About HttpFixer
HttpFixer is a free, browser-based suite of HTTP developer tools built by MetricLogic. Each tool fetches live data from your URL, detects your stack, and outputs stack-specific configuration — rather than generic recommendations.
How it works
Each tool follows the same pattern: fetch live data from your URL, read the response headers to identify your stack (Nginx, Cloudflare, Vercel, Express, and others), then output configuration specific to that stack. The output is always meant to be a starting point — always test in a staging environment before deploying to production.
Processing happens entirely in your browser. Your URLs, headers, and configs are not sent to any server beyond the target you specify.
Principles
The tools
| Tool | What it does |
|---|---|
| HeadersFixer | Scans HTTP security headers and generates stack-specific config for missing or misconfigured headers |
| CORSFixer | Sends a live OPTIONS preflight to your API and generates middleware fixes for common CORS errors |
| OAuthFixer | Diagnoses OAuth 2.0 / OIDC errors and generates provider-specific fixes for Auth0, Okta, Cognito, and others |
| CSPFixer | Scans your live page resources and generates a working Content Security Policy |
| EdgeFix | Audits Cache-Control and CDN caching headers and identifies misconfigurations |
| SpeedFixer | Fetches live PageSpeed audit results and generates stack-specific performance config |
| Header Diff | Compares HTTP headers between two URLs side by side |
| Cache Simulator | Visualises Cache-Control directive behaviour including stale-while-revalidate windows |
| HSTS Preload Checker | Checks preload list status and HSTS header requirements |
| JWT Debugger | Decodes and validates JSON Web Tokens — flags expired tokens, weak algorithms, and missing claims |
| CSP Validator | Validates a CSP string against W3C spec — flags unsafe-inline, missing directives, and syntax errors |
| Security Headers Scorer | Scores your security headers 0-100 with per-header breakdown and fix links |
| Mixed Content Fixer | Finds HTTP resources on your HTTPS page and generates the upgrade config |
| Redirect Chain Fixer | Follows redirect hops in real time and identifies loops |
| Pre-Launch Checklist | 20 HTTP checks before shipping — security, CORS, cache, redirects, and staging verification |
Part of MetricLogic
HttpFixer is part of the MetricLogic network of free developer diagnostic tools:
- ConfigClarity.dev — Server & DevOps audit tools (cron, SSL, Docker, firewall)
- DomainPreflight.dev — Domain & email authentication (DNS, DMARC, WHOIS)
- HttpFixer.dev — HTTP headers, CORS, CSP, OAuth (you are here)
Open source
All HttpFixer code is MIT licensed and public at github.com/metriclogic26/httpfixer.
View all tools →