diff --git a/Makefile b/Makefile
index 5d6943d..77295b4 100644
--- a/Makefile
+++ b/Makefile
@@ -25,6 +25,7 @@ install:
 	@cp -f check_senderscore check_ircd ${NAGIOS_EXEC}
 	@chmod 755 ${NAGIOS_EXEC}/check_senderscore
 	@chmod 755 ${NAGIOS_EXEC}/check_ircd
+	@chmod 755 ${NAGIOS_EXEC}/check_onion
 	@echo installing ircbot.sh to ${PREFIX}/bin
 	@cp -f ircbot.sh ${PREFIX}/bin
 	@chmod 755 ${PREFIX}/bin/ircbot.sh
@@ -32,6 +33,7 @@ install:
 uninstall:
 	@echo removing service checking scripts from ${NAGIOS_EXEC}
 	@rm -f ${NAGIOS_EXEC}/check_senderscore ${NAGIOS_EXEC}/check_ircd
+	@rm -f ${NAGIOS_EXEC}/check_senderscore ${NAGIOS_EXEC}/check_onion
 	@echo removing ircbot.sh from ${PREFIX}/bin
 	@rm -f ${PREFIX}/bin/ircbot.sh
 	@echo removing ircbot.service from ${SYSTEMD_UNIT_DIR}
diff --git a/README.md b/README.md
index cd45f78..d138a41 100644
--- a/README.md
+++ b/README.md
@@ -5,9 +5,11 @@ Simple nagios monitoring and notification scripts.
 `check_senderscore` checks the senderscore (a metric for whether an IP address
 tends to send spam email) of an IP address.
 
-`ircbot.sh` runs as a daemon as the nagios user, connects to the configured
-IRC server and channel, keeps the connection open, and relays messages from
-nagios to the channel.
+`check_onion` attempts to connect to a Tor Onion service via torsocks.
+
+`ircbot.sh` runs as a daemon as the nagios user, connects to the
+configured IRC server and channel, keeps the connection open, and
+relays messages from nagios to the channel.
 
 ## Installing
 
diff --git a/check_onion b/check_onion
new file mode 100755
index 0000000..c62628e
--- /dev/null
+++ b/check_onion
@@ -0,0 +1,58 @@
+#!/bin/sh
+
+# bare-bones check_onion plugin for nagios
+
+# dependencies: torsocks, curl
+
+# TODO: handle torsocks SOCKS failures
+
+# default thresholds (pretty high, because tor is slow)
+warn=15
+crit=20
+
+while getopts 'H:w:c:' opt
+do
+    case "$opt" in
+        H) host="$OPTARG";;
+        w) warn="$OPTARG";;
+        c) crit="$OPTARG";;
+    esac
+done
+
+if [ -z "$host" ]; then
+    echo "usage:" $0 "-H <hostname> [-w <warning-seconds]" \
+        "[-c <critical-seconds]"
+    exit 3
+fi
+
+starttime=$(date '+%s')
+http_code=$(torsocks curl -s -I $host | head -n 1 | awk '{print $2}')
+interval=$(echo $(date '+%s') - $starttime | bc)
+
+check_time() {
+    if [ $interval -lt $warn ]; then
+        status='OK'
+    elif [ $interval -lt $crit ]; then
+        status='WARNING'
+    else
+        status='CRITICAL'
+    fi
+}
+
+case $http_code in
+    5*) status='CRITICAL' ;;
+    4*) status='CRITICAL' ;;
+    3*) check_time ;;
+    2*) check_time ;;
+    *) status='UNKNOWN' ;;
+esac
+
+echo 'Onion' "${status}:" "${host}:" 'got HTTP code:' $http_code \
+    'in' $interval 'seconds'
+
+case $status in
+    OK) exit 0 ;;
+    WARNING) exit 1;;
+    CRITICAL) exit 2;;
+    UNKNOWN) exit 3;;
+esac