with? | BuiltWith, WhatRuns, Wappalyzer |
| All-in-one scanners | Can I get a broad sweep in one go? | web-check.xyz |
⥠Performance and Core Web Vitals
Speed is the one thing your visitors notice directly.
If two tools give you very different answers, it's usually because one is running its own test and the other is reporting what real visitors experienced. Google cares about the second one.
Google PageSpeed Insights
Start here. Paste a URL and you get scores out of 100 for speed, accessibility, best practice and SEO, plus a list of what's slowing the page down.
The panel at the top shows data from people who have actually visited your site, and that's the part Google uses. The scores underneath come from a simulated test, so treat the suggested savings as a starting point rather than gospel.
What's free: everything, and you don't need an account. That data from real visitors only appears if your site gets enough traffic, so smaller sites often won't see it.
Try it: pagespeed.web.dev
WebPageTest
The most detailed free speed tool there is. You pick a location, a browser and a connection speed, and it tests from a real machine there.
Where it goes further than PageSpeed Insights is showing you the page loading frame by frame, as a filmstrip and a video, so you can see what a visitor actually saw and when. You can also run the same test several times and take the middle result, which matters because single tests are noisy.
It's a dense interface and it doesn't hold your hand.
What's free: you get 300 tests a month with an account, plus 13 months of history. The API and bulk testing are paid.
Try it: webpagetest.org
GTmetrix
GTmetrix produces a tidy report that a non-technical client can read without you translating it, which is mostly why people like it.
The free tier has shrunk a lot. You need an account now, and the monthly test allowance is small before paid plans kick in at around $5/month. Fine for a few reports a month. If you're re-testing twenty times while fixing something, use WebPageTest instead.
What's free: a small monthly test allowance once you've made an account. Check their pricing page for the current number before you rely on it.
Try it: gtmetrix.com
DebugBear Free Website Speed Test
A middle ground between PageSpeed Insights and WebPageTest. No account needed, and the report explains why each score came out the way it did rather than just listing numbers.
It's particularly good at pointing out which third-party script is slowing you down, which on a WordPress site with a few plugins is usually the answer.
What's free: a mobile or desktop test without signing up. A free account unlocks 30+ locations.
Try it: debugbear.com/test/website-speed
SpeedVitals
Tests from 30+ locations and devices and gives you clear notes on what to fix.
The most useful part is the separate server response test, which checks your server from up to 40 places at once and shows you where it's slow. Handy when a client abroad says the site feels sluggish and it's fine for you.
What's free: you get 15 tests a week with an account, and that covers both the speed test and the server test.
Try it: speedvitals.com
Yellow Lab Tools
Free and open source, and it looks at something the others mostly skip: how bloated the page itself is, rather than how long it took to load.
That makes it useful for the page that tests fine on fast wifi but feels sluggish on an older phone.
What's free: everything. It's run by volunteers, so go easy on it.
Try it: yellowlab.tools
CrUX Vis
Charts the speed real visitors experienced over time, which PageSpeed Insights doesn't do. You get months of history, split by phone and desktop.
Useful for checking whether a change you made in June actually helped, and good for showing a client a before and after.
What's free: everything, and you don't need an account. Your site does need enough traffic for Google to have data on it.
Try it: cruxvis.withgoogle.com
Lighthouse in Chrome DevTools
Lighthouse is already built into Chrome. Open developer tools, find the Lighthouse panel and run it.
The advantage over the hosted tools is that it works on anything you can open in your browser, including local and staging sites and pages behind a login. Run it in an incognito window, otherwise your extensions affect the results.
ð SEO and search visibility
Most SEO tools are really keyword research tools. These ones tell you whether Google can find, read and index your pages, which is the part you can actually do something about.
Google Search Console
Not an instant checker, but still the most important tool here. Verify your site once and Google tells you what people searched for to find you, where you rank, which pages are indexed and which ones it decided to skip.
The indexing report is the one I look at first on any new site. If Google has skipped a few hundred pages, fix that before you touch anything else.
What's free: everything, and it stays free. You just need to prove you own the site.
Try it: search.google.com/search-console
Bing Webmaster Tools
The one everyone skips. Worth ten minutes now, because Bing's index feeds a lot of AI assistants, so it affects whether your business comes up when someone asks a chatbot for a recommendation.
There's a free site crawler too, and you can import your site straight from Search Console rather than verifying again.
What's free: everything.
