/tools
Tools
Small, focused web utilities I keep reaching for while writing the blog — so you (and I) can stop pasting URLs into five different validators every time a post ships.
Security
9 tools · readyHeaders, certificates, cookies, DNS. The boring fundamentals you only notice when they fail in production at 2am.
Headers analyzer
Inspect CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy and the COOP/COEP/CORP isolation trio. Grade each against current OWASP guidance.
CSP builder
Compose a Content-Security-Policy directive by directive with live validation, then send a synthetic violation to your report endpoint.
CORS preflight
Replay an OPTIONS preflight against a real endpoint and inspect every Access-Control-* response header against the request you describe.
Cookies
Audit every Set-Cookie for SameSite, Secure, HttpOnly, and the newer Partitioned (CHIPS) attribute. Highlight cookies that would break under third-party blocking.
HSTS preload
Check the Strict-Transport-Security header against Chrome’s preload rules — max-age ≥ 1y, includeSubDomains, and the preload directive — before you submit the form.
security.txt
Validate fields against RFC 9116. Confirms Expires is in the future and that the required Contact field is present.
CAA records
List the CA Authorization records for a domain and explain which issuers are permitted (and which are accidentally locked out).
Cache headers
Inspect Cache-Control, ETag, Last-Modified, Vary, Age, and Expires to see exactly how browsers and CDNs will cache — or refuse to cache — a response.
Compression
Negotiate gzip, Brotli, and Zstandard against a URL and confirm which encodings the server actually serves — plus whether it advertises Vary correctly.
SEO & structured data
7 tools · readyRobots, sitemaps, JSON-LD, hreflang, and core meta — the unglamorous fundamentals search depends on.
Meta inspector
Audit title, description, canonical, robots, viewport, charset, and every other meta tag against real length and indexability rules.
JSON-LD validator
Decode every schema.org graph on a page, validate required fields, and preview rich-result eligibility for Article, Product, Breadcrumb, and FAQ.
SERP preview
See how a page renders as a Google result on desktop and mobile, with live pixel-width truncation for the title and description.
Canonical check
Reconcile the canonical link, og:url, HTTP Link header, and redirect target — and flag when they disagree.
hreflang validator
Extract every language alternate and run reciprocity checks — catching missing return links, x-default gaps, and region mismatches.
robots.txt
Fetch and lint a site’s robots.txt, test whether any path is allowed for a given crawler, and generate a fresh file from a form.
sitemap.xml
Validate a sitemap or sitemap index for well-formedness and limits, and generate one from a list of URLs.
RSS & Feeds
3 tools · readyValidate, preview, and convert syndication feeds — RSS 2.0, Atom, RSS 1.0/RDF, and JSON Feed — against each spec.
Feed validator
Fetch a feed and lint it against its spec — required channel/item fields, parseable dates, unique ids, and format-specific rules for RSS, Atom, and JSON Feed.
Feed preview
Render a feed the way a reader would — item titles, dates, authors, and a plain-text summary — so you can see what subscribers get.
Feed converter
Paste or fetch a feed and convert between RSS 2.0 and JSON Feed, with notes on anything the target format cannot represent.
Performance
3 planned · coming soonLightweight checks — bundle inspection, font-loading audits, and image weight at a glance. Not a full Lighthouse replacement.
Font loading audit
Detect FOIT/FOUT risk, missing preloads, and oversized subsets.
Image weight ranker
Sort every image on a page by transferred bytes and DPR overdraw.
Cache header check
Show Cache-Control, ETag, and CDN hints across all assets.
Accessibility
2 planned · coming soonPractical spot-checks for color contrast, landmarks, and focus order. Don’t treat as a substitute for assistive-tech testing.
Contrast scanner
Sample every text/background pair on a page against WCAG AA & AAA.
Landmark outline
Render the implicit document outline a screen reader would build.
Code & syntax
3 planned · coming soonSnippet utilities for the things you copy-paste five times a day.
JWT inspector
Decode header + payload locally and verify against a JWK.
Base64 / URL helper
Encode, decode, URL-safe variants, and detect mojibake.
Regex playground
Match against multi-line samples with capture-group highlighting.
Social & sharing previews
7 tools · readyInspect, validate, and preview how a URL renders across every major platform — from Open Graph to Apple Smart App Banners.
OG preview
Render how a URL looks on Facebook, LinkedIn, Slack, Discord, iMessage, and more — and lint the meta tags against each platform’s rules.
X Card
Verify a page renders as summary, summary_large_image, app, or player. Check fallbacks when twitter:* is missing and og:* takes over.
LinkedIn post
See how the link unfurls on a feed post and inside a DM. LinkedIn caches aggressively — clear and re-scrape from the panel.
Rich Pin
Validate Article, Product, or Recipe Rich Pins. Confirms required schema.org fields and Pinterest-specific overrides.
Favicons
Check every icon size, Apple touch icon, Android maskable, Safari pinned tab SVG, and Windows tile. Flags missing or wrong-dimension files.
Smart App Banner
Inspect the apple-itunes-app meta tag. Verifies the app-id resolves and that the affiliate / argument parameters parse correctly.
oEmbed
Probe /oembed?url=… for JSON and XML responses. Validates required fields per type (photo, video, link, rich).