All checks
440 procedures, grouped by the part of the stack they test. Each page gives the shortest working check first, then the steps, the real output and what a failure means.
Security headers and TLS
- How to check certificate chain
- How to check certificate revocation
- How to check certificate SAN
- How to check cipher suites of a server
- How to check cookie flags with curl
- How to check CSP header
- How to check HSTS preload status
- How to check HTTP to https redirect
- How to check if a certificate is self-signed
- How to check if a site is vulnerable to clickjacking
- How to check if a website supports TLS 1.3
- How to check if cookies are secure and HttpOnly
- How to check if HSTS is enabled
- How to check if mixed content exists on a page
- How to check if OCSP stapling is enabled
- How to check if TLS 1.0 is disabled
- How to check permissions-policy header
- How to check referrer-policy header
- How to check SameSite cookie attribute
- How to check security headers
- How to check SSL certificate expiry
- How to check SSL certificate from command line
- How to check SSL certificate in chrome
- How to check subresource integrity
- How to check the TLS handshake
- How to check TLS version of a website
- How to check X-Content-Type-Options
- How to check X-Frame-Options
- How to test SSL configuration
- X-XSS-Protection deprecated
Performance and delivery
- How to check alt-svc header
- How to check cache-control header
- How to check CLS
- How to check content-encoding
- How to check DNS lookup time
- How to check ETag header
- How to check HTTP/3 support
- How to check if a redirect is 301 or 302
- How to check if a site uses a CDN
- How to check if a website uses HTTP/2
- How to check if brotli is enabled
- How to check if CDN cache is hit or miss
- How to check if gzip is enabled
- How to check if images are lazy loaded
- How to check if keep-alive is enabled
- How to check last-modified header
- How to check LCP of a page
- How to check number of requests on a page
- How to check page size
- How to check preload and preconnect hints
- How to check redirect chain
- How to check render blocking resources
- How to check stale-while-revalidate
- How to check TTFB
- How to check vary header
- How to test core web vitals
API checks
- How to check API endpoint
- How to check API response time
- How to check API versioning
- How to check content-type of API response
- How to check CORS configuration
- How to check HTTP response headers with curl
- How to check HTTP status code
- How to check if API returns valid JSON
- How to check JWT algorithm
- How to check JWT expiration
- How to check rate limit headers
- How to decode JWT
- How to test API authentication
- How to test API concurrency
- How to test API error responses
- How to test API idempotency
- How to test API pagination
- How to test API rate limiting
- How to test API timeout handling
- How to test API with curl
- How to test API with invalid input
- How to test CORS with curl
- How to test preflight request
- How to test retry-after header
- How to test webhook delivery
- How to validate cron expression
- How to validate JSON against schema
- How to validate OpenAPI spec
- How to verify JWT signature
Authentication and sessions
- How to check authorization header
- How to check cookie expiry
- How to check if refresh token works
- How to check if session expires after logout
- How to check session fixation
- How to check session id
- How to check session timeout
- How to test account lockout after failed logins
- How to test authorization code flow with curl
- How to test basic auth with curl
- How to test change password flow
- How to test concurrent sessions
- How to test CSRF protection
- How to test digest auth with curl
- How to test email verification link
- How to test expired token
- How to test login functionality
- How to test login with curl
- How to test logout invalidates token
- How to test oauth login flow
- How to test oidc
- How to test password reset flow
- How to test remember me functionality
- How to test totp
- How to test two factor authentication
Accessibility
- How to check a website for color blindness
- How to check accessibility tree
- How to check alt text on images
- How to check aria hidden elements are not focusable
- How to check aria labels
- How to check color contrast ratio
- How to check focus order
- How to check heading structure of a page
- How to check if a form is accessible
- How to check landmark regions of a page
- How to check lighthouse accessibility score
- How to check link text for accessibility
- How to check tap target size
- How to check the html lang attribute
- How to check visible focus indicator
- How to run an axe accessibility test
- How to test a focus trap in a modal
- How to test a page at 200 percent zoom
- How to test a skip to content link
- How to test aria attributes
- How to test aria live regions
- How to test keyboard navigation on a website
- How to test prefers reduced motion
Frontend and browser checks
- How to check console errors on a website
- How to check DOM size of a page
- How to check favicon of a website
- How to check for broken links on a website
- How to check if a javascript file is loaded
- How to check if a service worker is registered
- How to check if service worker is updated
- How to check localstorage in chrome
- How to check localstorage size
- How to check memory leak in a web page
- How to check session storage in chrome
- How to check viewport meta tag
- How to check web manifest
- How to check what a service worker has cached
- How to check which file types a file input accepts
- How to check which srcset image the browser loaded
- How to check which third party scripts a page loads
- How to find broken images on a website
- How to find css breakpoints of a website
- How to find detached DOM nodes
- How to find what causes horizontal scroll on mobile
- How to test a 404 page
- How to test file upload size limit
- How to test form validation messages
- How to test offline mode in chrome devtools
- How to test print styles of a page
- How to test responsive design
Crawlability and indexing
- How to check 410 vs 404 response
- How to check a self-referencing canonical
- How to check canonical tag
- How to check hreflang tags
- How to check if a page is indexable
- How to check if a page is noindex
- How to check if a staging site is indexable
- How to check if a url is blocked by robots.txt
- How to check if googlebot can render javascript
- How to check if server side rendering is working
- How to check json ld
- How to check meta title and description of a website
- How to check nofollow links
- How to check og image
- How to check open graph tags
- How to check rel next and rel prev pagination tags
- How to check robots.txt
- How to check sitemap and robots txt
- How to check sitemap index file
- How to check sitemap lastmod
- How to check soft 404
- How to check twitter card tags
- How to check www vs non-www canonical URL
- How to check x-robots-tag
- How to validate hreflang tags
- How to validate sitemap xml
- How to validate structured data
- How to view a page as googlebot
Email and DNS
- How to check a record of domain
- How to check cname record
- How to check DKIM record
- How to check DKIM selector
- How to check DMARC alignment
- How to check DMARC record
- How to check dns cache
- How to check dns propagation
- How to check dns records
- How to check dns ttl
- How to check if an email has passed SPF DKIM and DMARC
- How to check if dnssec is enabled
- How to check if email bounced
- How to check List-Unsubscribe header
- How to check MTA-STS
- How to check mx records
- How to check ns record
- How to check ptr record
- How to check SPF lookup limit
- How to check SPF record
- How to check txt record of a domain
- How to test email sending in a test environment
- How to test SMTP connection
- How to test transactional email rendering
- How to verify DKIM signature
- Test SMTP with STARTTLS
CI and test suite quality
- How to check branch coverage
- How to check code coverage threshold
- How to check dependency tree npm
- How to check environment parity
- How to check eslint errors
- How to check for secrets in a git repository
- How to check if a build is reproducible
- How to check if a npm package is installed globally
- How to check if package lock is in sync
- How to check installed npm package version
- How to check node version of a project
- How to check npm package licenses
- How to check npm packages for vulnerabilities
- How to check outdated npm packages
- How to check prettier formatting
- How to check test coverage
- How to check typescript errors
- How to check unused dependencies in package json
- How to check which tests are slowest
- How to check why a package is installed
- How to detect flaky tests
Localization and formats
- How to change locale in chrome
- How to change timezone in chrome for testing
- How to check accept language header
- How to check for garbled characters from the wrong encoding
- How to check for missing translations
- How to check if a page is UTF-8
- How to check if text is truncated
- How to check JSON encoding
- How to check string length with emoji
- How to check the browser locale
- How to check the encoding of a CSV file
- How to check the encoding of a file
- How to check the thousand separator and decimal separator
- How to test currency formatting
- How to test date format in different locales
- How to test daylight saving time
- How to test pluralization
- How to test rtl layout
- How to test text expansion in translations
- How to test timezone handling
- How to test unicode input
Payments and webhooks
- Card expiry date validation
- Github webhook signature verification
- How to check currency rounding
- How to check webhook signature
- How to test duplicate payment prevention
- How to test webhook retries
- Luhn check
- Price tampering
- Stripe webhook signature verification
- Webhook dead letter queue
- Webhook idempotency
- Webhook ordering
- Webhook replay attack
- Webhook signature verification failed
- Webhook timeout
- Zero decimal currency
WebSockets and realtime
- Eventsource auto reconnect
- How to check if websocket is secure
- How to check websocket connection in chrome
- How to check websocket message order
- How to check websocket origin validation
- How to check websocket ping pong
- How to test server sent events
- How to test websocket connection
- How to test websocket latency
- How to test websocket message size limit
- How to test websocket reconnect
- How to test websocket with curl
- Long polling test
- Socket io connection test
- Websocket authentication jwt
- Websocket binary frame
- Websocket close code 1006
- Websocket compression
- Websocket connection timeout
- Websocket handshake failed
- Websocket max connections
- Websocket subprotocol
Logging and observability
- Access log format
- Deep health check
- Health check timeout
- How to check correlation id in logs
- How to check log level in production
- How to check logs for pii
