# HTTP Technology Explorer

> Headers, compression, caching, HTTP/2-3 hints, redirects, security and tech stack for a URL. Fetches a public URL (or analyses pasted raw response headers and HTML) and explains what the response reveals: redirect target and HTTPS upgrade, HTTP/2 and HTTP/3 advertisement (Alt-Svc), compression, caching (Cache-Control, ETag, Last-Modified, Age, Vary), security headers, and server, framework, CMS and analytics fingerprints with a confidence level for each.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://httptechnologyexplorer.usefulweb.site/ (interactive tool at https://httptechnologyexplorer.usefulweb.site/tool)
- JSON API: POST https://httptechnologyexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://httptechnologyexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://httptechnologyexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://httptechnologyexplorer.usefulweb.site/mcp - tool `http_technology_explorer`

## Inputs
- mode (select): Mode
- url (url): URL (live mode)
- rawHeaders (textarea): Raw response headers (paste mode) - Output of curl -sIL or the browser's raw response headers. Several blocks are read as a redirect chain.
- html (textarea): HTML source (paste mode, optional)

## Method
- Live mode: one GET of the URL through the platform's SSRF-guarded fetcher (redirects followed and re-validated, ports 80/443 only, body capped at 512 KiB), plus a small GET of the http:// variant to see whether plain HTTP is upgraded to HTTPS.
- The fetcher speaks HTTP/1.1, so HTTP/2 and HTTP/3 support is inferred from the Alt-Svc header (h2/h3); pasted headers show the real protocol in their status line.
- Caching follows RFC 9111: no-store, private, no-cache, s-maxage > max-age > Expires-Date; CDN-Cache-Control/Surrogate-Control override for shared caches.
- Security headers use the same deterministic rules as HeaderLens (HSTS, CSP, nosniff, framing, Referrer-Policy, Permissions-Policy, validators, Vary, compression, version disclosure).
- Technology fingerprints come from response headers (Server, X-Powered-By, vendor headers) and HTML markers (meta generator, well-known asset paths such as /wp-content/, /_next/static/, /_nuxt/). Confidence: high = explicit self-identification, medium = characteristic path, low = weak hint.