HTTP Headers Analyzer
7 / 10
https://www.musicverter.com
Website → CloudFlare → Browser6 missing headers, 1 warnings, 1 notices
Header
Value
Explanation
date
mon, 23 dec 2024 04:00:12 gmt
The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against
Max-Age
or Expires
.cf-ray
8f65717b7f1c393d-iad
The
cf-ray
header provides a unique identifier for each request through Cloudflare. It's useful for troubleshooting and tracking requests in Cloudflare logs.cf-cache-status
hit
The page was served from Cloudflare's cache.
age
370625
The time in seconds that the page has been in the shared proxy cache. The maximum age is set by
max-age
or s-maxage
in the Cache-Control
header.last-modified
wed, 18 dec 2024 21:03:07 gmt
The date and time at which the origin server believes the page was last modified.
strict-transport-security
max-age=31536000; includesubdomains; preload
The
Strict-Transport-Security
header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.max-age
specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.includesubdomains
instructs the browser that all subdomains are HTTPS-only as well.preload
recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only.content-security-policy
frame-ancestors 'self'
The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
Notice Consider adding the
frame-ancestors
defines what parents may embed a page using <frame>
, <iframe>
, <object>
, <embed>
or <applet>
.Notice Consider adding the
upgrade-insecure-requests
directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues.surrogate-control
max-age=2147483647
surrogate-key
www.musicverter.com 6650646c9ee6f4035a80d040 pageid:6650646c9ee6f4035a80d099
x-frame-options
sameorigin
X-Frame-Options
prevents this URL from being embedded in an iframe
. This protects against clickjacking attacks.sameorigin
means that this page can be displayed in a iframe
, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny
for added security.x-lambda-id
10a2003b-e3f5-4bd9-ae83-0e65b4db2139
vary
accept-encoding
The
Vary
header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.set-cookie
_cfuvid=pmuz38o4idebzfgzxmjuwgl_o22i1cs5u1j4hya_wn4-1734926412119-0.0.1.1-604800000; path=/; domain=.cdn.webflow.com; httponly; secure; samesite=none
A cookie that was sent from the server to the browser.
Warning
domain=
sets the domain to which the cookie will be sent.path=
indicates the path that must exist in the requested URL for the browser to send the cookie.Warning
samesite=none
instructs the browser to send the cookie to all cross-site requests, such as on requests to load images or frames from other sites. This enables third-party sites to log cookie data. This could lead to data leaks and cross-site request forgery attacks. To improve security, set to samesite=strict
or samesite=lax
.secure
instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks.httponly
forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie.alt-svc
h3=":443"; ma=86400
The
alt-svc
header advertises alternative services for accessing the same resource, enabling protocol negotiation and potential performance improvements.h3
indicates that HTTP/3 is supported. Variants like h3-29
refer to specific drafts of the HTTP/3 protocol.ma=86400
specifies that the alternative service information is fresh for 86400 seconds.x-cluster-name
us-east-1-prod-hosting-red
referrer-policy
missing Add a
Referrer-Policy
header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy
header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.permissions-policy
missing Add a
Permissions-Policy
header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.cross-origin-embedder-policy
missing Add a
Cross-Origin-Embedder-Policy
to specify how this page can be loaded by cross-origin resources.cross-origin-opener-policy
missing Add a
Cross-Origin-Opener-Policy
header to opt-in into better browser isolation.cross-origin-resource-policy
missing Add a
Cross-Origin-Resource-Policy
header to specify who can load this page.x-permitted-cross-domain-policies
missing Add a
X-Permitted-Cross-Domain-Policies
header to prevent Flash, Adobe Reader and other clients from sharing data across domains.Questions or feedback? Email dries@buytaert.net.