Testing & QA — Useful Sites

Awesome Sites to Test On

2026-10-18T00:00:00Z

A list of target sites and APIs for practising test automation: demo shops, forms, trap-laden pages and fake APIs, grouped by kind. Rather than repeating dozens of interchangeable demo sites, this directory keeps a few representatives and points here for the rest.

https://github.com/BMayhew/awesome-sites-to-test-on

badssl.com

2026-10-18T00:00:00Z

A test site that serves subdomains with deliberately broken TLS setups (expired, self-signed, wrong host and so on). It tests clients, not servers: whether your browser or HTTP library rejects these errors correctly.

https://badssl.com/

CryptCheck

2026-10-18T00:00:00Z

A French test site that grades the TLS setup of HTTPS, SMTP and XMPP servers by cipher suite, certificate and key exchange. Unlike SSL Labs it covers mail and messaging servers as well as web.

https://cryptcheck.fr/

CSP Evaluator

2026-10-18T00:00:00Z

A Google tool that flags bypassable rules (unsafe-inline, broad wildcards, missing directives) when you paste in a Content-Security-Policy header. securityheaders.com grades headers in general; this looks only at the CSP, directive by directive, from an XSS angle. Unlike general header graders, it looks only at the CSP, directive by directive.

https://csp-evaluator.withgoogle.com/

Hardenize

2026-10-18T00:00:00Z

A scanner that gathers a domain's DNS, email (SPF/DKIM/DMARC), TLS and web-header security into one report. Unlike tests that measure a single layer it shows the whole external surface together; a public one-off scan is free, continuous monitoring is paid.

https://www.hardenize.com/

How's My SSL?

2026-10-18T00:00:00Z

A page that grades your browser's TLS client setup (version, cipher suites, known weaknesses). SSL Labs tests a server; this tests your side, the browser and OS, and the result is also available as a JSON API. SSL Labs tests a server, whereas this checks the client side.

https://www.howsmyssl.com/

MDN HTTP Observatory

2026-10-18T00:00:00Z

Mozilla's in-browser checker that scores a site's headers, cookies and TLS settings against security best practice; it now lives inside MDN. Unlike securityheaders.com it keeps a rescan history and is backed by an open-source scanner (http-observatory).

https://observatory.mozilla.org/

Security Headers

2026-10-18T00:00:00Z

A browser-based scan that grades a site's HTTP response headers (CSP, HSTS, X-Frame-Options, Permissions-Policy and so on) from A to F and explains what is missing. SSL Labs looks at the TLS layer; this looks at header hardening at the application layer. Instead of the TLS layer, it looks at application-layer header hardening.

https://securityheaders.com/

Static Analysis Tools

2026-10-18T00:00:00Z

A compilation of static analysis tools, linters and formatters grouped by language and format (formerly awesome-static-analysis). It is for surveying the options for a language rather than documenting a single tool.

https://github.com/analysis-tools-dev/static-analysis

Academy Bugs

2026-09-18T00:00:00Z

A practice site with 25 real bugs planted inside for you to find. Unlike automation practice sites it targets manual exploratory testing: you find the bugs and report them.

https://academybugs.com/find-bugs/

Airport Gap

2026-09-18T00:00:00Z

A RESTful API built to improve your API automation testing. Unlike simple mock APIs, it has realistic behaviour such as token authentication and rate limiting.

https://airportgap.dev-tester.com/

API Challenges

2026-09-18T00:00:00Z

A series of challenges, tutorials and references for practising API testing, by Alan Richardson (EvilTester). Unlike ordinary mock APIs it comes with a task list, marking your progress as you complete each challenge.

https://apichallenges.eviltester.com/

Applitools

2026-09-18T00:00:00Z

A visual regression testing platform that compares screens with visual AI. Unlike pixel-by-pixel tools, it ignores trivial differences such as anti-aliasing and flags real changes.

https://applitools.com

Automation Exercise

2026-09-18T00:00:00Z

An automation practice site with a UI, an API backend and a ready list of test cases. Unlike single-page demo sites, it offers end-to-end flows — sign-up, cart, checkout — together with their API.

https://www.automationexercise.com/

Awesome Appium

2026-09-18T00:00:00Z

A resource list for Appium, the mobile-app test-automation tool. Unlike platform-specific tools such as Espresso or XCUITest, it drives Android and iOS from one API over the WebDriver protocol.

https://github.com/SrinivasanTarget/awesome-appium

Awesome AVA

2026-09-18T00:00:00Z

A list of plugins and resources for AVA, the JavaScript test runner. Unlike Jest, it runs test files concurrently in separate processes by default.

https://github.com/avajs/awesome-ava

Awesome CodeRabbit

2026-09-18T00:00:00Z

A resource list for CodeRabbit, the AI-powered code-review platform. Unlike general AI code-review lists, it gathers only CodeRabbit configurations and sample rules; the company maintains it itself.

https://github.com/coderabbitai/awesome-coderabbit

Awesome Gatling

2026-09-18T00:00:00Z

A resource list for Gatling, the Scala-based load- and performance-testing framework. Unlike JMeter, you write scenarios in code (Scala, Java, Kotlin) rather than clicking them together in a GUI.

