HTTP Header AnalyzerFREE

HTTP Header Analyzer.
Every header, decoded.

Every response header decoded and graded — caching, security best-practice, compression, and a fix-first list ordered by impact.

AT A GLANCE
Freepart of the first waveFreeno signup requiredGradedagainst current best practiceCachedirectives fully interpretedSecurityheader coverage includedLiveand free to run

Part of the CDN World toolkit · FREE TO RUN

HTTP/2 200Priority · edge delivery
Ship toexample.com
  • cache-controlpublic, max-age=3600
  • content-encodingbr
  • strict-transport-securitymax-age=31536000
  • serveredge
  • age1824
  • varyAccept-Encoding
InspectedLive fetch & parseDirective interpretationBest-practice gradingFix generation
Example label · 6 headers read

Headers reveal a lot — but not everything. A free assessment reviews your full delivery, security and cost posture.
The report

What you’ll get.

THE OUTPUTInside the report
Header-by-header decodeIncluded

Every response header, explained in plain language.

Category gradesIncluded

Caching, security, compression and delivery each graded separately.

Prioritized fixesIncluded

Ordered by impact, with corrected values ready to copy.

Shareable reportIncluded

A stable link for the pull request or the ops channel.

Freeto use, forever

No signuprequired to run it

Shareableevidence-backed reports

Live nowand free to run

What it answers

HTTP Header Analyzer in four questions.

What your cache headers really do

Cache-Control is the most misconfigured line on the web; the analyzer shows how edges and browsers will actually treat each directive combination.

Which security headers are missing

CSP, HSTS, frame and content-type protections, present, absent, or present-but-wrong.

Whether compression is working

What was negotiated, what should have been, and what the difference costs in bytes.

What to fix first

One prioritized list, ordered by user-visible impact rather than alphabetical completeness.

Under the hood

How it works.

A transparent look at exactly what the tool checks, and how it reaches its answer.

DETECTIONHow it works
  1. 01Core

    Live fetch & parse

    · your URL, real response

    Fetches the URL and decodes the response exactly as delivered, including the intermediary fingerprints along the way.

  2. 02Core

    Directive interpretation

    · the hard part

    Header combinations are evaluated the way real caches resolve them, including the conflicts and precedence rules that trip people up.

  3. 03Core

    Best-practice grading

    · current, not 2018

    Graded against present-day guidance, including the security-header baseline we apply in assessments.

  4. 04Supporting

    Fix generation

    · copyable output

    Findings come with concrete corrected header values you can paste into a config.

Use cases

Who it’s for.

Performance audits

The fastest way to find the caching mistake that’s tanking your hit ratio.

Security baselines

Verify the header baseline before the pen test finds it for you.

Pre-launch checks

One paste per environment, staging surprises caught before production.

Core Web Vitals prep

Cache and compression headers are the cheapest CWV wins available.

Status & access

Free to use. Live now, free to run.

STATUSWhere the build stands
FREE
Freeto use, no signup
Liveand free to run
200+assessments/yr behind the data
Liveand free to run
  • Built on assessment data

    The toolkit automates the detection and benchmark data behind the assessments we already run, the tools are how we prove the data is good.

  • Free, no signup, shareable

    Every tool ships free with shareable reports; the business model is the advisory behind it, not your email address.

  • Available now

    The tool is live and free to run, with detection we keep refining as we expand our signature coverage.

LIVE NOWRun a lookup →

Want a human read on the result? A free assessment runs the same analysis, human-graded, usually within 24 hours, and gives you a benchmark against pooled volume pricing.

Live now · free to run, no signup
Keep reading

HTTP Header Analyzer in context.

The research this tool automates.

Cache-Control directives, mastered→Security headers at the edge→Brotli & Zstandard at the edge→Stale-while-revalidate, in depth→

More free CDN World tools

All part of the same toolkit — passive, non-intrusive, no signup.

CDN Finder FreeSee which CDN (or stack) serves any siteDNS Finder FreeIdentify the DNS provider and audit recordsTLS & Cache Checker FreeInspect TLS config and cache behaviorWAF Detector FreeDetect the web application firewall in useBot Detection FreeDetect the bot-management / anti-bot vendor
Want the full picture?

A free assessment reviews your whole delivery and security posture, human-graded.

Get a free infrastructure assessment ↗
FAQ

HTTP Header Analyzer questions,
answered straight.

Is the analyzer live?

It’s live and free to run in the CDN World toolkit — no signup. See the tools page.

Will it be free?

Yes, free with no signup, like every tool in the kit.

How is this different from viewing headers in DevTools?

DevTools shows you the headers; the analyzer tells you what they mean together: how caches will resolve conflicting directives, which security headers are absent, and what to change first, graded by the ruleset we use in paid assessments.

Does it check request headers too?

The first release focuses on responses, where nearly all of the fixable problems live; request-side analysis is on the roadmap.

Can it scan a whole site?

Launch scope is per-URL with shareable reports; crawling comes later.

I need an audit today.

A free assessment includes exactly this review, human-graded, usually within 24 hours.