Eleven new tools landed in /tools over the past two weeks: an SSL certificate checker, a page-weight probe, DNS/WHOIS lookup, a Schema.org validator, a privacy-policy-and-cookie-banner generator, SPF/DKIM/DMARC checks, a favicon-and-manifest checker, an hreflang checker, a WCAG contrast calculator, a UTM link builder, a QR generator. All free, no signup, most answer in under two seconds. Here's why they exist and what actually went into building them.
Numbers as of this post; the hub keeps growing.
Why a tools page at all
Every one of them is a lead magnet with a straight face about it. Someone lands on a check, gets a real answer in a couple of seconds, and at the bottom of the page there's a link to the paid version of the same idea — the full AI SEO audit, or one of the services it feeds: Bitrix work, ongoing support, 152-FZ compliance. No dark patterns, no fake urgency. The free check has to be genuinely useful on its own, or the whole thing is just noise with a form attached.
What's in the eleven
For developers. A Schema.org / JSON-LD validator that checks not just that the markup parses, but that the fields Google's rich-snippet algorithm actually requires are present — a Product without offers passes JSON validation and still gets no snippet. An hreflang checker that flags missing x-default and missing self-reference, the two mistakes that quietly misroute international visitors for years. A WCAG contrast calculator — no site fetch, just two colors in, a ratio and an AA/AAA pass/fail out, because computing that from a live page without a real browser would be a lie dressed up as a feature.
For sites. An SSL certificate checker that reads the handshake directly, not through a hosting panel. A page-weight probe that's upfront about not being Core Web Vitals — that needs a real browser rendering the page, which is what the paid audit already does. DNS and WHOIS lookup, including a plain-English warning that an expired domain gets grabbed within hours. SPF/DKIM/DMARC checks, with an honest caveat: DKIM selectors are arbitrary, so "not found" among the common ones doesn't mean "not configured." A favicon and manifest checker for the thing everyone forgets until their tab shows a blank square.
For business. The privacy policy generator is the deep one — draft policy text plus a live cookie-banner configurator: colors, bar-or-popup layout, button copy, all previewed as you type, not just described. A UTM link builder with custom parameters and a bulk paste-and-apply mode, because typing five fields by hand for every campaign link gets old fast. A QR generator that does something most free ones don't: your own photo can become the code's background or, weirder and better, the actual dark modules can be cut out of the photo pixel by pixel.
Three decisions worth explaining
One SSRF guard, not eleven. Every tool that takes a URL — and that's most of them — goes through the same fetch layer, which blocks private and loopback IP ranges, including after redirects (a redirect to an internal address doesn't get a free pass). Write that check once, correctly, and reuse it, instead of hoping eleven separate implementations all remembered.
One list, two places. The tools hub page and the "Tools" menu in the header used to be two hand-maintained lists — the kind that drift the moment you're in a hurry. They now read from a single tools/data.php, the same pattern the services menu already used. Add a tool once, it shows up in both.
The QR trick is just pixel comparison. No fancy image-processing library. Render the code with a marker background color, walk the pixel buffer, and wherever a pixel matches that marker, swap in the corresponding pixel from your uploaded photo — either only in the background pixels, or only in the code pixels, your choice. It's maybe forty lines of canvas code for an effect most generators charge for.
The one that got away — briefly
Chasing an unrelated horizontal-scroll bug, I set overflow-x: hidden on both html and body. By spec, that makes the browser auto-promote overflow-y to auto on both — which quietly turned body into its own nested scroll container instead of the viewport scrolling normally. window.scrollY stopped moving, the header's scroll listener never fired again, and the header vanished site-wide on the homepage. Found it by literally calling window.scrollTo() in the console and watching scrollY refuse to change. The fix is the property on body alone, not both. Small line, wrong assumption, real outage — the usual shape of these things.
What's next
A broken-link checker is next in line, run from a normal server instead of the Pi the paid audit engine sits behind — no more false positives on Telegram links because the network they're checked from can't reach them. After that, a lightweight public Bitrix-core version check, as a teaser for the fuller Bitrix/Aspro/Sotbit scan that already lives in the paid report.