HTTP Headers Analyzer

2 / 10

https://mb66.parts

Website → Cloudflare → Browser
5 missing headers, 4 warnings, 9 notices
JSON API

The site is using a CDN, but the HTML page is not cached.

Header	Value	Explanation
date	wed, 15 jul 2026 22:41:25 gmt	The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against `Max-Age` or `Expires`.
content-type	text/html; charset=utf-8	The type of the message body, specified as a MIME type.
server	cloudflare	Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare). Notice Consider removing or minimizing the `Server` header. Even without a version number, it reveals the server software, which aids reconnaissance.
nel	{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}	The `NEL` (Network Error Logging) header tells browsers to report network-level failures (DNS errors, TCP timeouts, TLS problems) back to the server. This means you can detect when real users fail to reach your site, even though the failure happens before your server sees a request. `report_to` defines the reporting group that reports for this NEL policy will be sent to. The reporting group details are specified in the `Report-To` header. `max_age` defines the number of seconds the browser should remember these settings. Prevents the browser from having to parse the JSON on each request. `success_fraction` defines the sampling rate that should be applied to reports about successful network requests. Its value must be a number between 0.0 and 1.0: 0 means no successful requests should be reported, and 1 means that every successful request should be reported.
vary	accept-encoding	The `Vary` header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type.
set-cookie	phpsessid=eep2h8gflf18etgcptkvdf9fej; path=/; httponly	A cookie that was sent from the server to the browser. `path=` indicates the path that must exist in the requested URL for the browser to send the cookie. `httponly` forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie. Warning This cookie is missing the `secure` flag. Without it, the cookie can be sent over unencrypted HTTP connections, making it vulnerable to interception. Notice This cookie does not set an explicit `samesite` attribute. Browsers default to `lax`, but setting it explicitly is recommended for clarity and cross-browser consistency.
set-cookie	_csrf=f919bf01ef0bb5c4fcd42ee2d24a1789fda6e1b2bfb0c4bbdbd96b962b4fc6fca%3a2%3a%7bi%3a0%3bs%3a5%3a%22_csrf%22%3bi%3a1%3bs%3a32%3a%229lsodfevpmuoav_uhlysqb2kxjxoycdt%22%3b%7d; path=/; httponly; samesite=lax	A cookie that was sent from the server to the browser. `path=` indicates the path that must exist in the requested URL for the browser to send the cookie. Notice `samesite=lax` instructs the browser not to share the cookie with third-party sites (e.g. when loading images, videos or frames from other sites), with one exception. The cookie will be sent when a user is navigating to the origin site from an external site (for example, when following a link). To improve protection against cross-site request forgery attacks, set to `samesite=strict`. `httponly` forbids JavaScript from accessing the cookie. Helps mitigate the risk of client side scripts accessing a protected cookie. Warning This cookie is missing the `secure` flag. Without it, the cookie can be sent over unencrypted HTTP connections, making it vulnerable to interception.
expires	thu, 19 nov 1981 08:52:00 gmt	This `Expires` date is in the past: the page is considered stale and will be removed from all caches. Notice The `Cache-Control` header, introduced in HTTP/1.1, supersedes the `Expires` header. Use a `Cache-Control` header with a `max-age` directive instead of `Expires`. `Cache-Control` is more powerful, but also more efficient in that it avoids roundtrips to the origin server. PS: November 19th is my birthday! 🎂
cache-control	no-store, no-cache, must-revalidate	`no-cache` means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped. Warning `no-cache` will cause a revalidation request to the origin server for every use of the cached response. Consider using `public` with appropriate `max-age` to improve caching efficiency. Warning `no-store` means the response may not be stored in any cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using `public` with an appropriate `max-age`. `must-revalidate` indicates that once a page becomes stale, both shared caches and browser caches must not use their stale copy without validating it with the origin server first. Notice `must-revalidate` has no effect with `no-store` since nothing is cached. Remove `must-revalidate`. Notice `must-revalidate` is redundant with `no-cache` since `no-cache` already requires revalidation. Remove `must-revalidate`. Notice `no-cache` is redundant when `no-store` is set, though some sites keep both for compatibility with older caches.
pragma	no-cache	Notice `Pragma: no-cache` forces revalidation with the origin server on every request. `Pragma` is a legacy HTTP/1.0 directive, superseded by `Cache-Control`. Remove `Pragma` to save bandwidth and processing power.
strict-transport-security	max-age=31536000; includesubdomains; preload	The `Strict-Transport-Security` header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking. `max-age` specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain. `includesubdomains` instructs the browser that all subdomains are HTTPS-only as well. `preload` recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only.
x-frame-options	deny	`X-Frame-Options` prevents this URL from being embedded in an `iframe`. This protects against clickjacking attacks. `deny` means that this page can never be displayed in an `iframe`. It's the most secure option.
