Check a list — one domain at a time
Up to 25 domains per run. Each one is checked sequentially, with a pause between requests, so the tool stays a polite visitor rather than a scanner. Results download as CSV.
Why one at a time, deliberately. Parallel checks are how a useful tool becomes a nuisance: 25 domains at once looks exactly like an attack from the other side, and gets you blocked by the very firewalls you are trying to assess. Sequential checks finish in about 30 seconds for 25 domains and produce better data, because a site that is slow under load is not the same as a site that is vulnerable.
Domains
One per line. Scheme optional (example.com and https://example.com both work). Blank lines are ignored.
Bigger than 25?
The public endpoint is capped on purpose — it is one shared function, and a thousand parallel users would make it useless for everyone. If you have a real inventory, run your own copy: same code, your own rate limits, your own logs. That is a 10-minute job and it is documented step by step.
How to read the results
- Vulnerable — a version was confirmed and it is below the fixed release for its branch. Act on it.
- Fixed — a version was confirmed at or above the fixed release. Still confirm the workers were restarted.
- Unknown — the server did not advertise a version. This is the common case and it is not a pass. The definitive check is on the server itself.
Need this run across an estate, with evidence?
A CSV of domains and verdicts is a starting point, not an audit trail. Version inventory, restart evidence and compromise checks are what hold up later.
Talk to someone