HTTP Headers Analyzer

6 / 10

https://maham001.s3.ap-south-1.amazonaws.com/index.html

Website → Browser
11 missing headers, 0 warnings, 1 notices
JSON API

Header	Value	Explanation
x-amz-request-id	sxz4q1v5s55hm4yw
x-amz-id-2	ct1phifzolcdymux6bzok7tl4d3ahf6ltrkncb52hn4xx/joqlsrwwrkgpilmjkq5rb/ldim2si=
date	mon, 19 oct 2026 05:04:20 gmt	The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against `Max-Age` or `Expires`.
content-type	application/xml	The type of the message body, specified as a MIME type.
server	amazons3	Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare). Notice Consider removing or minimizing the `Server` header. Even without a version number, it reveals the server software, which aids reconnaissance.
transfer-encoding	chunked	Specifies how the resource is transferred. Not to be confused with `Content-Encoding` which specifies how the request body is compressed. Transfer encoding operates at a lower level than content encoding. `chunked` means that the data is sent in chunks. Chunks are sent out and received independently of one another. The server can stream the document and does not have to wait for the full document to be generated. Similarly, the browser can start processing chunks as they come in rather than having to wait for the entire document to be downloaded.
strict-transport-security		missing Add a `Strict-Transport-Security` header. The `Strict-Transport-Security` header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.
content-security-policy		missing Add a `Content-Security-Policy` header. The `Content-Security-Policy` header helps browsers prevent cross site scripting (XSS) and data injection attacks.
referrer-policy		missing Add a `Referrer-Policy` header. When a visitor navigates from one page to another, browsers often pass along referrer information. The `Referrer-Policy` header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.
permissions-policy		missing Add a `Permissions-Policy` header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.
cross-origin-embedder-policy		missing Add a `Cross-Origin-Embedder-Policy` header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with `Cross-Origin-Opener-Policy`, it enables cross-origin isolation and access to `SharedArrayBuffer`.
cross-origin-opener-policy		missing Add a `Cross-Origin-Opener-Policy` header. It prevents other sites from retaining a `window` reference to this page when opened via `window.open()` or navigation, blocking script-based attacks through shared browsing contexts.
cross-origin-resource-policy		missing Add a `Cross-Origin-Resource-Policy` header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks.
x-frame-options		missing Add a `X-Frame-Options` header. The `X-Frame-Options` header prevents this URL from being embedded in an `iframe`. This protects against clickjacking attacks. Alternatively, set a `Content-Security-Policy` header with a `frame-ancestors` directive.
x-content-type-options		missing Add an `X-Content-Type-Options: nosniff` header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities.
x-permitted-cross-domain-policies		missing Add a `X-Permitted-Cross-Domain-Policies` header to prevent Flash, Adobe Reader and other clients from sharing data across domains.
content-encoding		missing No `Content-Encoding` header found. Enable compression such as `gzip` or `br` (Brotli) to reduce transfer sizes. Brotli typically achieves 15–20% better compression than gzip and is supported by all modern browsers.