Try it: bing.com/webmasters
Google Rich Results Test
Checks whether your pages can show the extra bits in search results: review stars, FAQ dropdowns, recipe cards, event listings, breadcrumbs. Paste a URL and it tells you what it found and what's broken.
Eligible and guaranteed are different things. Google still decides what to show.
What's free: everything.
Try it: search.google.com/test/rich-results
Schema Markup Validator
The same idea as the Rich Results Test, but it checks your markup properly rather than only the bits Google uses. Use it when you're describing a business, a person or a service and aren't chasing a particular search feature.
It's what replaced Google's old Structured Data Testing Tool.
What's free: everything.
Try it: validator.schema.org
Ahrefs Free (formerly Ahrefs Webmaster Tools)
A useful chunk of an expensive product, free for sites you own and verify. It crawls your site for technical problems and shows who links to you, along with which pages bring in traffic.
It only works on sites you can verify, so competitor research is out.
What's free: site audits, backlinks and analytics on as many of your own sites as you like, up to 5,000 pages crawled a month.
Try it: ahrefs.com/webmaster-tools
Screaming Frog SEO Spider
A desktop app rather than a website, but it's the best thing here for checking a site properly. It crawls your site the way a search engine would and gives you a spreadsheet of every page, along with broken links, missing page titles, images without alt text and redirects.
The free version handles 500 pages per crawl, which covers most small business sites entirely.
What's free: you can crawl 500 pages at a time on Windows, Mac or Linux. A licence is $279/year if you need more.
Try it: screamingfrog.co.uk/seo-spider
httpstatus.io
Paste in a list of URLs and it tells you where each one ends up and how many hops it takes to get there.
This is the one to use when you're rebuilding a site. Check every old address lands in the right place, and you'll avoid the most common way a redesign loses traffic.
What's free: bulk checking in the browser with no account. The API is paid.
Try it: httpstatus.io
âŋ Accessibility
The WebAIM Million report for 2026 found accessibility failures on 95.9% of the top million home pages, so the bar most sites are clearing is low. Meanwhile the rules have tightened: the European Accessibility Act has applied since June 2025, and in the UK the Equality Act already did.
One caveat before you start. Automated tools only catch about a quarter to a half of the problems. They'll spot a missing image description but not a bad one, and they can't tell you whether the site works without a mouse.
WAVE
The quickest way to see accessibility problems in context. Instead of giving you a list, it marks up a picture of your actual page, so you can see exactly which button is missing a label.
The colour contrast checker built into the sidebar is the part I use most.
The screenshot above is a real run on a real home page: no outright errors, but ten contrast failures. That's a typical result. Contrast is what fails on a palette that looked fine in the design file.
What's free: everything, and there are browser extensions for Chrome, Firefox and Edge. Use the extension for anything behind a login.
Try it: wave.webaim.org
axe DevTools
A free browser extension from Deque, and the engine behind a lot of other accessibility tools, including the one in Lighthouse.
Its selling point is that it doesn't cry wolf. If axe flags something, it's a genuine problem, which makes it a good list to hand a developer. The trade-off is that it stays quiet about anything it isn't certain of.
What's free: the browser extension, and you can run as many scans as you like.
Try it: deque.com/axe/devtools
Accessibility Insights for Web
Microsoft's free extension, and the one that walks you through the checks a machine can't do on its own, like whether the site can be used with only a keyboard. It records your answers as you go and produces a report at the end.
There's also a quick two-minute scan that draws numbered arrows over the page showing where the keyboard focus moves. Try it on a site with a custom dropdown menu.
What's free: everything. It's open source, from Microsoft, and works in Chrome and Edge.
Try it: accessibilityinsights.io
WebAIM Contrast Checker
A single-purpose page I have open more or less permanently. Put in a text colour and a background colour, and it tells you whether the combination passes.
The sliders let you nudge a colour until it does, without abandoning the brand palette. Most subtle grey body text fails.
What's free: everything.
Try it: webaim.org/resources/contrastchecker
ð SSL and certificates
The padlock showing in the browser doesn't mean the setup behind it is right. These check the setup.
Qualys SSL Labs Server Test
The standard SSL test, and has been for years. It inspects your certificate and encryption setup and gives you a grade from A+ down to F, with a plain list of anything that needs fixing.
The grading has got stricter recently, so a site that scored A+ two years ago might not today. Worth re-running after a hosting move.
It also catches the certificate problem that works fine in your browser but breaks on Android phones, which is a miserable one to debug any other way.
