Dries Buytaert

Explanation

The type of the message body, specified as a MIME type.

The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.

Instructs Internet Explorer what compatibility mode to use to render this page. For example, ie=9 specifies that the page should be rendered as if the user was using Internet Explorer 9, even if they use Internet Explorer 11 or later. It's basically a hack for working around compatibility issues between different versions of Internet Explorer.

no-cache means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped.
Warning no-cache will cause a revalidation request to the origin server for every use of the cached response. Consider using public with appropriate max-age to improve caching efficiency.
Warning no-store means the response may not be stored in any cache, including the browser's cache.
max-age=0 with must-revalidate means caching is disabled and all requests must be validated with the origin server.
Notice It does not make sense to set must-revalidate with no-store; when nothing is cached, there is nothing to revalidate.
Notice It does not make sense to set must-revalidate with no-cache; must-revalidate is implied.
Notice no-store is set, so it does not make sense to set no-cache as well.

Warning The page can't be cached by any shared caches such as Varnish or a CDN. If the page is something everybody can access, this behavior is not desired.
Notice Pragma is a HTTP/1.0 header. This request uses HTTP/1.1. In HTTP/1.1, Pragma is deprecated and superseded by the Cache-Control header. Remove Pragma to save bandwidth and processing power.

This Expires date is in the past: the page is considered stale and will be removed from all caches.
Notice Because there is a Cache-Control header with a max-age and/or s-maxage directive, the Expires header will be ignored. Consider removing Expires to save bandwidth and processing power.

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

The size of the message body, in bytes.

P3P stands for Platform for Privacy Preferences. It is used to specify a privacy policy in a machine-readable way. The privacy policy is described in a compact format using tokens. A browser can use the information to inform readers about the website's privacy practices. Unfortunately, it is not well supported by current browsers.

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
script-src specifies valid sources for JavaScript. This includes not only URLs loaded directly into <script> elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.
base-uri defines what URLs can be used in the <base> URL.
object-src defines what <object>, <embed> and <applet> elements are allowed to be loaded and executed.
worker-src defines what workers scripts (e.g. Worker, ServiceWorker or SharedWorker) can be loaded and executed.
report-uri defines the URL that violations will be reported to. While report-uri is officially deprecated in favor of report-to, limited browser support for the latter means report-uri remains a viable option for now.
Notice Consider adding the upgrade-insecure-requests directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues.

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
report-uri defines the URL that violations will be reported to. While report-uri is officially deprecated in favor of report-to, limited browser support for the latter means report-uri remains a viable option for now.
Notice Consider adding the upgrade-insecure-requests directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues.

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
Notice unsafe-none means protection is disabled. The page could be placed in the same browsing context as other pages.

The Cross-Origin-Resource-Policy header is part of the Fetch metadata request headers. It controls how resources can be shared across origins, enhancing security by preventing unauthorized access to resources.
same-site means the resource can only be loaded by documents from the same site.

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

The Accept-CH header specifies HTTP Client Hints that the server requests from the client (typically a browser) to optimize content delivery.

• sec-ch-ua-arch: Requests the client's device CPU architecture, such as ARM or x86.
• sec-ch-ua-bitness: Requests the bit architecture of the client's operating system, such as 32-bit or 64-bit.
• sec-ch-ua-full-version: Requests the complete version number of the client's browser.
• sec-ch-ua-full-version-list: Requests a detailed list of version numbers for the client's browser and its significant components.
• sec-ch-ua-model: Requests the model of the client's device.
• sec-ch-ua-platform: Requests the operating system platform of the client's device, such as Windows or MacOS.
• sec-ch-ua-platform-version: Requests the version of the operating system the client is running.

This header enables the browser's built-in XSS protection. However, it's considered legacy and modern browsers may ignore it.

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
sameorigin means that this page can be displayed in a iframe, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny for added security.

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

A cookie that was sent from the server to the browser.
expires= sets the maximum lifetime of the cookie using a specific date.
domain= sets the domain to which the cookie will be sent.
path= indicates the path that must exist in the requested URL for the browser to send the cookie.
httponly forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie.

The alt-svc header advertises alternative services for accessing the same resource, enabling protocol negotiation and potential performance improvements.
h3 indicates that HTTP/3 is supported. Variants like h3-29 refer to specific drafts of the HTTP/3 protocol.
ma=2592000 specifies that the alternative service information is fresh for 2592000 seconds.
ma=2592000 specifies that the alternative service information is fresh for 2592000 seconds.

missing Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.

missing Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.

missing Add a Cross-Origin-Embedder-Policy to specify how this page can be loaded by cross-origin resources.

missing Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains.