Multiple IPs per row: separate with semicolons
Each URL will be tested against all spoof IPs.
Configure target URLs and spoof IPs, then click Run Spoof Test.
Free HTTP host header spoof test tool — no sign-up, no install
A HTTP spoof test (also called host header spoofing) sends a request directly to a specific IP address while presenting a different domain name in the Host header. This lets you test origin servers, bypass CDNs, and validate staging environments without touching DNS.
For each URL you provide, two parallel requests run: one via normal public DNS (live CDN path), and one spoofed request that connects directly to your target IP with the original domain as the Host + SNI header. Status codes, headers, and body content are compared side-by-side.
All spoof requests are executed server-side — no client-side CORS limitations. No URLs, IPs, or response data are stored or logged. Rate-limited to prevent misuse. Only public HTTP/HTTPS targets are accepted.
Validate that your new CDN origin (F5, Fastly, Cloudflare) serves identical responses to Akamai before cutting over DNS. Compare status, headers, and body in bulk.
Send requests directly to your origin server IP while spoofing the public hostname. Verify that origin responses are correct before traffic is routed through a WAF or CDN.
Point the spoof IP at your staging server while the live URL resolves to production. See exact diffs between environments without changing any DNS or hosts file.
Detect if your WAF or bot defense is returning challenge pages to the spoofed origin path. The tool auto-detects F5 bot challenges and Akamai block pages.
Host header (and TLS SNI) to a different domain. It's a standard technique for testing origin servers, previewing staging environments, validating CDN migrations, and troubleshooting routing issues — all without modifying DNS or your local hosts file.
<script>, <style>, and HTML comments from both responses, then calculates a Sørensen-Dice bigram similarity score (0–100%). A score ≥ 95% is treated as a pass — small differences in timestamps or session tokens won't cause a false failure. A score below 95% indicates significant content divergence between CDN and origin.
Date, Content-Length, Set-Cookie, ETag, and Age are expected to differ between a live CDN response and a direct origin response — they carry per-request, per-cache metadata. Flagging them as diffs would create noise. The tool still shows them but marks them as ignored so you can focus on the headers that actually indicate a configuration mismatch.