Qualys [1][2] For testing SSL of publicly accessible sites. TestSSL.sh [3] for testing SSL of any site including private endpoints you can reach from your machine Only requires openssl and bash. SecurityHeaders [4] for testing what headers are missing from a website. URLScan [5] for diagnosing a websites behavior. bgp.he.net [6] for looking up information about an IP/AS Number/domain. Robtex [7] also for looking up information about IP/AS/domain as well as org mapping. WhatIsMyDNS [8] for checking DNS propagation re-run this 3 times as their probe timeouts are way too low. Old-school VirusTotal [9] for old browsers for scanning malware. WhoisDS [10] targeting newly registered domains. Mozilla TLS configuration tool [11] for setting up proper TLS/HTTPS configuration on Nginx, Apache, HAproxy, etc... Certificate Search [12] for cert transparency logs, certificate fingerprints and more. Thousand Eyes [13] free dashboard on a commercial site. DownDetector [14] for uptime of popular sites and services. EDNS Validator [15] for verification of your DNS EDNS support. Shodan [16] for looking up detected vulnerabilities of an IP. W3C Validator [17] for testing HTML/CSS.

[1] - https://www.ssllabs.com/ssltest/

[2] - https://dev.ssllabs.com/ssltest/

[3] - https://github.com/drwetter/testssl.sh

[4] - https://securityheaders.com/

[5] - https://urlscan.io/

[6] - https://bgp.he.net/

[7] - https://www.robtex.com/

[8] - https://www.whatsmydns.net/

[9] - https://www.virustotal.com/old-browsers/

[10] - https://www.whoisds.com/

[11] - https://ssl-config.mozilla.org/

[12] - https://crt.sh/

[13] - https://www.thousandeyes.com/outages/ [commercial site but priceless in my opinion]

[14] - https://downdetector.com/

[15] - https://ednscomp.isc.org/ednscomp?zone=ycombinator.com

[16] - https://www.shodan.io/

[17] - https://validator.w3.org/