What's free: unlimited tests. Results are published by default, so tick the box to hide them if you'd rather a client's site didn't appear on a public list.
Try it: ssllabs.com/ssltest
Hardenize
One page covering a domain's whole setup rather than just the certificate: encryption, DNS, email authentication and security headers, all colour-coded green, amber and red.
This is what I run when taking over a site from another agency, because it surfaces everything nobody thought to mention.
What's free: the full public report. Ongoing monitoring is the paid product.
Try it: hardenize.com
ðĻ Security headers and configuration
Headers are the cheapest security work you'll ever do. Most are a single line of server config or a plugin setting.
Security Headers
Grades your site A+ to F on the security headers it's sending, and explains what each one does and how to add it.
The most common grade across its 394 million scans is an F, so the bar is low. Getting to an A is usually about twenty minutes of work.
What's free: unlimited scans. Tick "hide results" if you don't want the domain appearing on the public boards.
Try it: securityheaders.com
Mozilla HTTP Observatory
Mozilla's version, now on MDN, and stricter than Security Headers. It scores things differently, so it's worth running both.
The screenshot above is this site: an A on Security Headers and a C here. Both are right. They're asking slightly different questions, and the stricter one gives you the better to-do list.
What's free: everything, and you don't need an account.
Try it: developer.mozilla.org/en-US/observatory
CSP Evaluator
A Content Security Policy is the header that controls what scripts a page is allowed to run. It's also easy to write one that looks protective but does nothing.
Paste yours in and this tells you whether it actually works. Worth doing before you trust an A+ from Security Headers.
What's free: everything.
Try it: csp-evaluator.withgoogle.com
ðĶ Malware and reputation scanning
If a site's been hacked, the owner is usually last to find out. These tell you what the rest of the world currently thinks of your domain.
Sucuri SiteCheck
First thing I check when a client says their site looks odd. It loads your pages the way a visitor would and looks for malware, spam links, dodgy redirects and out-of-date software.
It only sees what's publicly visible. A backdoor sitting in a PHP file that never gets served won't show up here, so a clean result covers the outside of the site and nothing more.
What's free: unlimited scans with no account.
Try it: sitecheck.sucuri.net
Google Safe Browsing Site Status
Tells you whether Google is showing a big red warning to people trying to visit your site. That warning appears in Chrome, Firefox, Safari and Android, so it costs you nearly all your traffic.
Check it after any security scare, and check it before you panic about a sudden drop in visitors.
What's free: everything.
Try it: transparencyreport.google.com/safe-browsing/search
urlscan.io
Opens a URL in a sandboxed browser and records everything it does, including a screenshot and every other site it contacts.
You can check a suspicious link without visiting it yourself, which helps when a client forwards you something from an email they're unsure about.
One thing to watch: public scans are permanently searchable by anyone. Set it to unlisted for anything that isn't a public page.
What's free: unlimited public scans. A free account gets you unlisted ones.
Try it: urlscan.io
Cloudflare Radar URL Scanner
Much the same job as urlscan.io, with Cloudflare's own threat data on top and a breakdown of what the page loads.
I run both when something looks off, since they categorise things differently.
What's free: everything, and you don't need an account.
Try it: radar.cloudflare.com/scan
â Code and markup validation
Browsers will render almost anything, which is why broken markup goes unnoticed. Screen readers, search crawlers and social media previews are far less forgiving.
W3C Nu Html Checker
The official HTML checker. Give it a URL, a file or some pasted code and it tells you what's wrong.
Not every warning needs acting on, but duplicate IDs and badly nested elements are worth fixing, because they break links and behave differently in different browsers.
What's free: everything.
Try it: validator.w3.org/nu
W3C CSS Validation Service
The same thing for stylesheets. Less essential than the HTML checker, since a broken CSS rule is usually just ignored, but it's the quickest way to find the stray bracket that's stopped half your styles working.
Set the profile to the latest CSS version, or it'll complain about perfectly good modern properties.
What's free: everything.
Try it: jigsaw.w3.org/css-validator
ð§ Email deliverability
If your site sends email at all, the form saying it sent and the message actually arriving are two different things. Nearly every delivery problem I've been called in to fix came down to a couple of missing DNS records.
Mail-Tester
Still the best five minutes you can spend on email. It gives you an address to send to, then scores your message out of 10 with a list of everything that's wrong.
Send it from the thing you're actually testing. A message from your webmail tells you nothing about what your contact form does.
What's free: three tests a day. There's also a set of separate free checkers on the site for your email DNS records.
