HTTP Headers Analyzer
7 / 10
https://github.com/farhanffaa/Farhan/
WordPress → Browser5 missing headers, 0 warnings, 4 notices
Header
Value
Explanation
server
github.com
date
wed, 15 jan 2025 09:35:02 gmt
The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against
Max-Age or Expires.vary
x-pjax, x-pjax-container, turbo-visit, turbo-frame, accept-encoding, accept, x-requested-with
The
Notice This request has many
Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.Notice This request has many
Vary headers. More headers decrease the likelihood of a cache hit.etag
w/"31758d7120d38eba056693d3507300d0"
A unique identifier that changes every time a page at a given URL changes. It acts as a fingerprint. A cache can compare
Etag values to see if the page has changed and became stale. For example, a browsers will send the ETag value of a cached page in an If-None-Match header. The web server compares the ETag value sent by the browser with the ETag value of the current version of the page. If both values are the same, the web server sends back a 304 Not Modified status and no body. This particular Etag value starts with w/ which means that it is a weak identifier; while unlikely, multiple pages might have the same identifier. Weak identifiers are used because strong identifiers can be difficult and costly to generate.cache-control
max-age=0, private, must-revalidate
private means the response can only be stored by the browser's cache, but not by CDNs, proxies, or any other shared caches.max-age=0 with must-revalidate means caching is disabled and all requests must be validated with the origin server.strict-transport-security
max-age=31536000; includesubdomains; preload
The
Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.includesubdomains instructs the browser that all subdomains are HTTPS-only as well.preload recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only.x-frame-options
deny
X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.deny means that this page can never be displayed in an iframe. It's the most secure option.x-content-type-options
nosniff
The
The value
X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.The value
nosniff is correctly set, providing protection against MIME type sniffing attacks.x-xss-protection
0
This header enables the browser's built-in XSS protection. However, it's considered legacy and modern browsers may ignore it.
referrer-policy
no-referrer-when-downgrade
When a visitor navigates from one page to another page, browsers often pass along referrer information. The
Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.no-referrer-when-downgrade means that the protocol, host, port, path and query string are shared. It is only shared when the protocol security level remains the same (HTTP → HTTP, HTTPS → HTTPS) or improves (HTTP → HTTPS). When the protocol becomes less secure (HTTPS → HTTP), nothing is shared.content-security-policy
default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
default-src sets the default policy for fetching resources like JavaScript, images, CSS, fonts, AJAX requests, frames, HTML5 media.script-src specifies valid sources for JavaScript. This includes not only URLs loaded directly into <script> elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.base-uri defines what URLs can be used in the <base> URL.style-src defines what CSS stylesheets are allowed to be loaded.media-src defines what <audio>, <video> and <track> elements are allowed to be loaded.img-src defines what images and favicons can be loaded.worker-src defines what workers scripts (e.g. Worker, ServiceWorker or SharedWorker) can be loaded and executed.font-src defines what fonts can be loaded using CSS's font-face.frame-src defines what <frame> and <iframe> elements can be loaded.frame-ancestors defines what parents may embed a page using <frame>, <iframe>, <object>, <embed> or <applet>.child-src defines what <frame>, <iframe> or workers can be loaded.manifest-src defines what manifest files can be loaded.form-action defines what URLs can be used for form submissions.upgrade-insecure-requests instructs browsers to replace insecure URLs (HTTP) with secure URLs (HTTPS).accept-ranges
bytes
Used by the server to advertise its support of partial HTTP requests. The browser can ask for a range or subset of the response body. It's a feature that allows a browser to resume an interrupted download.
bytes is the only range unit currently supported. none means that the server does not support range requests.set-cookie
_gh_sess=jgl3oyitackw1vsybmqrrnmwlzzzb7adunj%2belt0qbnmixrdddgswd1ahgthjwknzadhleryzdx5c3jbqvcaxgxsxx7fpturw8qna%2fpcftjflsjdutwntnaz5dndso8hmsonwarh04rfkbhnezwbf74rjllrshlaoqbkpf5gls9f90wpleptsnlyvsf3q2tg97bivhrg9zwljlbq%2b6nutc4jokghvvvxi%2b1zwa0nkinw8%2bywfy90bp7tw4p%2behsxvi36iwefhpmt7ficvpdmxa%3d%3d--pf%2findbj2oprqlxq--gmw0lgx4l9h8bcqk3vnnnq%3d%3d; path=/; httponly; secure; samesite=lax
A cookie that was sent from the server to the browser.
Notice
path= indicates the path that must exist in the requested URL for the browser to send the cookie.Notice
samesite=lax instructs the browser not to share the cookie with third-party sites (e.g. when loading images, videos or frames from other sites), with one exception. The cookie will be sent when a user is navigating to the origin site from an external site (for example, when following a link). To improve protection against cross-site request forgery attacks, set to samesite=strict.secure instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks.httponly forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie.set-cookie
_octo=gh1.1.28023024.1736933701; path=/; domain=github.com; expires=thu, 15 jan 2026 09:35:01 gmt; secure; samesite=lax
A cookie that was sent from the server to the browser.
Notice
expires= sets the maximum lifetime of the cookie using a specific date.domain= sets the domain to which the cookie will be sent.path= indicates the path that must exist in the requested URL for the browser to send the cookie.Notice
samesite=lax instructs the browser not to share the cookie with third-party sites (e.g. when loading images, videos or frames from other sites), with one exception. The cookie will be sent when a user is navigating to the origin site from an external site (for example, when following a link). To improve protection against cross-site request forgery attacks, set to samesite=strict.secure instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks.set-cookie
logged_in=no; path=/; domain=github.com; expires=thu, 15 jan 2026 09:35:01 gmt; httponly; secure; samesite=lax
A cookie that was sent from the server to the browser.
Notice
expires= sets the maximum lifetime of the cookie using a specific date.domain= sets the domain to which the cookie will be sent.path= indicates the path that must exist in the requested URL for the browser to send the cookie.Notice
samesite=lax instructs the browser not to share the cookie with third-party sites (e.g. when loading images, videos or frames from other sites), with one exception. The cookie will be sent when a user is navigating to the origin site from an external site (for example, when following a link). To improve protection against cross-site request forgery attacks, set to samesite=strict.secure instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks.httponly forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie.x-github-request-id
36ac:29a38f:d850f6:12c61bb:67878145
A unique request identifier generated by GitHub. GitHub's customer support can use this ID to trace a request through its network.
permissions-policy
missing Add a
Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.cross-origin-embedder-policy
missing Add a
Cross-Origin-Embedder-Policy to specify how this page can be loaded by cross-origin resources.cross-origin-opener-policy
missing Add a
Cross-Origin-Opener-Policy header to opt-in into better browser isolation.cross-origin-resource-policy
missing Add a
Cross-Origin-Resource-Policy header to specify who can load this page.x-permitted-cross-domain-policies
missing Add a
X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains.Questions or feedback? Email dries@buytaert.net.