- How to check metrics endpoint
- How to check trace propagation between services
- How to test a health check endpoint
- How to test logging
- Json logging format
- Prometheus metrics endpoint authentication
- Prometheus text exposition format
- Readiness probe vs liveness probe
- Sensitive data in logs
- Trace id in logs
- Traceparent and tracestate
- Traceparent header format
- X request id header
Databases and migrations
- How to check data integrity after migration
- How to check database collation
- How to check database integrity
- How to check database locks
- How to check database schema version
- How to check duplicate rows in sql
- How to check foreign key
- How to check if a query uses an index
- How to check if a table has an index
- How to check missing indexes
- How to check table schema
- How to check timezone stored in database
- How to check transaction isolation level
- How to check transaction rollback
- How to compare database schemas
- How to find slow queries
- How to test connection pool exhaustion
- How to test database migration
- How to test unique constraint
- How to verify a database backup
- How to verify row counts after migration
Privacy and consent
- How to check a consent record
- How to check browser fingerprinting
- How to check cookies on a website
- How to check do not track
- How to check for pii in urls
- How to check for tracking pixels
- How to check global privacy control
- How to check if a site honors global privacy control
- How to check if analytics ip is anonymized
- How to check if consent mode is enabled
- How to check if cookies are set without consent
- How to check if local storage is used before consent
- How to check if third party cookies are blocked
- How to check if tracking scripts load before consent
- How to check referer header
- How to check which third parties receive data
- How to revoke cookie consent
- How to test cookie consent banner
- How to test data deletion request
- How to test data export feature
Load and stress checks
- Error rate in performance testing
- How to check connection limit of a server
- How to check memory growth under load
- How to check p95 latency
- How to check requests per second an api can handle
- How to measure event loop lag
- How to read load test results
- How to run a soak test
- How to stress test an api
- How to test concurrent users
- How to test graceful degradation
- How to test load balancing
- How to test rate limiter under burst
- Load test ramp up time
- Spike testing in software testing
Test environments and doubles
- How to check config drift between environments
- How to check feature flags in test environment
- How to check for secrets in environment variables
- How to check if env variable exists
- How to check seed data in test database
- How to check test isolation
- How to check why jest did not exit after tests
- How to detect parallel test interference
- How to mock date in jest
- How to mock environment variables in vitest
- How to mock fetch in vitest
- How to reset mocks between tests
- How to run jest tests with a specific timezone
- How to simulate slow network in chrome
- How to spy on a function in jest
- How to test with a mock server
- How to test with fake time
- How to verify a mock was called
File uploads and media
- How to check archive expansion limits on upload
- How to check content disposition header
- How to check exif data is removed from an uploaded image
- How to check file name length
- How to check file type
- How to check if file type is validated on the server
- How to check path traversal in an uploaded file name
- How to check sha256 of a file
- How to check zip file contents
- How to test a unicode file name in content disposition
- How to test an interrupted file upload
- How to test image dimension limits on upload
- How to test multipart form data
- How to test uploading a file with a double extension
Background jobs and queues
- How to check a background job is idempotent
- How to check cron schedule drift
- How to check if a cron job is still running
- How to check if a cron job ran
- How to check if a queue worker is running
- How to check job order in a queue
- How to check queue depth and consumer lag
- How to test a stuck background job
- How to test duplicate job execution
- How to test graceful shutdown
- How to test job timeout and cancellation
- Why is my cron job not running
Forms and input validation
- Autofill testing
- How to check date input parsing in a form
- How to check field length limits in a form
- How to check required field validation
- How to check where focus lands after a validation error
- How to test double form submission
- How to test form data is kept after a failed submit
- How to test that client validation is enforced on the server
- How to test whitespace trimming in a form field
- HTML input pattern validation
- Input type email validation
- Input type number validation
- Paste event javascript
Data export and import
- Csv scientific notation
- How to check an export respects the filters applied
- How to check date format in an export
- How to check duplicate rows on import
- How to check formula injection in a csv export
- How to check leading zeros in a csv export
- How to check the delimiter of a csv file
- How to compare two csv files
- How to count rows in a csv file
- How to escape quotes in CSV
- How to test a large data export
- How to test a partially applied import
- How to test csv export encoding in a spreadsheet
- How to test csv import validation