Why 45 tools in one place?
Website operators face a common challenge: each check requires a different tool on a different platform, often US-hosted with its own tracker. A quick GDPR audit alone typically requires three to four different vendor tabs. XICTRAQ bundles these tools into one collection — and goes one step further: every snapshot check can seamlessly transition into continuous monitoring, with history, alerting and reports.
62% of German SMEs check their website compliance at most once per quarter (Bitkom Digital Office Index 2024). That is a risk — a faulty imprint or a forgotten cookie banner typically only surfaces when the legal warning arrives. Regular, automated checks close this gap.
Security and email authentication: 4 new tools
Email spoofing and phishing remain among the most common attack vectors targeting SMEs. The new security tools verify whether your domain is hardened against these threats — in seconds and without technical expertise.
Checks your DMARC record for syntax, policy strength (none/quarantine/reject), reporting addresses and alignment mode. Shows immediately whether your domain is protected against email spoofing — or whether the policy is too weak.
Validates BIMI records (Brand Indicators for Message Identification): logo URL, VMC certificate, SVG format compliance. BIMI displays your company logo directly in email clients — but only when DMARC is set to reject.
Validates your MTA-STS policy and the associated DNS record. MTA-STS enforces TLS encryption for inbound email — without MTA-STS an attacker can downgrade transport to cleartext.
Tests your cookie banner for technical correctness: are trackers blocked before consent? Does the reject button work? Are consent decisions properly respected?
All four tools deliver a point-in-time check. To continuously ensure DMARC, BIMI and MTA-STS remain correctly configured, use email security monitoring in your XICTRAQ account — automatically every 24 hours with alerting on configuration changes.
GDPR and compliance: 4 new tools for European requirements
The GDPR and German DDG/TDDDG impose specific requirements on websites. From June 2025, the European Accessibility Act (EAA/BFSG) adds another obligation. These four tools cover the most common compliance checks:
Checks your legal notice for completeness per § 5 DDG: company name, address, authorized representatives, contact details, trade register, VAT ID. Detects missing mandatory fields before a law firm does.
Crawls your website and detects third-party connections, external resources and potential GDPR issues: Google Fonts from googleapis.com, embedded YouTube without enhanced privacy mode, external analytics scripts.
Specifically checks for Google Fonts loaded from external servers. Since the Munich District Court ruling (Case 3 O 17493/20), embedding via Google servers without consent is actionable under German law — even if the hosting provider loads them without being asked.
Tests digital accessibility per WCAG 2.1 Level AA: contrasts, alt texts, form labels, keyboard navigation, ARIA attributes. Mandatory for all B2C offerings from June 2025.
Tip for agencies: Combine imprint checker + privacy crawler + Google Fonts check + consent checker for a quick GDPR pre-audit with new clients. In under 5 minutes you know where the biggest compliance gaps are — and can prepare a concrete proposal.
The XICTRAQ GDPR watcher runs these checks automatically: Google Fonts monitoring, cookie scanning and third-party tracking run every 24 hours. On changes you receive an immediate notification — for example when a plugin update suddenly loads Google Fonts externally or a new tracker appears without consent.
SEO and performance: 5 new tools
Technical SEO increasingly decides rankings. Google evaluates Core Web Vitals as a ranking signal (Google Search Central, 2024), broken links waste crawl budget, and incorrect redirects cost link equity. The new SEO tools automate the most common checks:
Crawls your website and finds all dead links — internal and external. Shows HTTP status code, source page and anchor text. Broken links produce 404 errors, frustrate visitors and waste crawl budget.
Follows the complete redirect chain of a URL: 301, 302, 307, 308, meta refresh. Detects redirect loops, chains that are too long (more than 3 hops cost SEO value) and incorrect status codes on redirects.
Measures LCP, CLS and INP of your page via headless Chromium — the three Google ranking signals. Shows concrete optimization hints and compares against Google thresholds (good/needs improvement/poor).
Identifies the technology stack of a website: CMS, JavaScript frameworks, server software, CDN, analytics, fonts. Useful for competitor analysis, prospecting and technical audits.
Validates your XML sitemap against the sitemap protocol: syntax, URL formats, lastmod dates, namespace, compression. Detects common errors like duplicate URLs, invalid date formats or missing XML declarations.
The transition to continuous monitoring is seamless: XICTRAQ checks broken links automatically on every crawl, monitors Core Web Vitals with performance budgets and alerts on SEO-relevant changes. A broken link is caught in hours, not weeks.
Developer tools: 5 new helpers for daily work
Developers need tools that are instantly available and do not send data to third parties. The five new developer tools run — depending on type — either locally in your browser or server-side with immediate results:
Test regex in the browser: enter patterns, match test strings, visualize groups and captures. Supports JavaScript and PCRE syntax with real-time highlighting. Runs entirely locally — ideal for sensitive inputs.
