Vigilbase Tools are free security checks at vigilbase.com/tools. Each one checks a single area, such as a site's HTTP security headers, a domain's email authentication records or a Cloudflare account's configuration, and explains every finding with a fix.
Kinds of tool
The tools fall into three groups by what they send and what they need from you.
| Kind | What it does | What you need |
|---|---|---|
| Non-intrusive | Reads public information only: DNS records, HTTP response headers and TLS certificates. | Nothing. Complete the security check on the page and run it. |
| Intrusive | Sends active requests to the target to look for exposed files or vulnerability signals. | A verified work email on the same domain as the target. |
| In your browser | Builds or evaluates something locally. Nothing is sent to Vigilbase. | Nothing. |
The Cloudflare Checkup is different again: it reads your own Cloudflare account with read-only access that you grant.
Run a tool
Open the tool. Go to vigilbase.com/tools and choose a tool.
Enter the target. Type a URL or a domain, depending on the tool.
Pass the security check. Most tools that run on Vigilbase's servers show a short automated check before the scan starts.
Verify your email, if asked. Intrusive tools email you a 6-digit code first.
Read the result. Work through the findings from the most severe down.
Grades
Most tools give an A+ to F grade with a score out of 100, plus a status of Secure, Warnings or Vulnerable. Each tool scores differently, and the grade bands are not the same for every tool, so each tool page explains its own scoring.
A grade describes what the tool could see at the time of the scan. It is not a full security assessment and does not prove that a site is secure. When a tool cannot assess the target, for example because the site answered with a bot verification challenge or an error page, it shows an error and assigns no grade.
Saved runs and share links
Tools that save their result give it an address of the form https://vigilbase.com/tools/run/<id>. Open that page to see the result again, copy a share link with Copy link, or download it as a PDF.
- FortiBleed results are never shown on a saved-run page; they stay inside the verified check.
- Cloudflare Checkup results collected with the CLI are labelled Self-reported wherever they are shared, and their grade is left out of the page title and link preview.
Report by email
When a scan finishes, most tools offer to email you the report. Enter a work email address: personal and free mailbox providers are refused.
The first time you use an address, Vigilbase sends a verification link instead of the report. Follow the link and select Confirm on the page it opens; the report then arrives at that address. Links expire after 60 minutes.
Tools with no stored run, such as the record generators and the CSP generator, point you to a tool that can email a report.
Scan quota
Scans that run on Vigilbase's servers share an hourly quota: 20 scans per client IP address and 20 per target, with 1,000 an hour overall. When the quota is used up, wait and try again later.