How We Measure

The rule everything else follows

No value on this site is ever estimated, interpolated, or filled in from a previous run. A tool either has a real answer from a real lookup, or it says which step failed and why. There is no third state.

This matters more here than on most sites, because this site earns money from affiliate links that are triggered by findings. A tool that could shade a result toward a commission would be worthless, and would be found out. So the measurement code has no knowledge of which partners exist, and the thresholds it compares against are published industry ones — Google’s Core Web Vitals cut-offs, the CA/Browser Forum’s certificate rules — not numbers we chose.

Where each number comes from

Tools marked below as phase 2 or phase 3 are not built yet. They are listed so the roadmap is visible, and each entry describes exactly what that tool will query when it ships.

• DNS Checker — queries four independent public resolvers (Google, Cloudflare, Quad9 and OpenDNS) over DNS-over-HTTPS and reports each answer separately. Answers are never merged: a disagreement between resolvers is the finding, not noise to be smoothed away.
• SSL Checker — opens a TLS connection to the host and reads the certificate chain it actually presents. Issuer, validity window, chain completeness and negotiated protocol are read from that connection, not from a third-party certificate database.
• WHOIS Lookup — queries the registry over RDAP, the standardised JSON successor to WHOIS. Where a registrant’s details are redacted under GDPR, the redaction is shown as a redaction. We do not attempt to work around it, and we do not substitute an older unredacted record from elsewhere.
• Website Speed Test — Core Web Vitals come from Google’s PageSpeed Insights API: Lighthouse for lab data, and the Chrome User Experience Report for field data from real Chrome users. Server response time is measured separately by our own probes in several regions, which is the one number Google does not publish.
• Website Down Checker — issues HTTP requests from several regions and reports each region’s status code and response time individually, so a regional outage can be told apart from a global one.
• Redirect Checker — follows a redirect chain one hop at a time without automatic redirect handling, so every intermediate URL and status code stays visible.
• Domain Name Generator — name candidates are generated by a language model; availability is not. Availability comes from a DNS pre-filter followed by an RDAP query against the registry. There is one registry per top-level domain, so availability is identical at every registrar — only price differs.
• WordPress Theme Detector — parses the site’s publicly served HTML for theme and plugin paths, then reads the theme’s own style.css header and the public WordPress.org plugin directory. No private endpoint is touched.

The transcript

Every result on this site ends with a transcript: the raw exchange that produced the verdict above it. Which resolver or endpoint was queried, what it returned, how long it took, and whether the answer was live or came from cache.

It is plain selectable text rather than an image, for a practical reason — you can take any line from it, run the equivalent dig, openssl s_client or curl -I yourself, and confirm we are telling the truth. A methodology page you have to believe is worth much less than one you can test.

Caching and rate limits

Results are cached so that repeated checks of the same target do not hammer public infrastructure that is provided to everyone for free. Cache lifetimes are tuned to how fast each kind of data actually changes: DNS is checked repeatedly during a migration and so is cached for minutes, while registration records barely move and are cached for a day.

Every result states its own cache age in the transcript, so you always know whether you are looking at a live measurement or a recent one.

TOOL                      CACHE  RATE LIMIT  STATUS
───────────────────────────────────────────────────
DNS Checker                  5m    30 / min  live
SSL Checker                  1h    20 / min  live
WHOIS Lookup                24h    20 / min  live
Website Speed Test           6h     5 / min  live
Website Down Checker         1m    20 / min  live
Redirect Checker             1h    20 / min  live
Domain Name Generator       10m     4 / min  live
WordPress Theme Detector    24h    15 / min  live

Rate limits exist because public endpoints get scripted. They are per IP and per tool, so hitting the limit on one tool does not lock you out of the others. If you have a legitimate reason to run these checks in bulk, get in touch rather than working around the limit — the limit is protecting the upstream services, not us.

What our crawler does

Some tools need to fetch a page’s public HTML. When they do, they follow the same rules a well-behaved crawler follows:

• Requests identify themselves honestly as SiteCheckToolsBot/1.0 (+https://sitechecktools.com/how-we-measure/). We never impersonate a browser to get past a block. Some sites will refuse us because of this, and that is the correct outcome.
• robots.txt is checked before any page HTML is fetched. An explicit Disallow stops the fetch and the tool reports that it stopped, rather than returning a blank result.
• Every outbound request has a hard 10-second timeout, and response bodies are read up to a size cap and then abandoned. Nothing we fetch can hang or exhaust memory.
• Only publicly accessible content is fetched. No authentication is attempted, no cookies are sent, and no private endpoint is probed.
• Fetched content is used to produce the result and is not retained beyond the cache lifetime listed above.

What we refuse to check

Some targets are rejected before any request is made. Private and reserved address space — loopback, RFC 1918 ranges, link-local addresses including the 169.254.169.254 cloud metadata endpoint, and internal-use suffixes like .local and .internal — is blocked outright.

This is checked twice: once on the hostname you typed, and again after DNS resolution, because a public-looking domain can point at a private address. Redirect chains are re-checked at every hop for the same reason. A tool that will fetch any URL you give it is an open proxy into whatever network it runs on.

What we store

No accounts, no saved reports, no history. The domain or URL you submit is used as a cache key for the lifetime shown in the table above, and then it is gone. There is no database. See the privacy policy for the full detail.

When a check fails

Failures are reported as failures, with the reason. A timeout says the host did not respond in time. A blocked target says the address is private. A rejected lookup says the upstream source refused it. None of these produce a number.

Where a tool runs several independent lookups — four DNS resolvers, several probe regions — a partial failure is shown as a partial failure. Three answers and one error is reported as three answers and one error, not as three answers.

Corrections

If a result here disagrees with a result you trust, we want to know, and the transcript should make it possible to say exactly where the two diverge. Email hello@sitechecktools.com with the transcript and what you expected. Methodology changes are noted with the update date at the top of this page.