About this tool
The requests it makes
For each domain checked, it does only this:
- Public DNS lookups (A/AAAA, CNAME, NS, MX), and DNS lookups at Team Cymru to find the network operator (AS) of each address. Your browser sends them to Cloudflare's DNS over HTTPS (
cloudflare-dns.com); they never reach the site. - One ordinary GET of the front page (
/), sent from this site's server (Cloudflare Workers), trying https, www and http in that order and stopping at the first that answers. Redirects are followed, at most 8 requests and 15 seconds in total. The answer is checked for signs of PHP and for the names (not values) of headers that platforms such as Railway, Zeabur and Vercel add. - The start of one TLS 1.2 connection to the site's port 443, sent from this site's server (Cloudflare Workers) to an address already checked to be public. It reads the name of the certificate authority from the certificate the server sends first, then closes the connection: no key exchange and no page request.
It never requests any other URL, and sends no attack requests, login attempts, directory scans or port scans. The User-Agent is OpenVMap/version with a link to this page.
No LLM is used to check a site. Every conclusion can be reproduced from the recorded observations.
What it stores
It keeps no list of checked domains. On the result page the domain sits after the # in the URL, the part browsers never send to a server, and it reaches the server only for the PHP check, in the request body rather than the URL. The server keeps no request logs.
To stop many requests reaching one site, PHP check results are kept for one hour, under a value the domain cannot be recovered from (a hash with a secret added). The rate limit (10 a minute) uses the same kind of value made from the client address; the address itself is not stored.
Information sent to third parties
To run a check, your browser sends the following. Nothing is sent for ads, analytics or social media, and no cookies are set.
- Recipient: Cloudflare, Inc. (
cloudflare-dns.com) - What is sent: DNS lookups for the domain being checked and the host names and addresses the check needs. Your IP address reaches them too, as with any connection.
- Purpose: public DNS and routing lookups
- Handling: under Cloudflare's public DNS resolver privacy policy.
This site itself runs on Cloudflare, so page views and the PHP check pass through Cloudflare.
Which domains to check
Use it on domains you manage or were asked to check. Result pages are not indexed by search engines.
About the provider statuses
Each provider's status is written from what the provider has published. It can be wrong, so always check the source. “Official notice” means the provider's own page; “secondary source” means press or third-party summaries. “Unknown” means no official notice could be found, not that the provider has done nothing. Every status shows the date it was checked, and links its source where there is one.
Providers: if something is wrong or you have published an update, please tell us and we will correct it promptly.
For site administrators
A request from this tool is one ordinary visit to the front page of a domain a user typed in. Questions or exclusion requests: open an issue on GitHub.
Terms and disclaimer
- This tool is free and run by an individual.
- Results are estimates from public data and one response from the front page. PHP's patch state cannot be seen from outside; confirm with whoever runs your server or your web agency.
- No guarantee is made that results or listed information are accurate or complete. To the extent permitted by law, the operator is not liable for any loss arising from use of this tool.
- The content may change and the service may stop without notice.
Source code and license
The source code is on GitHub. The code is MIT licensed; the provider status data (data/providers.yaml) is CC BY 4.0.