HTTP Headers Analyzer

7 / 10
https://creators.spotify.com/pod/profile/ayaan-baloch01
Website → Browser
9 missing headers, 0 warnings, 1 notices
JSON API
Header Value Explanation
x-timer s1786923407.679068,vs0,ve224 Provides timing information about the journey of a request through Fastly's network. Format: s<timestamp>,vs<seconds>,ve<seconds>, where s is the start time of the request, vs stands for Varnish start and ve stands for Varnish end. The length of the trip is ve - vs milliseconds.
content-type text/html; charset=utf-8 The type of the message body, specified as a MIME type.
content-encoding gzip Specifies how the resource is compressed. Not to be confused with Transfer-Encoding which specifies how the data is transferred.
gzip means that the data is compressed with gzip.
content-language en Specifies the page's intended audience. For example, en-US means that the document is intended for English language speakers in the United States. The language tags are defined in RFC 5646.
accept-ranges bytes Used by the server to advertise its support of partial HTTP requests. The browser can ask for a range or subset of the response body. It's a feature that allows a browser to resume an interrupted download. bytes is the only range unit currently supported. none means that the server does not support range requests.
age 0 The time in seconds that the page has been in the shared proxy cache. The maximum age is set by max-age or s-maxage in the Cache-Control header.
date sun, 16 aug 2026 23:36:46 gmt The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.
x-served-by cache-iad-kcgs7200034-iad, cache-iad-kcgs7200034-iad, cache-iad-khef600020-iad Fastly's shield and edge servers that were queried for the request.
x-cache miss, miss The page was not served from Fastly's cache. This site is a customer of Fastly's origin shielding feature for improved reliability.
x-cache-hits 0, 0 The number of times this page has been served from the Varnish cache. Higher numbers are better.
vary accept-language, accept-encoding The Vary header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.
strict-transport-security max-age=86400 The Strict-Transport-Security header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking.
max-age specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain.
Notice For optimal security, consider increasing max-age to at least 31,536,000 seconds (1 year), especially if you're considering preloading.
content-length 15023 The size of the message body, in bytes.
content-security-policy missing Add a Content-Security-Policy header. The Content-Security-Policy header helps browsers prevent cross site scripting (XSS) and data injection attacks.
referrer-policy missing Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.
permissions-policy missing Add a Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.
cross-origin-embedder-policy missing Add a Cross-Origin-Embedder-Policy header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with Cross-Origin-Opener-Policy, it enables cross-origin isolation and access to SharedArrayBuffer.
cross-origin-opener-policy missing Add a Cross-Origin-Opener-Policy header. It prevents other sites from retaining a window reference to this page when opened via window.open() or navigation, blocking script-based attacks through shared browsing contexts.
cross-origin-resource-policy missing Add a Cross-Origin-Resource-Policy header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks.
x-frame-options missing Add a X-Frame-Options header. The X-Frame-Options header prevents this URL from being embedded in an iframe. This protects against clickjacking attacks. Alternatively, set a Content-Security-Policy header with a frame-ancestors directive.
x-content-type-options missing Add an X-Content-Type-Options: nosniff header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities.
x-permitted-cross-domain-policies missing Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains.