HTTP Headers Analyzer
3 / 10
https://groups.google.com/g/paxoqiq/c/4b_WxodQ8Kc
Website → Browser4 missing headers, 4 warnings, 8 notices
Header
Value
Explanation
vary
sec-fetch-dest, sec-fetch-mode, sec-fetch-site
A list of request headers that need to be taken into account to determine whether a cached response can be used rather than making a new request with the origin server. The headers specified by
Vary
must match with those of the cached response.x-ua-compatible
ie=edge
Instructs Internet Explorer what compatibility mode to use to render this page. For example,
ie=9
specifies that the page should be rendered as if the user was using Internet Explorer 9, even if they use Internet Explorer 11 or later. It's basically a hack for working around compatability issues between different versions of Internet Explorer.cache-control
no-cache, no-store, max-age=0, must-revalidate
no-cache
means the response can be stored by any cache, but that the stored page must be validated with the origin before it can be served. If the origin confirms that the page has not changed, downloading of the body can be skipped.Warning
no-cache
will cause a roundtrip to the origin web server for every request. Consider using public
to avoid roundtrips and improve caching.Warning
no-store
means the response may not be stored in any cache, including the browser's cache.max-age
specifies the maximum amount of seconds a page is considered valid. The higher max-age
, the longer a page can be cached.must-revalidate
indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first.Notice It does not make sense to set
must-revalidate
with no-store
; when nothing is cached, there is nothing to revalidate.Notice It does not make sense to set
must-revalidate
with no-cache
; must-revalidate
is implied.Warning Because
max-age
is set to 0 seconds, nothing will ever be cached in shared caches or browsers. Caching is effectively disabled!Notice
no-store
is set, so it does not make sense to set no-cache
as well.pragma
no-cache
Warning The page can't be cached by any shared caches such as Varnish or a CDN. If the page is something everybody can access, this behavior is not desired.
Notice
Notice
Pragma
is a HTTP/1.0 header. This request uses HTTP/1.1. In HTTP/1.1, Pragma
is deprecated and superseded by the Cache-Control
header. Remove Pragma
to save bandwidth and processing power.expires
mon, 01 jan 1990 00:00:00 gmt
This
Notice Because there is a
Expires
date is in the past: the page is considered stale and will be removed from all caches.Notice Because there is a
Cache-Control
header with a max-age
and/or s-maxage
directive, the Expires
header will be ignored. Consider removing Expires
to save bandwidth and processing power.date
sat, 18 may 2024 21:51:37 gmt
The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when compairing against
Max-Age
or Expires
.content-length
703311
The size of the message body, in bytes.
p3p
cp="this is not a p3p policy! see g.co/p3phelp for more info."
P3P
stands for Platform for Privacy Preferences. It is used to specify a privacy policy in a machine-readable way. The privacy policy is described in a compact format using tokens. A browser can use the information to inform readers about the website's privacy practices. Unfortunately, it is not well supported by current browsers.content-security-policy
require-trusted-types-for 'script';report-uri /_/groupsfrontendui/cspreport
Specifies a security policy to help browsers detect and block cross-site scripting (XSS) and data injection attacks.
Notice
report-uri
defines the URL that violations will be reporeted to. These reports are are JSON objects that are POST
ed to.Notice
report-uri
is deprecated and superseded by report-to
.content-security-policy
script-src 'report-sample' 'nonce-8cy1av2pcsms5vk3bysfma' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/groupsfrontendui/cspreport;worker-src 'self'
Specifies a security policy to help browsers detect and block cross-site scripting (XSS) and data injection attacks.
Notice
base-uri
defines what URLs can be used in the <base>
URL.script-src
defines what JavaScript is allowed to be loaded and executed.object-src
defines what <object>
, <embed>
and <applet>
elements are allowed to be loaded and executed.worker-src
defines what workers scripts (e.g. Worker
, ServiceWorker
or SharedWorker
) can be loaded and executed.report-uri
defines the URL that violations will be reporeted to. These reports are are JSON objects that are POST
ed to.Notice
report-uri
is deprecated and superseded by report-to
.permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.
cross-origin-opener-policy
unsafe-none
A Cross-Origin Opener Policy (COOP) header specifies how this page's browsing context can be shared when opened in a 'browser tab', 'popup', 'iframe', etc. The policy can force the creation of a new top-level browsing context to make sure the browser context is protected or isolated.
