Bridge WAF
WAF tools: check headers, addresses and reputation
Five checks, each answering one question about a site or an address. They run in the browser without an account, and every one is paired with the page explaining what its answer means, since a lookup on its own tells you what is true without telling you what to do about it.
What is here
Security headers. Reads the protective headers a site returns and shows what is present, what is missing, and what each one is for. The rules behind them are covered under rules.
Address reputation. Reports what is known about an address from public sources, which is the input behind most reputation-based decisions rather than a verdict about the address itself. Paired with IP reputation.
Blocklist check. Answers a narrower question: whether an address appears on public lists. That is a different question from reputation, and the two are worth keeping apart, because presence on a list is a fact while reputation is an interpretation.
Botnet lookup. Reports whether an address is associated with known automated networks, which is useful when a pattern in your logs comes from somewhere you do not recognise and you need to know whether it is worth investigating further.
Firewall detection. Identifies whether a site sits behind a filtering layer, from what its responses reveal. Useful mostly when inheriting infrastructure nobody documented, where the first question is what is already in the path.
What is not here, and why
One thing is missing on purpose.
There is no attack test. A tool that generates load against a site you name is indistinguishable from the thing it claims to help you defend against, and running one against infrastructure you do not own is not ours to offer. Testing resilience is a legitimate need and belongs in an arrangement where both sides know it is happening, not behind a button on a public page.
What these tools do instead is describe what is observable: what a site returns, what is published about an address, and what a pattern resembles. Deciding what to do about it is covered under operations.
Questions
Do these tools need an account?
No. Each one answers a single question in the browser without registration. The address lookups report what public sources say rather than anything about your own site, and nothing you check here is kept against your domain or shared anywhere.
A lookup describes what is observable. What to do about it is a decision, and the safe place to make it is while nothing is being refused.
off
Nothing is inspected. Traffic reaches your origin as it otherwise would.
monitor
Requests are inspected and matches recorded. Nothing is refused while you watch.
block
Matching requests are refused rather than forwarded, and still recorded.