This site lets you test your webmention implementation on your indieweb site, and whether it robustly detects certain types of XSS attacks.

Indieauth with your url and choose a page on your site. I will send it one good webmention, and others that try to embed some XSS in it. You can then check back on your page to see how it handles them.

Here's the source on github.