Dries Buytaert

Explanation

The type of the message body, specified as a MIME type.

A list of request headers that need to be taken into account to determine whether a cached response can be used rather than making a new request with the origin server. The headers specified by Vary must match with those of the cached response.

Instructs Internet Explorer what compatibility mode to use to render this page. For example, ie=9 specifies that the page should be rendered as if the user was using Internet Explorer 9, even if they use Internet Explorer 11 or later. It's basically a hack for working around compatability issues between different versions of Internet Explorer.

no-cache means the response can be stored by any cache, but that the stored page must be validated with the origin before it can be served. If the origin confirms that the page has not changed, downloading of the body can be skipped.
Warning no-cache will cause a roundtrip to the origin web server for every request. Consider using public to avoid roundtrips and improve caching.
Warning no-store means the response may not be stored in any cache, including the browser's cache.
max-age specifies the maximum amount of seconds a page is considered valid. The higher max-age, the longer a page can be cached.
must-revalidate indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first.
Notice It does not make sense to set must-revalidate with no-store; when nothing is cached, there is nothing to revalidate.
Notice It does not make sense to set must-revalidate with no-cache; must-revalidate is implied.
Warning Because max-age is set to 0 seconds, nothing will ever be cached in shared caches or browsers. Caching is effectively disabled!
Notice no-store is set, so it does not make sense to set no-cache as well.

Warning The page can't be cached by any shared caches such as Varnish or a CDN. If the page is something everybody can access, this behavior is not desired.
Notice Pragma is a HTTP/1.0 header. This request uses HTTP/1.1. In HTTP/1.1, Pragma is deprecated and superseded by the Cache-Control header. Remove Pragma to save bandwidth and processing power.

This Expires date is in the past: the page is considered stale and will be removed from all caches.
Notice Because there is a Cache-Control header with a max-age and/or s-maxage directive, the Expires header will be ignored. Consider removing Expires to save bandwidth and processing power.

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when compairing against Max-Age or Expires.

The size of the message body, in bytes.

P3P stands for Platform for Privacy Preferences. It is used to specify a privacy policy in a machine-readable way. The privacy policy is described in a compact format using tokens. A browser can use the information to inform readers about the website's privacy practices. Unfortunately, it is not well supported by current browsers.

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

A Cross-Origin Resource Policy (CORP) header specifies the origins that are allowed to read this page.

• cross-origin specifies that any origin can read this page. This is the default option and the least safe.
• same-origin specifies that only requests from the same origin can read the resource. This is the most strict and safest option.
• same-site specifies that only requests from the same site can read the page. Is a bit more relaxed than same-origin as it allows different subdomains, schemes and ports.

Specifies a security policy to help browsers detect and block cross-site scripting (XSS) and data injection attacks.
report-uri defines the URL that violations will be reporeted to. These reports are are JSON objects that are POSTed to.
Notice report-uri is deprecated and superseded by report-to.

Specifies a security policy to help browsers detect and block cross-site scripting (XSS) and data injection attacks.
base-uri defines what URLs can be used in the <base> URL.
script-src defines what JavaScript is allowed to be loaded and executed.
object-src defines what <object>, <embed> and <applet> elements are allowed to be loaded and executed.
worker-src defines what workers scripts (e.g. Worker, ServiceWorker or SharedWorker) can be loaded and executed.
report-uri defines the URL that violations will be reporeted to. These reports are are JSON objects that are POSTed to.
Notice report-uri is deprecated and superseded by report-to.

The Accept-CH header specifies HTTP Client Hints that the server requests from the client (typically a browser) to optimize content delivery.

• sec-ch-ua-arch: Requests the client's device CPU architecture, such as ARM or x86.
• sec-ch-ua-bitness: Requests the bit architecture of the client's operating system, such as 32-bit or 64-bit.
• sec-ch-ua-full-version: Requests the complete version number of the client's browser.
• sec-ch-ua-full-version-list: Requests a detailed list of version numbers for the client's browser and its significant components.
• sec-ch-ua-model: Requests the model of the client's device.
• sec-ch-ua-platform: Requests the operating system platform of the client's device, such as Windows or MacOS.
• sec-ch-ua-platform-version: Requests the version of the operating system the client is running.

A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
Notice unsafe-none means protection is disabled. The page could be placed in the same browsing context as other pages.

Some of the software used to generate or serve this page.

X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks.
sameorigin means that this page can be displayed in a iframe, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny for added security.

Instructs the browser not to change the MIME type of the request. Browsers sometimes sniff or inspect the document to determine if the specified MIME type is correct. A browser changing the MIME type of a document can introduce security vulnerabilities. These vulnerabilities can occur when a website allows users to upload content and the user disguises a particular file type as something else. For example, a JavaScript file is uploaded as a JPEG file. When the browser changes the MIME type from image/jpeg to test/javascript, it gives attackers an opportunity to perform a cross-site scripting attack.

A cookie that was sent from the server to the browser.
expires= sets the maximum lifetime of the cookie using a specific date.
domain= sets the domain to which the cookie will be sent.
path= indicates the path that must exist in the requested URL for the browser to send the cookie.
httponly forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie.

The alt-svc header advertises alternative services for accessing the same resource, enabling protocol negotiation and potential performance improvements.
h3 indicates that HTTP/3 is supported. Variants like h3-29 refer to specific drafts of the HTTP/3 protocol.
ma=2592000 specifies that the alternative service information is fresh for 2592000 seconds.
ma=2592000 specifies that the alternative service information is fresh for 2592000 seconds.

missing Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.

missing Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.

missing Add a Cross-Origin-Embedder-Policy to specify how this page can be loaded by cross-origin resources.

missing Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains.