Spoof Tester Online

HTTP host header spoof test — compare live CDN vs direct origin IP responses

Configuration

Multiple IPs per row: separate with semicolons

Spoof Test Features:
  • Sends Host header spoof directly to target IP
  • Pass/Fail: live CDN vs spoofed origin status match
  • Fuzzy HTML body similarity (scripts/styles stripped)
  • Bot challenge & WAF block page detection
  • Full header diff (CDN noise auto-filtered)
  • Akamai debug headers injected on live requests

Spoof Test Report

Configure target URLs and spoof IPs, then click Run Spoof Test.

About Spoof Tester Online

Free HTTP host header spoof test tool — no sign-up, no install

What is a Spoof Test?

A HTTP spoof test (also called host header spoofing) sends a request directly to a specific IP address while presenting a different domain name in the Host header. This lets you test origin servers, bypass CDNs, and validate staging environments without touching DNS.

How This Tool Works

For each URL you provide, two parallel requests run: one via normal public DNS (live CDN path), and one spoofed request that connects directly to your target IP with the original domain as the Host + SNI header. Status codes, headers, and body content are compared side-by-side.

Privacy & Safety

All spoof requests are executed server-side — no client-side CORS limitations. No URLs, IPs, or response data are stored or logged. Rate-limited to prevent misuse. Only public HTTP/HTTPS targets are accepted.

Common Use Cases for HTTP Spoof Testing

CDN Migration Testing

Validate that your new CDN origin (F5, Fastly, Cloudflare) serves identical responses to Akamai before cutting over DNS. Compare status, headers, and body in bulk.

Origin Server Testing

Send requests directly to your origin server IP while spoofing the public hostname. Verify that origin responses are correct before traffic is routed through a WAF or CDN.

Staging vs Production

Point the spoof IP at your staging server while the live URL resolves to production. See exact diffs between environments without changing any DNS or hosts file.

WAF & Bot Bypass Check

Detect if your WAF or bot defense is returning challenge pages to the spoofed origin path. The tool auto-detects F5 bot challenges and Akamai block pages.

Frequently Asked Questions

What is host header spoofing and why is it used?
Host header spoofing means sending an HTTP request to a specific IP address while setting the Host header (and TLS SNI) to a different domain. It's a standard technique for testing origin servers, previewing staging environments, validating CDN migrations, and troubleshooting routing issues — all without modifying DNS or your local hosts file.
How is this different from editing my hosts file?
Editing your hosts file changes DNS system-wide on your machine, affecting all apps and browsers. This online spoof tester runs the requests server-side and tests specific URLs — no system changes, no admin rights, and you can test multiple IPs in parallel. You also get a side-by-side comparison with the live CDN response automatically.
Can I test multiple origin IPs at once?
Yes. In URL mode, add multiple spoof IPs (e.g., one for Production VIP and one for Staging VIP). Every URL you test is checked against all spoof IPs in parallel, and results are grouped by domain and environment so you can compare all three responses side-by-side. In CSV mode, separate multiple IPs per row with semicolons.
What does the body similarity score mean?
Before comparing, the tool strips <script>, <style>, and HTML comments from both responses, then calculates a Sørensen-Dice bigram similarity score (0–100%). A score ≥ 95% is treated as a pass — small differences in timestamps or session tokens won't cause a false failure. A score below 95% indicates significant content divergence between CDN and origin.
Why are some headers marked as "ignored"?
Headers like Date, Content-Length, Set-Cookie, ETag, and Age are expected to differ between a live CDN response and a direct origin response — they carry per-request, per-cache metadata. Flagging them as diffs would create noise. The tool still shows them but marks them as ignored so you can focus on the headers that actually indicate a configuration mismatch.
Is this tool safe to use on production URLs?
Yes. All requests are read-only HTTP GET requests — nothing is written or modified on your servers. The tool only compares what your server naturally returns. It's rate-limited and no data is stored. That said, if your origin has strict IP allowlisting, ensure the CoderYogi.com server IP is permitted, or consider internal testing for highly restricted environments.