HTTP header analysis for https://sites.google.com/view/weebly242324/home

HTTP Headers Analyzer

3 / 10

https://sites.google.com/view/weebly242324/home

WordPress → Browser
4 missing headers, 4 warnings, 7 notices

Value

Explanation

text/html; charset=utf-8

The type of the message body, specified as a MIME type.

deny

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
deny means that this page can never be displayed in an iframe. It's the most secure option.

sec-fetch-dest, sec-fetch-mode, sec-fetch-site

The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.

no-cache, no-store, max-age=0, must-revalidate

no-cache means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped.
Warning no-cache will cause a revalidation request to the origin server for every use of the cached response. Consider using public with appropriate max-age to improve caching efficiency.
Warning no-store means the response may not be stored in any cache, including the browser's cache.
max-age specifies the maximum amount of seconds a page is considered valid. The higher max-age, the longer a page can be cached.
must-revalidate indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first.
Notice It does not make sense to set must-revalidate with no-store; when nothing is cached, there is nothing to revalidate.
Notice It does not make sense to set must-revalidate with no-cache; must-revalidate is implied.
Warning Because max-age is set to 0 seconds, nothing will ever be cached in shared caches or browsers. Caching is effectively disabled!
Notice no-store is set, so it does not make sense to set no-cache as well.

no-cache

Warning The page can't be cached by any shared caches such as Varnish or a CDN. If the page is something everybody can access, this behavior is not desired.
Notice Pragma is a HTTP/1.0 header. This request uses HTTP/1.1. In HTTP/1.1, Pragma is deprecated and superseded by the Cache-Control header. Remove Pragma to save bandwidth and processing power.

mon, 01 jan 1990 00:00:00 gmt

This Expires date is in the past: the page is considered stale and will be removed from all caches.
Notice Because there is a Cache-Control header with a max-age and/or s-maxage directive, the Expires header will be ignored. Consider removing Expires to save bandwidth and processing power.

mon, 30 dec 2024 14:30:11 gmt

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

799675

The size of the message body, in bytes.

cp="this is not a p3p policy! see g.co/p3phelp for more info."

P3P stands for Platform for Privacy Preferences. It is used to specify a privacy policy in a machine-readable way. The privacy policy is described in a compact format using tokens. A browser can use the information to inform readers about the website's privacy practices. Unfortunately, it is not well supported by current browsers.

unsafe-none

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
Notice unsafe-none means protection is disabled. The page could be placed in the same browsing context as other pages.

base-uri 'self';object-src 'none';report-uri /_/view/cspreport;script-src 'report-sample' 'nonce-y3bdalrjzclzeslua0ynda' 'unsafe-inline' 'unsafe-eval';worker-src 'self';frame-ancestors https://google-admin.corp.google.com/

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
script-src specifies valid sources for JavaScript. This includes not only URLs loaded directly into <script> elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.
base-uri defines what URLs can be used in the <base> URL.
object-src defines what <object>, <embed> and <applet> elements are allowed to be loaded and executed.
worker-src defines what workers scripts (e.g. Worker, ServiceWorker or SharedWorker) can be loaded and executed.
frame-ancestors defines what parents may embed a page using <frame>, <iframe>, <object>, <embed> or <applet>.
report-uri defines the URL that violations will be reported to. While report-uri is officially deprecated in favor of report-to, limited browser support for the latter means report-uri remains a viable option for now.
Notice Consider adding the upgrade-insecure-requests directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues.

same-site

The Cross-Origin-Resource-Policy header is part of the Fetch metadata request headers. It controls how resources can be shared across origins, enhancing security by preventing unauthorized access to resources.
same-site means the resource can only be loaded by documents from the same site.

origin

When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.
origin means that the protocol, host, and port are shared. The path and query string are not shared.

default="/web-reports?jobset=prod&bl=editors.sites-viewer-frontend_20241210.02_p1&clss=1&context=ejwvyh9m1gucb_bnzz2fr4xt-zhtsug7ukkrdqgn5ncf14gxfrlqubccoo48yycdxye0lyergzlwtnbqhbzkcz4izbxmtfu1wk0t1xq1sselji4jitg5su5698frn1f0sfr3lgretwrprzpsgbi6qbkctsl2qdxxytqq7pjs7snjrk9k60a_lfnajckkooz7yrwwosrzaph_kkwr5irkr8i3acl-go-wjdsh3susxqblwljmegmjkvnh7r1gpk40sqvnriasjkxxs5g1gclgza3qbidhfzwrbqwlzciaitd1jivb2thgkqb8zwkvan1vf_fssnegurbamok8eziobnko3hyg-ti01y5zj4zmh_gn-kigxl-fo-yqd8ozjhc_ak9cx-f7wcoi3aghxahnmyj8ax-e_wpllrfeabs7ucoet6pukgk6p0pvcuvtkluf7l-dkw7cax-eaantme9ka-_kf9hw-bl88rxep1goeubqdahoggtsie2qo6otxbbqvirwohwusbwb32cxuayf3mjhglf6vziak_v04mmwofsifviqxktd2wg9uag7p9olijas6mxjynu8ihywngoqezh51idmiwevqtwmw14zidr4c9ogjkjozyl4o6pehianj5wi5-heo6widzzgg5afd4ld8hv8o2iwxlevivuwnbpmpmpsnm5ahf8ud9nnac910buq4narfm4suuhx-dvkir7ionc4h5rid9x19zidvtncfamvj7vjapffnw3u9dew3ezqpxnie-wt0opte4bayen9htjartndxzbwyupjoplgglzb_fqanug5f4aq4hvohbnpdnjfmkwepd_gs88gfqftd3gpo9vloiis9vijvn3speog8xlpg9hm56kfjuvpu6botzshypbtepz2-qkxwl-cpsmwmjjlp4jrf6aqohutqd2w--samwcoby58moweo5qjzxja8jza-rdmlttkpfzuwq1chftpr1zsyshmjekdrn8aztpuhvur2me5faoklmyowpjuj1x-_n_dwouovluhtnkfol6iu96dowfilrpwafy9yhxy7lqvacfehbu4fv2kejvf_2fjgnjoym5k3mguttjrbq3pdra7ushngtpb0mps9va72vpdmzwr9vbmvmzgekzw5b7m_wchr7np&build-label=editors.sites-viewer-frontend_20241210.02_p1&imp-sid=cmvjk7paz4odfrrczgaddyaucq&is-cached-offline=false"

esf

This header enables the browser's built-in XSS protection. However, it's considered legacy and modern browsers may ignore it.

nosniff

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

The alt-svc header advertises alternative services for accessing the same resource, enabling protocol negotiation and potential performance improvements.
h3 indicates that HTTP/3 is supported. Variants like h3-29 refer to specific drafts of the HTTP/3 protocol.
ma=2592000 specifies that the alternative service information is fresh for 2592000 seconds.
ma=2592000 specifies that the alternative service information is fresh for 2592000 seconds.

missing Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.

missing Add a Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.

missing Add a Cross-Origin-Embedder-Policy to specify how this page can be loaded by cross-origin resources.

missing Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains.

Questions or feedback? Email dries@buytaert.net.