{
"url": "https://firstnow.ru/blog/post/12-zachem-nuzhen-bortovoy-kompyyuter-i-kakoy-vybraty",
"score": 1,
"summary": {
"missing": 8,
"warnings": 4,
"notices": 6
},
"caches": [
"Website",
"Nginx",
"Browser"
],
"headers": {
"server": {
"value": "nginx/1.22.0",
"findings": [
{
"severity": "info",
"message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
},
{
"severity": "warning",
"message": "The server header exposes a specific version number (1.22.0). This makes it easier for attackers to find known vulnerabilities for that version. Remove or suppress the version number."
}
]
},
"date": {
"value": "tue, 20 oct 2026 08:25:25 gmt",
"findings": [
{
"severity": "info",
"message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires."
}
]
},
"content-type": {
"value": "text/html; charset=utf-8",
"findings": [
{
"severity": "info",
"message": "The type of the message body, specified as a MIME type."
}
]
},
"transfer-encoding": {
"value": "chunked",
"findings": [
{
"severity": "info",
"message": "Specifies how the resource is transferred. Not to be confused with Content-Encoding which specifies how the request body is compressed. Transfer encoding operates at a lower level than content encoding."
},
{
"severity": "info",
"message": "chunked means that the data is sent in chunks. Chunks are sent out and received independently of one another. The server can stream the document and does not have to wait for the full document to be generated. Similarly, the browser can start processing chunks as they come in rather than having to wait for the entire document to be downloaded."
}
]
},
"connection": {
"value": "keep-alive",
"findings": [
{
"severity": "info",
"message": "Controls whether the TCP connection stays open after this request finishes. keep-alive means the browser can reuse the same connection for additional requests, avoiding the overhead of a new TCP handshake. close means the connection will be shut down after this response."
}
]
},
"x-powered-by": {
"value": "fat-free framework",
"findings": [
{
"severity": "info",
"message": "Some of the software used to generate or serve this page."
}
]
},
"x-frame-options": {
"value": "sameorigin",
"findings": [
{
"severity": "info",
"message": "X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks."
},
{
"severity": "info",
"message": "sameorigin allows this page to be displayed in an iframe on the same origin. This is the recommended setting."
}
]
},
"x-xss-protection": {
"value": "1; mode=block",
"findings": [
{
"severity": "info",
"message": "A legacy header that enables the browser's built-in cross-site scripting (XSS) filter. Modern browsers ignore it in favor of Content-Security-Policy."
},
{
"severity": "info",
"message": "1 enables XSS filtering."
},
{
"severity": "info",
"message": "mode=block blocks the response entirely if an attack is detected, instead of sanitizing the page."
},
{
"severity": "notice",
"message": "Add a Content-Security-Policy header for more comprehensive protection."
}
]
},
"x-content-type-options": {
"value": "nosniff",
"findings": [
{
"severity": "info",
"message": "The X-Content-Type-Options header prevents browsers from guessing a response's content type. Without it, browsers may interpret files differently than intended, which can lead to security vulnerabilities."
},
{
"severity": "info",
"message": "The value nosniff is correctly set."
}
]
},
"pragma": {
"value": "no-cache",
"findings": [
{
"severity": "notice",
"message": "Pragma: no-cache forces revalidation with the origin server on every request. Pragma is a legacy HTTP/1.0 directive, superseded by Cache-Control. Remove Pragma to save bandwidth and processing power."
}
]
},
"cache-control": {
"value": "no-cache, no-store, must-revalidate",
"findings": [
{
"severity": "info",
"message": "no-cache means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped."
},
{
"severity": "warning",
"message": "no-cache will cause a revalidation request to the origin server for every use of the cached response. Consider using public with appropriate max-age to improve caching efficiency."
},
{
"severity": "warning",
"message": "no-store means the response may not be stored in any cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using public with an appropriate max-age."
},
{
"severity": "info",
"message": "must-revalidate indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first."
},
{
"severity": "notice",
"message": "must-revalidate has no effect with no-store since nothing is cached. Remove must-revalidate."
},
{
"severity": "notice",
"message": "must-revalidate is redundant with no-cache since no-cache already requires revalidation. Remove must-revalidate."
},
{
"severity": "notice",
"message": "no-cache is redundant when no-store is set, though some sites keep both for compatibility with older caches."
}
]
},
"expires": {
"value": "thu, 01 jan 1970 00:00:00 +0000",
"findings": [
{
"severity": "info",
"message": "This Expires date is in the past: the page is considered stale and will be removed from all caches."
},
{
"severity": "notice",
"message": "The Cache-Control header, introduced in HTTP/1.1, supersedes the Expires header. Use a Cache-Control header with a max-age directive instead of Expires. Cache-Control is more powerful, but also more efficient in that it avoids roundtrips to the origin server."
}
]
},
"content-encoding": {
"value": "gzip",
"findings": [
{
"severity": "info",
"message": "Specifies how the resource is compressed. Not to be confused with Transfer-Encoding which specifies how the data is transferred."
},
{
"severity": "info",
"message": "gzip means that the data is compressed with gzip."
},
{
"severity": "warning",
"message": "Add a Content-Length header. The Content-Length header is required, unless the message is transported using chunked encoding. Without a Content-Length header some servers will respond with 400 (bad request) or terminate connections early."
}
]
}
},
"missing": {
"strict-transport-security": {
"message": "Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication."
},
"content-security-policy": {
"message": "Add a Content-Security-Policy header. The Content-Security-Policy header helps browsers prevent cross site scripting (XSS) and data injection attacks."
},
"referrer-policy": {
"message": "Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination."
},
"permissions-policy": {
"message": "Add a Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
},
"cross-origin-embedder-policy": {
"message": "Add a Cross-Origin-Embedder-Policy header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with Cross-Origin-Opener-Policy, it enables cross-origin isolation and access to SharedArrayBuffer."
},
"cross-origin-opener-policy": {
"message": "Add a Cross-Origin-Opener-Policy header. It prevents other sites from retaining a window reference to this page when opened via window.open() or navigation, blocking script-based attacks through shared browsing contexts."
},
"cross-origin-resource-policy": {
"message": "Add a Cross-Origin-Resource-Policy header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
},
"x-permitted-cross-domain-policies": {
"message": "Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
}
}
}