Dries Buytaert

Explanation

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

The type of the message body, specified as a MIME type.

The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.

The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.

public means the response may be stored by all caches, including browser caches, CDNs, and shared caches.
max-age specifies the maximum amount of seconds a page is considered valid. The higher max-age, the longer a page can be cached.

Specifies the page's intended audience. For example, en-US means that the document is intended for English language speakers in the United States. The language tags are defined in RFC 5646.

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
sameorigin means that this page can be displayed in a iframe, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny for added security.

Some of the software used to generate or serve this page.

Allows web developers to debug content security policies. Violations are reported to the specified report-uri, but not enforced.

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
script-src specifies valid sources for JavaScript. This includes not only URLs loaded directly into <script> elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.
object-src defines what <object>, <embed> and <applet> elements are allowed to be loaded and executed.
style-src defines what CSS stylesheets are allowed to be loaded.
frame-ancestors defines what parents may embed a page using <frame>, <iframe>, <object>, <embed> or <applet>.
report-to defines the URL that violations will be reported to. report-to is designed to replace report-uri, but still lacks universal browser support.
report-uri defines the URL that violations will be reported to. While report-uri is officially deprecated in favor of report-to, limited browser support for the latter means report-uri remains a viable option for now.
upgrade-insecure-requests instructs browsers to replace insecure URLs (HTTP) with secure URLs (HTTPS).

Specifies if this page can embed cross-origin resources. Allowing an attacker to embed a page and load its context into their memory space could result in data leaks. This header shifts the default behavior to an explicit opt-in model; the actual policy is specified in either a seperate Cross-Origin-Resource-Policy header or a CORS check.
require-corp specifies that this page can only embedded resources from the same origin, or resources explicitly marked as loadable from another origin.

A unique identifier that changes every time a page at a given URL changes. It acts as a fingerprint. A cache can compare Etag values to see if the page has changed and became stale. For example, a browsers will send the ETag value of a cached page in an If-None-Match header. The web server compares the ETag value sent by the browser with the ETag value of the current version of the page. If both values are the same, the web server sends back a 304 Not Modified status and no body.

The page was not served from a cache.

The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.
max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.
includesubdomains instructs the browser that all subdomains are HTTPS-only as well.

When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.
strict-origin means that the protocol, host, and port are shared, but only when the protocol security level remains the same (HTTPS → HTTPS). The path and query string are not shared. When the protocol becomes less secure (HTTPS → HTTP), nothing is shared.

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
same-origin-allow-popups specifies that if a popup is created, and the popup comes from the same origin, then we have full access to that popup.

The Cross-Origin-Resource-Policy header is part of the Fetch metadata request headers. It controls how resources can be shared across origins, enhancing security by preventing unauthorized access to resources.
Notice cross-origin means the resource can be loaded by documents from any origin. This is the least secure option.

Instructs clients like Flash and Acrobat Reader what cross-domain policy they have to use. none is the most secure setting. Data can't be shared across domains.