HTTP 헤더 성능 분석기

What HTTP headers do for page speed

Every file your server sends starts with a few lines of headers. They tell the browser what to do with it: keep a copy or not, for how long, how it was compressed and which protocol to use next time.

How the wrong header slows a site down

Header problems are usually boring. A stylesheet that hasn't changed in a year gets downloaded again on every visit. The HTML goes out uncompressed. Nobody sees this on the page, but the waterfall shows requests that didn't need to happen and files three times the size they should be. The fix is usually a line or two in the server config.

What the header analyzer checks

1. Cache-Control and the cache lifetime

For repeat visits this is the header that matters most. Put a version or a hash in the file name of your CSS and JavaScript, and the file under that URL never changes, so it can stay in the browser cache for a year (max-age=31536000) and a returning visitor gets it without a single request. Without the hash, a year means visitors keep the old file after a deploy; that is why a long cache lifetime only works for versioned file names. Less than a month on a static file costs 15 points. Immutable is a small extra (5 points): Firefox and Safari skip the revalidation on reload, and Chrome stopped revalidating subresources on reload years ago.

2. Brotli, gzip or zstd compression

HTML, CSS and JavaScript are text, and text compresses well. Gzip often takes 70% or more off a file and Brotli gets another 15 to 20% on top. Zstd ends up close to Brotli in size and is quicker to compress, which helps HTML that is built per request. The server picks one from the browser's Accept-Encoding, so a browser without zstd still gets Brotli or gzip. No Content-Encoding header costs 25 points, and so does deflate.

3. HTTP/2, HTTP/3 and alt-svc

HTTP/2 puts every file from your domain on one connection. HTTP/3 runs on QUIC instead of TCP, so a new connection needs fewer round trips and one lost packet no longer holds up every file behind it, which is where a flaky mobile connection gains the most. Browsers usually learn about HTTP/3 from the alt-svc header (h3=":443") on an HTTP/2 response and switch on the next connection. HTTP/1.1 costs 15 points, HTTP/2 without alt-svc 10.

4. HSTS and the http to https redirect

Strict-Transport-Security tells the browser to use HTTPS for your domain from now on. The speed gain is small. A returning visitor who follows an old http:// link goes straight to https, without the connection on port 80 and the 301 that would otherwise count in their TTFB. Chrome already tries HTTPS first on http:// links, so in Chrome most of that gain is there without HSTS. A missing header, or a max-age under a year, still costs 5 points.

You start at 100 and lose points for each thing that is wrong. A redirect, headers over 1.4 KB or a Pragma header without Cache-Control cost you too, and most fixes come with the line to paste in nginx or Apache. Enter a URL above.