HTTP Headers Analyzer
3 / 10
https://tutorial.ninja
Website → Apache → Browser5 missing headers, 3 warnings, 6 notices
Header
Value
Explanation
expires
thu, 19 nov 1981 08:52:00 gmt
This
Notice Because there is a
PS: November 19th is my birthday! 🎂
Expires
date is in the past: the page is considered stale and will be removed from all caches.Notice Because there is a
Cache-Control
header with a max-age
and/or s-maxage
directive, the Expires
header will be ignored. Consider removing Expires
to save bandwidth and processing power.PS: November 19th is my birthday! 🎂
cache-control
no-store, no-cache, must-revalidate
no-cache
means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped.Warning
no-cache
will cause a revalidation request to the origin server for every use of the cached response. Consider using public
with appropriate max-age
to improve caching efficiency.Warning
no-store
means the response may not be stored in any cache, including the browser's cache.must-revalidate
indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first.Notice It does not make sense to set
must-revalidate
with no-store
; when nothing is cached, there is nothing to revalidate.Notice It does not make sense to set
must-revalidate
with no-cache
; must-revalidate
is implied.Notice
no-store
is set, so it does not make sense to set no-cache
as well.pragma
no-cache
Warning The page can't be cached by any shared caches such as Varnish or a CDN. If the page is something everybody can access, this behavior is not desired.
Notice
Notice
Pragma
is a HTTP/1.0 header. This request uses HTTP/1.1. In HTTP/1.1, Pragma
is deprecated and superseded by the Cache-Control
header. Remove Pragma
to save bandwidth and processing power.set-cookie
phpsessid=1586f9a115546f6b24a1de4561fea64e; path=/
A cookie that was sent from the server to the browser.
path=
indicates the path that must exist in the requested URL for the browser to send the cookie.strict-transport-security
max-age=31536000; includesubdomains
The
Strict-Transport-Security
header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.max-age
specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.includesubdomains
instructs the browser that all subdomains are HTTPS-only as well.x-frame-options
sameorigin
X-Frame-Options
prevents this URL from being embedded in an iframe
. This protects against clickjacking attacks.sameorigin
means that this page can be displayed in a iframe
, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny
for added security.x-content-type-options
nosniff
The
The value
X-Content-Type-Options
header, when set to nosniff
, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.The value
nosniff
is correctly set, providing protection against MIME type sniffing attacks.referrer-policy
no-referrer-when-downgrade
When a visitor navigates from one page to another page, browsers often pass along referrer information. The
Referrer-Policy
header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string.no-referrer-when-downgrade
means that the protocol, host, port, path and query string are shared. It is only shared when the protocol security level remains the same (HTTP → HTTP, HTTPS → HTTPS) or improves (HTTP → HTTPS). When the protocol becomes less secure (HTTPS → HTTP), nothing is shared.permissions-policy
geolocation=(self), camera=()
Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.
vary
user-agent
The
Notice Varying on
Vary
header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.Notice Varying on
user-agent
can lead to low cache efficiency due to the high number of unique user agents. Only use this if you're serving significantly different content based on user agent.date
mon, 23 dec 2024 03:52:51 gmt
The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against
Max-Age
or Expires
.server
apache
content-security-policy
missing Add a
Content-Security-Policy
header. The Content-Security-Policy
header helps browsers prevent cross site scripting (XSS) and data injection attacks.cross-origin-embedder-policy
missing Add a
Cross-Origin-Embedder-Policy
to specify how this page can be loaded by cross-origin resources.cross-origin-opener-policy
missing Add a
Cross-Origin-Opener-Policy
header to opt-in into better browser isolation.cross-origin-resource-policy
missing Add a
Cross-Origin-Resource-Policy
header to specify who can load this page.x-permitted-cross-domain-policies
missing Add a
X-Permitted-Cross-Domain-Policies
header to prevent Flash, Adobe Reader and other clients from sharing data across domains.Questions or feedback? Email dries@buytaert.net.