Dries Buytaert

Explanation

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

The type of the message body, specified as a MIME type.

The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.

Some of the software used to generate or serve this page.
Warning Sharing too many details about a server or web application makes it easier for hackers to target a website. Avoid specific version numbers such as 8.1.30, especially when running software that is end-of-life and/or has known security bugs. Consider removing this header. At a miminum, remove any version number.

DNS requests are very small in terms of bandwidth, but latency can be quite high. Prefetching DNS results can significantly improve page load performance.
Notice This feature is non-standard and is not on a standards track. Not supported by all browsers.

Indicates which HTTP methods can be used.

Indicates which HTTP headers can be used.

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
upgrade-insecure-requests instructs browsers to replace insecure URLs (HTTP) with secure URLs (HTTPS).

Specifies if this page can embed cross-origin resources. Allowing an attacker to embed a page and load its context into their memory space could result in data leaks. This header shifts the default behavior to an explicit opt-in model; the actual policy is specified in either a seperate Cross-Origin-Resource-Policy header or a CORS check.
Notice unsafe-none means protection is disabled. This page can embedded any cross-origin resource. This is often required to embed things like YouTube videos.
Policy violations will be submitted to the URL in the report-to field.

Specifies if this page can embed cross-origin resources. Allowing an attacker to embed a page and load its context into their memory space could result in data leaks. This header shifts the default behavior to an explicit opt-in model; the actual policy is specified in either a seperate Cross-Origin-Resource-Policy header or a CORS check.
cross-origin-embedder-policy-report-only means the policy is not enforced. Typically used to test a policy before enabling it.
Notice unsafe-none means protection is disabled. This page can embedded any cross-origin resource. This is often required to embed things like YouTube videos.
Policy violations will be submitted to the URL in the report-to field.

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
Notice unsafe-none means protection is disabled. The page could be placed in the same browsing context as other pages.

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
cross-origin-opener-policy-report-only means the policy is not enforced. Typically used to test a policy before enabling it.
Notice unsafe-none means protection is disabled. The page could be placed in the same browsing context as other pages.
Policy violations will be submitted to the URL in the report-to field.

The Cross-Origin-Resource-Policy header is part of the Fetch metadata request headers. It controls how resources can be shared across origins, enhancing security by preventing unauthorized access to resources.
Notice cross-origin means the resource can be loaded by documents from any origin. This is the least secure option.

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.
strict-origin-when-cross-origin means that the protocol, host, port, path and query string are shared for same-site requests. For cross-site requests, protocol, host, and port are shared, but only when the protocol security level remains the same (HTTP → HTTP, HTTPS → HTTPS). For cross-site requests where the protocol becomes less secure (HTTPS → HTTP), nothing is shared.

The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.
max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.

Notice This is a deprecated version of the Content Security Policy header. Modern browsers use the Content-Security-Policy header without the "X-" prefix.

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
sameorigin means that this page can be displayed in a iframe, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny for added security.

Instructs clients like Flash and Acrobat Reader what cross-domain policy they have to use. none is the most secure setting. Data can't be shared across domains.

Instructs Internet Explorer what compatibility mode to use to render this page. For example, ie=9 specifies that the page should be rendered as if the user was using Internet Explorer 9, even if they use Internet Explorer 11 or later. It's basically a hack for working around compatibility issues between different versions of Internet Explorer.

rel="https://api.w.org/" is where you can learn more about WordPress' REST API. Applications can interact with this WordPress site by sending and receiving JSON objects.

Specifies a link that might be of interest to the browser.

rel="shortlink" specifies a shorter URL for the current page, to be used in space constrained interfaces and/or for manual entry.

A unique identifier that changes every time a page at a given URL changes. It acts as a fingerprint. A cache can compare Etag values to see if the page has changed and became stale. For example, a browsers will send the ETag value of a cached page in an If-None-Match header. The web server compares the ETag value sent by the browser with the ETag value of the current version of the page. If both values are the same, the web server sends back a 304 Not Modified status and no body. This particular Etag value starts with w/ which means that it is a weak identifier; while unlikely, multiple pages might have the same identifier. Weak identifiers are used because strong identifiers can be difficult and costly to generate.

The page was served from LiteSpeed's cache.

Some of the software used to generate or serve this page.

The time in seconds that the page has been in the shared proxy cache. The maximum age is set by max-age or s-maxage in the Cache-Control header.

The alt-svc header advertises alternative services for accessing the same resource, enabling protocol negotiation and potential performance improvements.
h3 indicates that HTTP/3 is supported. Variants like h3-29 refer to specific drafts of the HTTP/3 protocol.
ma=86400 specifies that the alternative service information is fresh for 86400 seconds.