Notice
Notice
unsafe-none
means protection is disabled. The page could be placed in the same browsing context as other pages.cross-origin-resource-policy
same-site
A Cross-Origin Resource Policy (CORP) header specifies the origins that are allowed to read this page.
cross-origin
specifies that any origin can read this page. This is the default option and the least safe.same-origin
specifies that only requests from the same origin can read the resource. This is the most strict and safest option.same-site
specifies that only requests from the same site can read the page. Is a bit more relaxed thansame-origin
as it allows different subdomains, schemes and ports.
accept-ch
sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-model, sec-ch-ua-wow64, sec-ch-ua-form-factor, sec-ch-ua-platform, sec-ch-ua-platform-version
The
Accept-CH
header specifies HTTP Client Hints that the server requests from the client (typically a browser) to optimize content delivery.
sec-ch-ua-arch
: Requests the client's device CPU architecture, such as ARM or x86.sec-ch-ua-bitness
: Requests the bit architecture of the client's operating system, such as 32-bit or 64-bit.sec-ch-ua-full-version
: Requests the complete version number of the client's browser.sec-ch-ua-full-version-list
: Requests a detailed list of version numbers for the client's browser and its significant components.sec-ch-ua-model
: Requests the model of the client's device.sec-ch-ua-platform
: Requests the operating system platform of the client's device, such as Windows or MacOS.sec-ch-ua-platform-version
: Requests the version of the operating system the client is running.
reporting-endpoints
default="/_/groupsfrontendui/web-reports?context=ejwnw00og3ecb_d51l8asukalllmt1rpnk8ph81r5k1ktmurzvs57jnngtc5aq5ohpyobqtmzfh7g5jadpdnusipg2sorzktczlfpz72tqh2h22sx2e7dhzw-1na3vcbxw6ofphjn8yxjhmetzh8eq6jbsoc74_neo4ownivuav2oygw6pw10uv3mibgr03m0vdgcxg6f_gkizoovtbjrx7eukahnq_eqxpoyy1kfqt-okynafu3byhw32rzkx3o1ngohupobj5orwsstp3bgpugiycam6eb5j3l0p-gzmowdbb901malhonptncm8foaazqsf3a3fbnlq7ytu0vl7kzdlui8nikocgrktwuyml0llmoxptvmblxit4-ufl43kinkhl_as1ahcc"
server
esf
Some of the software used to generate or serve this page.
x-xss-protection
0
x-frame-options
sameorigin
X-Frame-Options
prevents this URL from being embedded in an iframe
. This protects against clickjacking attacks.sameorigin
means that this page can be displayed in a iframe
, but only on the currrent origin. It can't be displayed on another domain. Consider setting this to deny
for added security.x-content-type-options
nosniff
Instructs the browser not to change the MIME type of the request. Browsers sometimes sniff or inspect the document to determine if the specified MIME type is correct. A browser changing the MIME type of a document can introduce security vulnerabilities. These vulnerabilities can occur when a website allows users to upload content and the user disguises a particular file type as something else. For example, a JavaScript file is uploaded as a JPEG file. When the browser changes the MIME type from
image/jpeg
to test/javascript
, it gives attackers an opportunity to perform a cross-site scripting attack.set-cookie
nid=514=thfzewjltssfkixqaunddn2t87vzc8qzfrbnolxozv-ng7zjwcibe2nxa3iwc2psgl4dko4vf-_khn1dnhpb3bupl_mm1clteo1chrsykmlt9zh0vgqnw_lle_ecnbpko_cxfnopvejjax7n7bmp9_cnacc_3ul2a5pjmd5kuyu; expires=sun, 17-nov-2024 21:51:37 gmt; path=/; domain=.google.com; httponly
A cookie that was sent from the server to the browser.
expires=
sets the maximum lifetime of the cookie using a specific date.domain=
sets the domain to which the cookie will be sent.path=
indicates the path that must exist in the requested URL for the browser to send the cookie.httponly
forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie.alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
The
alt-svc
header advertises alternative services for accessing the same resource, enabling protocol negotiation and potential performance improvements.h3
indicates that HTTP/3 is supported. Variants like h3-29
refer to specific drafts of the HTTP/3 protocol.ma=2592000
specifies that the alternative service information is fresh for 2592000 seconds.ma=2592000
specifies that the alternative service information is fresh for 2592000 seconds.strict-transport-security
missing Add a
Strict-Transport-Security
header. The Strict-Transport-Security
header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.referrer-policy
missing Add a
Referrer-Policy
header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy
header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.cross-origin-embedder-policy
missing Add a
Cross-Origin-Embedder-Policy
to specify how this page can be loaded by cross-origin resources.x-permitted-cross-domain-policies
missing Add a
X-Permitted-Cross-Domain-Policies
header to prevent Flash, Adobe Reader and other clients from sharing data across domains.Questions or feedback? Email dries@buytaert.net.