Cache-Control is a short header with a long list of ways to misread it: no-cache does not mean do not store, max-age=0 is not no-store, s-maxage only speaks to shared caches, and without any of them a browser invents a lifetime from Last-Modified. This check fetches an address from this server, computes the freshness lifetime for a browser and for a shared cache the way RFC 9111 does, then sends a request with If-None-Match and one with If-Modified-Since to see whether the validators actually work, and a second plain request to read what a cache in front does the second time.
Redirects and up to four requests of at most 256 KB each go from this server to the address entered. Hosts in private, loopback and link-local networks are refused. The query is protected by reCAPTCHA v3; the calling IP address and the target are stored for one hour to limit the rate.
Limits worth knowing: only one of the resolved addresses is tested; a CDN answers per edge, so the cache status seen from here may differ elsewhere; the second request follows the first within seconds, which a cache with a minimum TTL may treat differently from real traffic; headers set by JavaScript or Service Workers are not visible; and the heuristic lifetime is the RFC suggestion of ten percent, while individual browsers use their own rules.