Try it: mail-tester.com
MXToolbox
MXToolbox covers most of the rest: mail server lookups, spam blocklist checks, and all the DNS records email relies on.
The blocklist check is the one to run first when someone says their emails are going to spam. If your mail server is on a blocklist, nothing else you change will help until that's sorted.
What's free: the individual lookups. Monitoring and alerts are paid.
Try it: mxtoolbox.com
Learn and Test DMARC
A teaching tool disguised as a test. Send it an email and it draws the whole exchange as a diagram, showing each check as it happens and why your message passed or failed.
It's the clearest explanation of email authentication I've found, and it's explaining your email rather than a generic example.
What's free: everything.
Try it: learndmarc.com
dmarcian and EasyDMARC
To check a domain without sending anything, dmarcian's Domain Checker and EasyDMARC's free tools both look up your records and explain what's missing.
If you're setting DMARC up from scratch, start in monitoring mode and watch the reports for a few weeks before tightening it. Going straight to the strictest setting is how you discover which department has been using Mailchimp.
What's free: the record checkers on both.
Try it: dmarcian.com/domain-checker and easydmarc.com/tools
ð DNS and domain health
DNS is where a confident change on a Friday afternoon turns into a weekend. These show you what everyone else sees, rather than what your own computer has cached.
whatsmydns.net
Enter a domain and it checks it from servers around the world, showing green ticks and red crosses on a map.
This is the page you keep refreshing after moving hosts, waiting to know it's safe to switch the old server off. It's also handy for proving to a client that the change has gone through and it's their own connection that's behind.
What's free: everything.
Try it: whatsmydns.net
DNSChecker
The same job from a bigger pool of servers, with a pile of other lookup tools alongside it. Handy as a second opinion when whatsmydns.net gives you an answer you don't quite believe.
What's free: all the interactive tools.
Try it: dnschecker.org
intoDNS
Rather than just listing your DNS records, it checks whether the whole setup is healthy and tells you what's wrong in plain sentences.
It looks like it was built in 2008 because it was, and it still finds things nothing else here does.
What's free: everything.
Try it: intodns.com
DNSViz
If you've turned on DNSSEC, this draws the whole chain as a diagram and highlights anything broken in red.
Worth checking after any registrar or nameserver change, because DNSSEC doesn't fail gracefully. When it breaks, your domain simply stops resolving for a chunk of the internet.
What's free: everything. It's open source.
Try it: dnsviz.net
Dig Web Interface
A proper DNS lookup tool in the browser, for when you want the raw answer instead of a friendly summary.
You can ask a specific nameserver what it's serving, which means you can check your new host has everything right before you point the domain at it.
What's free: everything.
Try it: digwebinterface.com
ð Uptime monitoring
Everything above tells you about one moment. This tells you when something breaks.
UptimeRobot
Checks your site on a schedule and messages you when it stops responding, by email, SMS, Slack or a couple of dozen other things.
Set it to look for a word from your footer rather than just checking the page loads. A broken WordPress site often returns a blank page that still counts as working.
One catch: since December 2024 the free plan is for personal use only. Monitoring client sites needs a paid plan, from around âŽ7â9/month.
What's free: 50 monitors checked every 5 minutes, as long as it's for personal use.
Try it: uptimerobot.com
ðą Cross-browser and responsive testing
Responsively App
A free desktop browser built for responsive work. It shows your page at a dozen screen sizes at once, and scrolling or typing in one moves them all together.
Saves dragging a browser window to twelve different widths, and it works on local sites, which the hosted tools don't.
What's free: everything. It's open source, and runs on Windows, Mac and Linux.
Try it: responsively.app
Browserling
Gives you a real browser on a real machine that you can click around in, rather than a screenshot. Useful for reproducing the bug a client is describing in the exact browser they're using.
The free session is three minutes, which is usually enough to confirm or rule out a problem.
What's free: a three-minute session with no account. Paid plans start around $19/month.
Try it: browserling.com
Chrome DevTools device mode
Before reaching for anything hosted, Chrome can simulate different screen sizes and slow connections with Ctrl/Cmd + Shift + M.
It's no substitute for a real phone, since a simulated iPhone isn't an iPhone, but it catches most layout problems in seconds.
ðŠ Privacy and tracking
Blacklight
Scans your page and tells you exactly what's tracking your visitors: ad trackers, third-party cookies, tools that record what people type, and whether you're telling Facebook and Google who's been to your site.
