Site Headers Report
Enter a URL to see whether it's served through a CDN, how it's meant to be cached, whether the response is compressed, and how it grades against baseline security headers — all from one request.
Overview
Four separate response-header checks — CDN detection, cache behavior, compression, and security headers — all boil down to reading the same HTTP response, so this tool fetches a URL once and reports all four at the same time instead of making you run four separate checks.
CDN detection looks for recognizable provider fingerprints (Cloudflare's cf-ray, CloudFront's x-amz-cf-id, and similar). Cache analysis parses Cache-Control, ETag, Expires, and Age into a plain-language verdict. Compression reports the Content-Encoding actually used (gzip, Brotli, or none). Security headers are graded A through F against this site's own baseline (HSTS, CSP, X-Frame-Options, and more).
None of these checks measure whether a browser or CDN actually cached or compressed a given request — they report what the origin's response instructed caches and clients to do.
Examples & Sample Data
Checking a URL's headers
https://example.com
CDN: Cloudflare · Cache: cacheable for 3600s · Compression: br (Brotli) · Security headers: B (5/6 pass)
How It Works
- Enter a full URL, including https:// or http://.
- Complete the verification check if shown.
- Click Check to fetch the URL once and review its CDN, cache, compression, and security-header results.
Common Use Cases
Auditing a new deployment
Confirm a CDN migration took effect, static assets are cacheable and compressed, and the expected security headers all made it to production — in one check instead of four.
Investigating a slow or misconfigured site
Rule out missing CDN, bad caching, and no compression as contributing factors before digging into other causes.
Tips & Best Practices
- A result is cached for 60 seconds per URL, so re-running this check right after Site Speed Audit on the same URL reuses the same fetch rather than hitting the origin twice.
Frequently Asked Questions
All four read the same HTTP response headers from the same request, so they're combined into this one tool — one fetch, four results, instead of four separate pages each making their own request.
Common signature headers from Cloudflare, Amazon CloudFront, Fastly, Akamai, Vercel, and Netlify. Providers not in this list, or configured to strip identifying headers, won't be detected even if a CDN is present.
Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy, X-Frame-Options (or CSP's frame-ancestors), and Permissions-Policy — the same baseline this site itself sends on every response.
No, it issues a standard GET request, the same as a browser visiting the page.
Related Tools
Explore more high-performance utilities.