Free DDoS Resilience Tools
Small, read-only self-audits you can run against your own domain in about a minute. No signup, no account, no data sent to us.
Each one answers a single question that is cheap to check and expensive to get wrong. They are the questions a structured DDoS test answers properly, reduced to the part you can verify yourself.
ddos-protection-path-check
Checks whether every public hostname on your domain actually routes through your CDN, WAF, or scrubbing edge, or whether one of them resolves around it.
The apex and www commonly disagree, because DNS forbids a CNAME at a zone apex and every provider substitutes its own mechanism there. A hostname outside the edge is outside the protection entirely.
origin-exposure-check
Looks for origin IPs that still serve your site directly, bypassing the edge you put in front of it.
An edge only protects traffic that has no way around it. If the origin answers on its own address, an attacker who finds that address skips every control you configured.
edge-cache-check
Measures how much of your site the CDN really serves from cache, and how much it forwards to your origin.
Cache absorption is the layer that depends on your own response headers, not the vendor. At a low hit ratio the edge forwards the flood to you and the availability dashboard stays green.
dns-resilience-check
Audits nameserver count, provider and network diversity, DNSSEC, and TTL sanity.
A perfectly hardened origin still goes dark if DNS does. If every authoritative nameserver sits with one provider, one incident there takes the whole domain offline.
Each one has a build story on DEV covering why it exists and what it deliberately does not claim, including the bugs found while testing them. They are collected at dev.to/blackneuron.
What they do, and what they never do
Every one of these is defensive by design. We publish audit tools. We do not publish attack tools.
Public data only
They read DNS, public ASN registries, and ordinary HTTP responses. The same information any browser or search engine already receives.
No attack traffic
No port scanning, no vulnerability probing, no floods. Nothing these tools do would look unusual in a web server log.
Authorization first
They are built to audit your own estate. Point them at domains you own or are explicitly permitted to test.
Common questions
Are these tools free?
Yes. All four are free, open source under the MIT licence, and require no signup or account. You build them yourself and run them locally, so nothing about your domain is sent to us.
Is running them against my own domain safe and legal?
They read public DNS records, public network registry data, and ordinary HTTP responses, which is the same information a browser or search engine already receives. There is no port scanning, no vulnerability probing and no attack traffic of any kind. Point them at domains you own or are explicitly permitted to test.
Will they tell me whether my site can survive a DDoS attack?
No, and it matters that they do not claim to. They report how your infrastructure is configured: whether protection sits in the path, whether the origin is reachable around it, how much the edge caches, and whether DNS is a single point of failure. Whether those defences hold under a live attack, at what threshold they engage, and how they behave when an attack changes shape are separate questions that only a test answers.
Do I need to know Rust to use them?
Only enough to run one command. Each is a single file with two dependencies and builds with cargo build --release on a stable toolchain. There is nothing else to install and no configuration.
Why publish audit tools rather than attack tools?
Because a tool that generates load can be pointed at somebody else. Everything we publish is read-only and defensive by design, which is also why these can be run against your own estate without an authorization conversation first. The adaptive testing engine itself is not open source.
These tell you how you are configured, not whether you would hold
A clean result from every tool on this page is worth having. It still cannot tell you whether your defenses detect a real flood, at what threshold they engage, how many seconds pass before mitigation starts, or what happens when the attack changes shape to evade them.
A static test cannot answer that either, because it replays a fixed script while a real attacker adapts. Our Patent-Pending Adaptive DDoS Testing applies simultaneous multi-vector load and adapts in real time to how your defenses respond, so you find out where resilience actually ends.