You can't write an honest cookie notice without knowing what's actually loading, and "we don't really track anything" is usually wrong once marketing has had access to Tag Manager. It explains everything in plain English, so it's a good one to show a client.
What's free: everything.
Try it: themarkup.org/blacklight
ðą Sustainability and page weight
Website Carbon Calculator
Estimates the carbon footprint of a page based on how much data it sends and whether your host runs on renewable energy.
The exact number involves a lot of assumptions, so take it as a rough guide. Where it's genuinely useful is making page weight mean something to people who don't care about megabytes. "This page is heavier than 78% of sites tested" lands better than a file size.
What's free: everything, and there's a badge you can embed.
Try it: websitecarbon.com
Ecograder
A broader version of the same idea, scoring the page on weight, speed, findability and hosting, then giving you a list of what to change first. The greener thing and the faster thing are usually the same thing.
What's free: everything, while it's in beta.
Try it: ecograder.com
ð· Images and assets
Images are the biggest part of most pages, and compressing them is the easiest speed win there is.
Squoosh
Google's image compressor. It puts the original on one side and the compressed version on the other, with a slider between them and the new file size updating as you change the quality.
Everything happens in your browser, so the images stay on your computer. For photos, you can usually cut the file size dramatically before you can see any difference.
What's free: everything. It's open source.
Try it: squoosh.app
TinyPNG
For when you've got twenty images and no interest in fiddling with each one. Drag them in, get smaller files back. Despite the name, it handles JPEGs as well.
What's free: you can do 20 images at a time, up to 5MB each.
Try it: tinypng.com
ð§ Technology detection
BuiltWith
Tells you what a site is built with: the CMS, the host, the analytics, the payment processor, everything it can detect.
Good for sizing up a site you've inherited, since the list is effectively an inventory of every third party you're now responsible for.
What's free: the domain lookup. The paid plans run into the hundreds per month and aren't aimed at this.
Try it: builtwith.com
WhatRuns and Wappalyzer
Wappalyzer used to be the free option here, but it now limits how many lookups you get without paying. The browser extension is still handy.
WhatRuns is a free extension that does the same job with no limits.
𧰠All-in-one scanners
web-check.xyz
An open-source project by Alicia Sykes that runs about thirty checks on a domain at once and lays them out as a dashboard: DNS, certificates, headers, cookies, hosting, tech stack and more.
No single check goes as deep as the dedicated tool, but it's a quick way to work out where to look. I run it first on an unfamiliar site, then use the specialist tool for whatever looked wrong.
What's free: everything, and you can host it yourself if you'd rather not send client domains elsewhere.
Try it: web-check.xyz
ðŠĶ Tools that are gone or no longer worth using
Some of these still turn up in lists that haven't been updated in a while.
Google Mobile-Friendly Test. Retired in December 2023. Use Chrome's device mode or Responsively App for a quick look, and PageSpeed Insights for the speed side.
Google Structured Data Testing Tool. Retired in 2020 and replaced by the Rich Results Test and the Schema Markup Validator.
webhint.io's online scanner. Gone. webhint still exists as a browser extension and a command line tool. The page you could paste a URL into has gone.
Wappalyzer's free lookups. Now limited to a small monthly allowance. Use WhatRuns or BuiltWith instead.
Pingdom Website Speed Test. Still online, but it hasn't kept up with how pages are measured now. PageSpeed Insights or DebugBear will tell you more.
Accessibility overlay widgets. Not a testing tool, but they get suggested as a shortcut. They don't fix the underlying problems, and disabled users generally say they make sites harder to use.
ð Building a testing routine
Running everything once and then forgetting about it is how sites drift. A small, boring schedule works better.
Before you launch a site
- Nu Html Checker and a WAVE pass on each of your main templates
- SSL Labs and Security Headers, then fix anything below an A
- Mail-Tester with a real message from the real contact form
- PageSpeed Insights on the home page, a landing page and the heaviest page on the site
- Rich Results Test on your structured data
- Verify in Search Console and Bing Webmaster Tools and submit the sitemap
A monthly ten-minute check
PageSpeed Insights on your key pages, Security Headers, and a look at Search Console's Page Indexing report. If field data exists for your domain, CrUX Vis will show you the trend.
A longer check every few months
A Screaming Frog crawl for the broken links, redirect chains and missing metadata that pile up. Mozilla Observatory. Hardenize to catch anything that has drifted across the domain. Blacklight to see what's been added to your tag manager without anyone telling you.