Convert images to Base64 and back. Generates data URIs for CSS backgrounds, email templates or inline SVGs. Shows preview, file size and MIME type. Fully in-browser — no upload.
Make cron expressions readable: shows the next 10 execution times, explains syntax in natural language and validates against standard cron and extended formats (seconds, year field).
Look up all HTTP status codes: description, typical causes, RFC reference and differences between similar codes (301 vs. 308, 401 vs. 403, 502 vs. 504). Searchable and filterable by category.
Build HTTP requests in the browser: configure method, headers, body and export as cURL command — or import an existing cURL command and execute it. Shows response headers, body, timing and TLS details.
These tools complement the existing browser helpers (JWT decoder, JSON formatter, encoder, UUID generator, subnet calculator, mail header analyzer, password generator). Together they cover the most common developer tasks without sensitive data needing to leave your machine.
All 45 tools at a glance
| Category | Tools | Type |
|---|---|---|
| Security & email | DNS lookup, DNSSEC, SSL check, security score, HTTP headers, mail check, IP blacklist, DMARC validator, BIMI validator, MTA-STS checker, consent checker | Server |
| GDPR & compliance | Cookie scanner, imprint checker, privacy crawler, Google Fonts check, accessibility check (BFSG) | Server |
| SEO & performance | Pagespeed, robots.txt/sitemap, Open Graph, broken links, redirect checker, Core Web Vitals, tech stack, sitemap validator, resource waterfall | Server |
| Network & DNS | DNS propagation, Whois/RDAP, ASN lookup, reverse IP, subdomain finder, my IP | Server |
| Developer (browser) | JWT decoder, JSON formatter, JSONL validator, encoder/hash, UUID generator, subnet calculator, mail header, password generator, regex tester, Base64 image, cron parser, HTTP status, cURL tester | Browser |
Typical workflow: GDPR audit in 10 minutes
A new client hires you to manage their website. Before writing a proposal, you want to know the compliance status. With the XICTRAQ tool collection it takes less than 10 minutes:
- Imprint checker — mandatory fields complete? Missing VAT ID or trade register entry is the most common legal-notice issue for SME websites.
- Privacy crawler — which third-party connections does the site make? External fonts, analytics, CDN resources — anything without legal basis is problematic.
- Google Fonts check — are fonts loading from googleapis.com? Actionable under German law since the Munich court ruling.
- Consent checker — does the cookie banner work technically? Does it block trackers before consent?
- Cookie scanner — which cookies and trackers load before consent? Headless Chromium catches JS-injected trackers too.
- Accessibility check — WCAG 2.1 Level AA: contrasts, alt texts, keyboard navigation.
After 10 minutes you have a documented baseline with concrete recommendations — a solid foundation for your proposal. And once the client agrees, set up XICTRAQ monitoring: the same checks run automatically, and you are alerted on every change.
From snapshot to continuous protection
The 45 tools are deliberately built as snapshot tools: they show the state right now. For SMEs that want to protect their website continuously, XICTRAQ offers a seamless transition to monitoring:
- Automatic interval checks — the same checks run automatically every 6 to 24 hours (depending on plan and check type)
- Alerting via 6 channels — email, Slack, Discord, Telegram, Microsoft Teams and webhook. You learn about problems in minutes, not weeks.
- History and trends — how has the security score evolved over the last 90 days? When was an external tracker added?
- PDF reports — automatically weekly or monthly, for clients or your own data protection officer.
- Multi-region probes — checks run in parallel from three EU data centres (DE-1, FI, DE-2), two in Germany, one in Finland — geo issues surface immediately.
The free plan requires no credit card. For full functionality, paid plans start at EUR 12/month. The transition is seamless: every tool links directly to the monitoring version of the same check.
Technical foundation: what powers the tools
Transparency is part of the tool collection philosophy. Three technical decisions that make the difference:
- Headless Chromium for real browser checks — tools like Core Web Vitals, broken link checker, cookie scanner and consent checker use a real browser. They detect JS-injected trackers, dynamically generated links and client-side loaded resources that pure HTTP crawlers miss.
- No tracking, no cookies, no account — the tools set no cookies, load no third-party code and require no signup. Browser tools (regex tester, Base64 image, cron parser, HTTP status) never leave your machine.
- EU hosting on Hetzner — all servers are in Falkenstein (Saxony, Germany) and Helsinki (Finland). No data transfer to third countries. Usable in the public sector and regulated industries without DPO review.
Frequently asked questions about the new tools
Are all 45 tools free and signup-free?
What is the difference between the sitemap validator and the robots.txt tool?
Does the consent checker detect cookie banners that are technically broken?
Which tools do I need for a quick GDPR check?
Can I integrate the tools into my existing workflows?
Are my checked domains or inputs stored?
Sources: Bitkom Digital Office Index 2024 (SME compliance check frequency), Google Search Central 2024 (Core Web Vitals as ranking signal), Munich District Court Case 3 O 17493/20 (Google Fonts ruling).