Free API

Base URL

https://api.webstatbot.com/

Quick example

curl "https://api.webstatbot.com/checkup?url=example.com"

Limits

No key needed. Rate-limited per address: 300 requests/hour — heavier tools (rbl, propagation, exposed, …) count for more than one against that limit.
Per target domain: at most 20 checks of that domain across every tool and every visitor, every 10 minutes.
Successful responses are cached for a few minutes server-side — identical requests close together may come back from cache rather than re-running the check.

Machine-readable spec

Download openapi.json Open in Swagger Editor

Endpoints

Web & reachability

Endpoint	Params	Description
`GET /checkup`	`url`*	dns → whois → connect → http, in order, and says exactly where it fails.
`GET /diagnostics`	`url`*	Everything checkup does, plus the canonical URL — where redirects really end up.
`GET /headers`	`url`*	Apex and www fetched separately, redirects not followed, so you see what each sends first.
`GET /security`	`url`*	HTTPS, the redirect to it, common security headers, and a calibrated exposed-path check.
`GET /a11y`	`url`*	Static HTML check: lang, title, alt text, form labels, heading order, link text, zoom.
`GET /share_preview`	`url`*	Reads Open Graph/Twitter tags and actually fetches the preview image to confirm it resolves.
`GET /hosting`	`url`*	IP, PTR and network owner for the web and mail infrastructure behind a domain.
`GET /robots`	`url`*	Parsed per agent: allow, disallow, crawl-delay, plus any sitemaps it declares.
`GET /redirects`	`url`*	The full hop-by-hop path a URL takes, up to 12 hops, flags a loop.

DNS & domain

Endpoint	Params	Description
`GET /dns`	`url`* `types`	A, AAAA, MX, TXT and more — pick the types you need, plus SPF/DMARC presence.
`GET /whois`	`url`*	Registrar, status, expiry date and nameservers, straight from the registry.
`GET /dnssec`	`url`*	Confirms DS/DNSKEY records exist — not a full cryptographic chain validation.
`GET /propagation`	`url`* `type`	Google, Cloudflare and Quad9 queried independently; a resolver that fails shows its own error.
`GET /subdomains`	`url`* `resolve`	Names found in Certificate Transparency logs, optionally resolved too.

Network & mail

Endpoint	Params	Description
`GET /mailcheck`	`url`*	MX, SPF, DMARC, DKIM (common selectors) and rDNS, rolled into one score.
`GET /rbl`	`url`*	Every zone is calibrated first — one that blocks public resolvers is reported as “blind”, never a false listing.
`GET /rdns`	`url`*	PTR records and whether they forward-confirm back to the IP (FCrDNS).
`GET /myip`	—	The address this request reached us from — useful when scripting against the API.

Security tools

Endpoint	Params	Description
`GET /ping`	`url`*	Round-trip time to a site over a few HTTP requests — min/avg/max, not ICMP.
`GET /exposed`	`url`* `confirm`* `extra`	.env, backups, feed-export scripts and other commonly-leaked paths — paste your own list too (up to 40 total), after you confirm it's your site.

Reference

Endpoint	Params	Description
`GET /catalog/bots`	—	The bot id, label and User-Agent string used by bot-identification tooling elsewhere on the site.

Playground

Pick an endpoint, enter a URL or domain, and send a real request — this calls the live API exactly like your own code would, and shows the exact request URL plus the raw response.