And whenever something changes
- After a DNS or host change: whatsmydns.net, then intoDNS
- After a redesign or migration: httpstatus.io on your old URL list, then a Screaming Frog crawl
- After changing email providers: Mail-Tester and learndmarc.com
- After any security scare: Sucuri SiteCheck and Google Safe Browsing
- After a certificate renewal: SSL Labs, because incomplete chains are silent
And set up uptime monitoring properly, with a keyword check. It's the only item on this page that tells you about a problem instead of waiting for you to ask.
ð Quick reference
Every tool on this page, with what it does and what you get for free. Correct as of September 2026.
| Tool | For | Free tier |
|---|---|---|
| PageSpeed Insights | Performance, Core Web Vitals | Unlimited, no account |
| WebPageTest | Deep performance analysis | 300 runs/month with free account |
| GTmetrix | Client-friendly performance reports | Limited monthly tests, account required |
| DebugBear Speed Test | Readable performance reports | Free tests, 30+ locations with account |
| SpeedVitals | Multi-location speed and TTFB | 15 tests/week with free account |
| Yellow Lab Tools | Front-end code quality | Unlimited, open source |
| CrUX Vis | Core Web Vitals over time | Unlimited, no account |
| Google Search Console | Search performance and indexing | Free, verification required |
| Bing Webmaster Tools | Bing indexing, site scan, keywords | Free, verification required |
| Rich Results Test | Google rich result eligibility | Unlimited |
| Schema Markup Validator | Schema.org validation | Unlimited |
| Ahrefs Free | Site audit and backlinks | 5,000 crawl credits/month, own sites only |
| Screaming Frog | Full technical crawl | 500 URLs per crawl |
| httpstatus.io | Redirect chains, status codes | Bulk checks in browser |
| WAVE | Visual accessibility evaluation | Unlimited, plus extensions |
| axe DevTools | Zero-false-positive a11y scans | Free extension |
| Accessibility Insights | Guided manual a11y testing | Free, open source |
| WebAIM Contrast Checker | Colour contrast against WCAG | Unlimited |
| Qualys SSL Labs | TLS configuration grading | Unlimited |
| Hardenize | Whole-domain security report | Free public report |
| Security Headers | HTTP security header grading | Unlimited |
| Mozilla HTTP Observatory | Stricter header and config audit | Unlimited |
| CSP Evaluator | Finding CSP bypasses | Unlimited |
| Sucuri SiteCheck | Malware and blocklist scan | Unlimited |
| Google Safe Browsing | Browser warning status | Unlimited |
| urlscan.io | Sandboxed page inspection | Unlimited public scans |
| Cloudflare URL Scanner | Sandboxed scan with threat intel | Unlimited |
| W3C Nu Html Checker | HTML validation | Unlimited |
| W3C CSS Validator | CSS validation | Unlimited |
| Mail-Tester | Spam score and authentication | 3 tests per 24 hours |
| MXToolbox | MX, blocklist, SMTP diagnostics | Interactive lookups |
| Learn and Test DMARC | Visual SPF/DKIM/DMARC walkthrough | Unlimited |
| dmarcian Domain Checker | DMARC/SPF/DKIM record check | Unlimited |
| EasyDMARC free tools | SPF, DKIM, DMARC and domain checks | Free interactive tools |
| whatsmydns.net | Global DNS propagation | Unlimited |
| DNSChecker | Propagation plus DNS toolbox | Unlimited |
| intoDNS | DNS zone health audit | Unlimited |
| DNSViz | DNSSEC chain visualisation | Unlimited, open source |
| Dig Web Interface | Precise DNS queries | Unlimited |
| UptimeRobot | Uptime and keyword monitoring | 50 monitors, 5 min, personal use only |
| Responsively App | Multi-viewport responsive testing | Free, open source |
| Browserling | Live cross-browser sessions | 3-minute session, one browser |
| Blacklight | Tracker and fingerprinting audit | Unlimited |
| Website Carbon | Emissions per page view | Unlimited |
| Ecograder | Sustainability scoring | Free beta |
| Squoosh | Local image compression | Unlimited, runs in browser |
| TinyPNG | Bulk image compression | 20 images at a time, 5MB each |
| BuiltWith | Technology detection | Free domain lookup |
| WhatRuns | Technology detection | Free extension, no limits |
| web-check.xyz | ~30 checks in one sweep | Free, self-hostable |
Last checked September 2026. Free tiers move around a lot, so if something here is out of date, leave a comment and I'll fix it.
