A few things we built for ourselves that are useful on their own -- no login, no catch.
Build a correct Coraza / ModSecurity SecLang WAF rule from simple fields -- no SecLang syntax to memorize. Copy the result straight into your own config.
Check any site's HTTP response for HSTS, CSP, X-Frame-Options, and other security headers in seconds.
Check any site's SSL/TLS certificate -- expiry date, issuer, protocol, and trust status in seconds.
Trace redirect chains, check robots/canonical directives, validate on-page SEO and social preview metadata, and scan for broken resource hygiene -- all in one pass. Even check as Googlebot or Bingbot to spot cloaking.