https://github.com/aliesbelik/awesome-gatling

Awesome JMeter

2026-09-18T00:00:00Z

A resource list for JMeter, the load- and performance-testing tool. Unlike general performance-testing lists, it gathers only JMeter plugins, integrations and guides.

https://github.com/aliesbelik/awesome-jmeter

Awesome k6

2026-09-18T00:00:00Z

A resource list for k6, the developer-centric load and performance testing tool. Unlike general performance lists it focuses on one tool and its scripting ecosystem.

https://github.com/grafana/awesome-k6

Awesome Playwright

2026-09-18T00:00:00Z

A list of tools, plugins and examples for the Playwright ecosystem. Unlike the official docs it brings together community tooling and real project examples.

https://github.com/mxschmitt/awesome-playwright

Awesome Regression Testing

2026-09-18T00:00:00Z

A list of visual-regression tools that verify changes did not break functionality or style. Unlike unit tests, they compare screenshots and catch style breakages that code assertions cannot see.

https://github.com/mojoaxel/awesome-regression-testing

Awesome Selenium

2026-09-18T00:00:00Z

A collection of the Selenium browser-automation framework and its surrounding tools. Unlike scattered search it gathers language bindings, grid and plugins in one place.

https://github.com/christian-bromann/awesome-selenium

Awesome Test Automation

2026-09-18T00:00:00Z

A list gathering test-automation frameworks, tools and resources by language and platform. Unlike scattered searches it collects them all in one organised place.

https://github.com/atinfo/awesome-test-automation

Awesome Testing

2026-09-18T00:00:00Z

A list gathering every branch of software testing — unit, end-to-end, performance, contract — with resources. Unlike a single tool list, it pairs books and testing theory with the tools; you can also find the rest of this field’s practice sites here.

https://github.com/TheJambo/awesome-testing

Beeceptor

2026-09-18T00:00:00Z

Spins up a mock REST endpoint in seconds and intercepts or fakes HTTP requests. Unlike writing your own mock server, it needs no code or setup.

https://beeceptor.com

Browserling

2026-09-18T00:00:00Z

Live-test your site across different browsers and operating systems.

https://www.browserling.com

Countries GraphQL API

2026-09-18T00:00:00Z

A simple public GraphQL API serving country, continent and language data, with no key required. Unlike REST-based mock APIs, it suits practising GraphQL queries and client testing.

https://countries.trevorblades.com/

Cypress

2026-09-18T00:00:00Z

An end-to-end testing framework that runs in the browser with live reload and time-travel debugging. Unlike Selenium the test runs in the same browser loop as the app; compared with Playwright, multi-tab and cross-browser support is more limited.

https://cypress.io

DummyJSON

2026-09-18T00:00:00Z

A fake JSON REST API offering dozens of resources for quick prototyping and test data. Unlike JSONPlaceholder it has richer data (products, carts, recipes) plus authentication, pagination and search.

https://dummyjson.com

Fake Store API

2026-09-18T00:00:00Z

A fake e-commerce REST API with products, carts and users for front-end prototypes. Unlike general mock APIs such as JSONPlaceholder, its data model is e-commerce-specific.

https://fakestoreapi.com

GoREST

2026-09-18T00:00:00Z

A test API with OAuth2 authentication and write support, over REST and GraphQL. Unlike read-only fake APIs it truly lets you exercise create/update flows.

https://gorest.co.in/

httpbin

2026-09-18T00:00:00Z

An HTTP testing service that echoes headers, body and response. Unlike mock REST APIs, it tests HTTP itself — headers, cookies, redirects, compression — rather than data.

https://httpbin.org

Insomnia

2026-09-18T00:00:00Z

A clean API client for REST, GraphQL and gRPC requests. Unlike Postman it is lighter and open source, and can be versioned with git.

https://insomnia.rest/

JSONPlaceholder

2026-09-18T00:00:00Z

A zero-setup test API that returns realistic fake JSON on request. Unlike running your own mock it is instantly available — the standard for prototypes and tutorials.

https://jsonplaceholder.typicode.com/

Katalon

2026-09-18T00:00:00Z

A low-code test automation tool for web, API and mobile. Unlike code-first frameworks such as Playwright, it builds scenarios with record-and-playback and a visual editor, no coding needed; advanced features are paid.

https://katalon.com

Mailtrap

2026-09-18T00:00:00Z

An email sandbox that captures outgoing mail before it reaches real recipients. Unlike testing against a real SMTP server, it makes accidentally emailing a customer impossible.

https://mailtrap.io

Ministry of Testing

2026-09-18T00:00:00Z

A hub bringing together community, learning resources and events for software testers. Unlike tool-focused sites, it centres on the craft itself — exploratory testing, test strategy, careers.

https://ministryoftesting.com

OMDb API

2026-09-18T00:00:00Z

An API serving movie and series data, handy for tests and prototypes. Since IMDb has no public API, it is the common alternative; the free key is limited to 1,000 requests a day.

https://www.omdbapi.com/

Playwright

2026-09-18T00:00:00Z

Microsoft’s cross-browser (Chromium, Firefox, WebKit) automation and testing framework, driving all three from one API. Unlike Selenium, it waits automatically and talks to the browser over its own protocol rather than WebDriver.

https://playwright.dev