# Vigilbase Tools > Free security tools on vigilbase.com for websites, email domains, DNS and Cloudflare accounts, with graded results you can save and share. Source: https://docs.vigilbase.com/tools Vigilbase Tools are free security checks at [vigilbase.com/tools](https://vigilbase.com/tools). Each one checks a single area, such as a site's HTTP security headers, a domain's email authentication records or a Cloudflare account's configuration, and explains every finding with a fix. ## Kinds of tool The tools fall into three groups by what they send and what they need from you. | Kind | What it does | What you need | | --- | --- | --- | | Non-intrusive | Reads public information only: DNS records, HTTP response headers and TLS certificates. | Nothing. Complete the security check on the page and run it. | | Intrusive | Sends active requests to the target to look for exposed files or vulnerability signals. | A verified work email on the same domain as the target. | | In your browser | Builds or evaluates something locally. Nothing is sent to Vigilbase. | Nothing. | The [Cloudflare Checkup](https://docs.vigilbase.com/tools/cloudflare-checkup) is different again: it reads your own Cloudflare account with read-only access that you grant. > [!IMPORTANT] > Only scan sites and domains you own or are allowed to test. Verifying an email address proves you can read that mailbox; it does not give you permission to test a system. ## Run a tool :::steps 1. **Open the tool.** Go to [vigilbase.com/tools](https://vigilbase.com/tools) and choose a tool. 2. **Enter the target.** Type a URL or a domain, depending on the tool. 3. **Pass the security check.** Most tools that run on Vigilbase's servers show a short automated check before the scan starts. 4. **Verify your email, if asked.** Intrusive tools email you a 6-digit code first. 5. **Read the result.** Work through the findings from the most severe down. ::: ## Grades Most tools give an A+ to F grade with a score out of 100, plus a status of **Secure**, **Warnings** or **Vulnerable**. Each tool scores differently, and the grade bands are not the same for every tool, so each tool page explains its own scoring. A grade describes what the tool could see at the time of the scan. It is not a full security assessment and does not prove that a site is secure. When a tool cannot assess the target, for example because the site answered with a bot verification challenge or an error page, it shows an error and assigns no grade. ## Saved runs and share links Tools that save their result give it an address of the form `https://vigilbase.com/tools/run/`. Open that page to see the result again, copy a share link with **Copy link**, or download it as a PDF. - FortiBleed results are never shown on a saved-run page; they stay inside the verified check. - Cloudflare Checkup results collected with the CLI are labelled **Self-reported** wherever they are shared, and their grade is left out of the page title and link preview. ## Report by email When a scan finishes, most tools offer to email you the report. Enter a work email address: personal and free mailbox providers are refused. The first time you use an address, Vigilbase sends a verification link instead of the report. Follow the link and select **Confirm** on the page it opens; the report then arrives at that address. Links expire after 60 minutes. Tools with no stored run, such as the record generators and the CSP generator, point you to a tool that can email a report. ## Scan quota Scans that run on Vigilbase's servers share an hourly quota: 20 scans per client IP address and 20 per target, with 1,000 an hour overall. When the quota is used up, wait and try again later. ## Tools :::cards - [Cloudflare Checkup](https://docs.vigilbase.com/tools/cloudflare-checkup) Grade a Cloudflare account and every zone it can see, read-only. - [Website Security](https://docs.vigilbase.com/tools/website-security) A 27-point scan of a live site you own or may test. - [Security headers](https://docs.vigilbase.com/tools/security-headers) Grade a site's HTTP security headers. - [Email security](https://docs.vigilbase.com/tools/email-security) Grade SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, BIMI and TLS-RPT. - [React2Shell](https://docs.vigilbase.com/tools/react2shell) Look for React Server Components exposure signals. - [FortiBleed](https://docs.vigilbase.com/tools/fortibleed) Check a company domain against the public FortiBleed dataset. - [CSP evaluator and generator](https://docs.vigilbase.com/tools/csp) Grade a Content-Security-Policy or build a new one. - [HSTS checker](https://docs.vigilbase.com/tools/hsts-checker) Check Strict-Transport-Security and preload readiness. - [Email record checkers](https://docs.vigilbase.com/tools/email-checkers) Focused SPF, DMARC, DKIM, BIMI and MTA-STS checks. - [SPF and DMARC generators](https://docs.vigilbase.com/tools/record-generators) Build SPF and DMARC records in your browser. - [DNS checkers](https://docs.vigilbase.com/tools/dns) See whether a site is on Cloudflare and whether DNSSEC validates. ::: ## Use the tools from code :::cards - [Agent API](https://docs.vigilbase.com/tools/developers/agent-api) Run the security headers and email security checks over HTTP. - [Vigilbase CLI](https://docs.vigilbase.com/tools/cli/install-and-sign-in) Run tools and the Cloudflare Checkup from a terminal. :::