Dries Buytaert

Explanation

Used by the server to advertise its support of partial HTTP requests. The browser can ask for a range or subset of the response body. It's a feature that allows a browser to resume an interrupted download. bytes is the only range unit currently supported. none means that the server does not support range requests.

The time in seconds that the page has been in the shared proxy cache. The maximum age is set by max-age or s-maxage in the Cache-Control header.

public means the response may be stored by all caches, including browser caches, CDNs, and shared caches.
max-age specifies the maximum amount of seconds a page is considered valid. The higher max-age, the longer a page can be cached.

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
default-src sets the default policy for fetching resources like JavaScript, images, CSS, fonts, AJAX requests, frames, HTML5 media.
script-src specifies valid sources for JavaScript. This includes not only URLs loaded directly into <script> elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.
object-src defines what <object>, <embed> and <applet> elements are allowed to be loaded and executed.
style-src defines what CSS stylesheets are allowed to be loaded.
img-src defines what images and favicons can be loaded.
font-src defines what fonts can be loaded using CSS's font-face.
frame-src defines what <frame> and <iframe> elements can be loaded.
upgrade-insecure-requests instructs browsers to replace insecure URLs (HTTP) with secure URLs (HTTPS).

The type of the message body, specified as a MIME type.

Specifies if this page can embed cross-origin resources. Allowing an attacker to embed a page and load its context into their memory space could result in data leaks. This header shifts the default behavior to an explicit opt-in model; the actual policy is specified in either a seperate Cross-Origin-Resource-Policy header or a CORS check.
require-corp specifies that this page can only embedded resources from the same origin, or resources explicitly marked as loadable from another origin.

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
same-origin specifies that the page can only share the browsing context with other pages from the same origin.

The Cross-Origin-Resource-Policy header is part of the Fetch metadata request headers. It controls how resources can be shared across origins, enhancing security by preventing unauthorized access to resources.
same-origin means the resource can only be loaded by documents from the same origin.

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

A unique identifier that changes every time a page at a given URL changes. It acts as a fingerprint. A cache can compare Etag values to see if the page has changed and became stale. For example, a browsers will send the ETag value of a cached page in an If-None-Match header. The web server compares the ETag value sent by the browser with the ETag value of the current version of the page. If both values are the same, the web server sends back a 304 Not Modified status and no body.

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.
strict-origin-when-cross-origin means that the protocol, host, port, path and query string are shared for same-site requests. For cross-site requests, protocol, host, and port are shared, but only when the protocol security level remains the same (HTTP → HTTP, HTTPS → HTTPS). For cross-site requests where the protocol becomes less secure (HTTPS → HTTP), nothing is shared.

The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.
max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.
includesubdomains instructs the browser that all subdomains are HTTPS-only as well.
preload recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only.

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
sameorigin means that this page can be displayed in a iframe, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny for added security.

A unique request identifier generated by Netlify. Netlify's customer support can use this ID to trace a request through its network.

Instructs clients like Flash and Acrobat Reader what cross-domain policy they have to use. none is the most secure setting. Data can't be shared across domains.

The size of the message body, in bytes.