x-content-type-options	nosniff	The `X-Content-Type-Options` header prevents browsers from guessing a response's content type. Without it, browsers may interpret files differently than intended, which can lead to security vulnerabilities. The value `nosniff` is correctly set.
x-xss-protection	1; mode=block	A legacy header that enables the browser's built-in cross-site scripting (XSS) filter. Modern browsers ignore it in favor of `Content-Security-Policy`. `1` enables XSS filtering. `mode=block` blocks the response entirely if an attack is detected, instead of sanitizing the page. Notice Add a `Content-Security-Policy` header for more comprehensive protection.
referrer-policy	strict-origin	When a visitor navigates from one page to another page, browsers often pass along referrer information. The `Referrer-Policy` header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string. `strict-origin` means that the protocol, host, and port are shared, but only when the protocol security level remains the same (HTTPS → HTTPS). The path and query string are not shared. When the protocol becomes less secure (HTTPS → HTTP), nothing is shared.
permissions-policy	geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()	Controls which browser features and APIs (camera, microphone, geolocation, payment, USB, etc.) this page and its embedded iframes are allowed to use. Each feature is set to an allowlist of origins; an empty list `()` disables the feature entirely. This is a defense-in-depth measure: even if an attacker injects script via XSS, they cannot access the restricted APIs.
report-to	{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2bqwaqocwxxbi03plzr3mmborcvnetynkrqnsyaztgzrtegqqglhwcxtggluzp4qiojnlyan%2fcxnysgsif04kc5haj0lwplo6tpy4kajyefnwqr6%2fcvpsgvmxpouqolcn5izdfg%3d%3d"}]}	The `Report-To` header defines where browsers should send error reports. It sets up named reporting endpoints that other headers (like `NEL` and `Content-Security-Policy`) reference when they need to send violation or failure data. `group` defines the reporting group. Groups allow reports to be grouped logically; e.g. there could be a group for network errors and a second group for browser feature deprecation reports. `max_age` defines the number of seconds the browser should remember these settings. Prevents the browser from having to parse the JSON on each request. `endpoints` defines one or more URLs where the reports need to be sent to. Multiple URLs can be specified for failover and load-balancing. Endpoints can be assigned a `weight` to distribute load, with each endpoint receiving a specified fraction of the reporting traffic. Endpoints can also be assigned a `priority` to set up fallback collectors.
cf-cache-status	dynamic	Notice The `dynamic` status indicates that Cloudflare did not cache this resource. This is normal and expected for HTML pages — by default, Cloudflare only caches static assets like images, CSS, and JavaScript. To cache HTML content as well, change the 'Cache Level' setting from `dynamic` to `cache everything` in Cloudflare.
speculation-rules	"/cdn-cgi/speculation"	Points to a JSON resource that defines rules for speculative loading, telling the browser to prefetch or prerender pages the user is likely to visit next. This can make navigations feel instant.
content-encoding	br	Specifies how the resource is compressed. Not to be confused with `Transfer-Encoding` which specifies how the data is transferred. `br` means that the data is compressed with `brotli`. Warning Add a `Content-Length` header. The Content-Length header is required, unless the message is transported using chunked encoding. Without a `Content-Length` header some servers will respond with 400 (bad request) or terminate connections early.
cf-ray	a1bc46443c5ad634-iad	The `cf-ray` header provides a unique identifier for each request through Cloudflare. It's useful for troubleshooting and tracking requests in Cloudflare logs.
alt-svc	h3=":443"; ma=86400	The `alt-svc` header tells the browser that the same content is available over a different protocol. This allows the browser to upgrade to a faster protocol (e.g. HTTP/3 over QUIC) on subsequent requests without a separate negotiation step. `h3` indicates that HTTP/3 is supported. HTTP/3 uses the QUIC protocol (UDP-based) instead of TCP, which eliminates the TCP handshake delay and performs better on lossy networks. Variants like `h3-29` refer to specific drafts of the HTTP/3 protocol. `ma=86400` specifies that the alternative service information is fresh for 86400 seconds.
content-security-policy		missing Add a `Content-Security-Policy` header. The `Content-Security-Policy` header helps browsers prevent cross site scripting (XSS) and data injection attacks.
cross-origin-embedder-policy		missing Add a `Cross-Origin-Embedder-Policy` header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with `Cross-Origin-Opener-Policy`, it enables cross-origin isolation and access to `SharedArrayBuffer`.
cross-origin-opener-policy		missing Add a `Cross-Origin-Opener-Policy` header. It prevents other sites from retaining a `window` reference to this page when opened via `window.open()` or navigation, blocking script-based attacks through shared browsing contexts.
cross-origin-resource-policy		missing Add a `Cross-Origin-Resource-Policy` header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks.
x-permitted-cross-domain-policies		missing Add a `X-Permitted-Cross-Domain-Policies` header to prevent Flash, Adobe Reader and other clients from sharing data across domains.