Point it at any website, see what's running underneath.
Your browser reads and analyzes what it can. Cloudflare retrieves responses and details the browser can’t access; failed requests stay visible. How requests work ↗
Enter a URL above to begin scanning
No sections match. Try a shorter search.
X-Ray is a static app downloaded from FluxWorkshop. Your browser runs the scan, parses the returned source and builds the report. It requests the page and DNS records. It also attempts robots.txt and security.txt at the final public origin, or the requested origin when the main response cannot reveal a final URL. A same-origin manifest is requested only when declared in captured HTML. Up to two declared same-origin sitemaps and two declared same-origin feeds are requested, with a 35-second limit for that additional stage. Sitemaps declared in robots.txt can still be collected when the page is unreadable. It does not follow sitemap entries or feed links, crawl linked pages, or execute the target’s JavaScript.
Your browser requests each public document directly first. If browser policy, CORS or network conditions make the response unreadable, X-Ray automatically tries the Cloudflare proxy. A readable browser response stays the primary observation. X-Ray also makes a separate Worker request for browser-inaccessible main-response details such as cookie attributes and unexposed headers. That response is shown separately in the technical evidence: its status, body and policies may differ and are never merged into the browser response or its page analysis. If a request or service fails, the report retains the results it received and shows the error in the same run. No X-Ray backend runs on the computer serving these static files.
DNS queries go directly from your browser to Cloudflare’s resolver, independently of the page proxy. A recognized Worker response identifies its capture time, normalized headers, redirect chain, timing and body completeness. These fields describe the response Cloudflare received, including any target CDN or challenge page. Cloudflare can add, remove or replace fields, including Server and cf-* headers. These are not a byte-for-byte network capture, a complete origin-header inventory or proof of the hidden origin stack. Cookie header values are removed from cookie metadata; URLs and document source are retained as returned. Older fallback proxy headers remain unattributed. A supplemental observation requires a validated Worker response.
The target can see direct browser requests; the external proxy and DNS provider can see the requests sent to them. These services may keep logs. X-Ray does not claim otherwise.
Overall security, exploitability, backend code, WAF effectiveness, all subdomains, actual email signing, accessibility conformance, search ranking, real-user performance and the complete runtime dependency graph are outside this scan. Certificate details, negotiated TLS settings, the target connection’s HTTP version and connected IP are not exposed by the Worker’s fetch API. DNS addresses are separate observations. Worker timings measure response collection; browser timing includes proxy work. Neither is a page-speed score.
Resources listed in the page are declarations, not a browser network trace. All supported icon and sharing-image previews load automatically with the report, directly from their image hosts. Those hosts see the requests and your browser may send its existing cookies. No referrer is sent by the preview image. “Copy scan link” creates a link that runs a fresh scan; the JSON export preserves this observation and its timestamp.
DNS response fields ↗HTTP headers ↗robots.txt ↗security.txt ↗