HTTP Headers Analyzer

5 / 10

https://gayhardcore.mobi

Website → Browser
8 missing headers, 1 warnings, 5 notices
JSON API

Header	Value	Explanation
server	angie	Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare). Notice Consider removing or minimizing the `Server` header. Even without a version number, it reveals the server software, which aids reconnaissance.
date	fri, 16 oct 2026 15:01:00 gmt	The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against `Max-Age` or `Expires`.
content-type	text/html; charset=utf-8	The type of the message body, specified as a MIME type.
content-security-policy	script-src 'nonce-g/polzy5yg/y98/dv4mzsw=='; style-src 'unsafe-inline'	The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load. `script-src` specifies valid sources for JavaScript. This includes not only URLs loaded directly into `<script>` elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution. `style-src` defines what CSS stylesheets are allowed to be loaded. Notice Consider adding the `upgrade-insecure-requests` directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues. Notice `unsafe-inline` in `style-src` allows inline styles. This is common and lower risk than inline scripts, but nonces or hashes provide stronger protection. Notice No `default-src` directive is set. Without it, directives that are not explicitly defined have no fallback restriction. Notice Consider adding `base-uri 'self'` or `base-uri 'none'` to prevent base tag injection, which can redirect relative URLs to an attacker-controlled domain.
content-encoding	gzip	Specifies how the resource is compressed. Not to be confused with `Transfer-Encoding` which specifies how the data is transferred. `gzip` means that the data is compressed with `gzip`. Warning Add a `Content-Length` header. The Content-Length header is required, unless the message is transported using chunked encoding. Without a `Content-Length` header some servers will respond with 400 (bad request) or terminate connections early.
strict-transport-security		missing Add a `Strict-Transport-Security` header. The `Strict-Transport-Security` header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.
referrer-policy		missing Add a `Referrer-Policy` header. When a visitor navigates from one page to another, browsers often pass along referrer information. The `Referrer-Policy` header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.
permissions-policy		missing Add a `Permissions-Policy` header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.
cross-origin-embedder-policy		missing Add a `Cross-Origin-Embedder-Policy` header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with `Cross-Origin-Opener-Policy`, it enables cross-origin isolation and access to `SharedArrayBuffer`.
cross-origin-opener-policy		missing Add a `Cross-Origin-Opener-Policy` header. It prevents other sites from retaining a `window` reference to this page when opened via `window.open()` or navigation, blocking script-based attacks through shared browsing contexts.
cross-origin-resource-policy		missing Add a `Cross-Origin-Resource-Policy` header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks.
x-content-type-options		missing Add an `X-Content-Type-Options: nosniff` header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities.
x-permitted-cross-domain-policies		missing Add a `X-Permitted-Cross-Domain-Policies` header to prevent Flash, Adobe Reader and other clients from sharing data across domains.