HTTP Headers Analyzer

6 / 10

https://pn3172.blogspot.com

Website → Browser
7 missing headers, 1 warnings, 5 notices
JSON API

Header	Value	Explanation
content-type	text/html; charset=utf-8	The type of the message body, specified as a MIME type.
content-encoding	gzip	Specifies how the resource is compressed. Not to be confused with `Transfer-Encoding` which specifies how the data is transferred. `gzip` means that the data is compressed with `gzip`.
date	fri, 16 oct 2026 18:48:53 gmt	The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against `Max-Age` or `Expires`.
expires	fri, 16 oct 2026 18:48:53 gmt	The date and time after which the page should be considered stale and all caches should be refreshed. Notice Because there is a `Cache-Control` header with a `max-age` and/or `s-maxage` directive, the `Expires` header will be ignored. Consider removing `Expires` to save bandwidth and processing power.
cache-control	private, max-age=0	`private` means the response can only be stored by the browser's cache, but not by CDNs, proxies, or any other shared caches. `max-age` specifies the maximum amount of seconds a page is considered valid. The higher `max-age`, the longer a page can be cached. Warning Because `max-age` is set to 0 seconds and no `s-maxage` is set, caching is effectively disabled. Every request will hit the origin server. Consider setting a positive `max-age` or adding `s-maxage` for shared caches.
x-content-type-options	nosniff	The `X-Content-Type-Options` header prevents browsers from guessing a response's content type. Without it, browsers may interpret files differently than intended, which can lead to security vulnerabilities. The value `nosniff` is correctly set.
x-frame-options	sameorigin	`X-Frame-Options` prevents this URL from being embedded in an `iframe`. This protects against clickjacking attacks. `sameorigin` allows this page to be displayed in an `iframe` on the same origin. This is the recommended setting.
content-security-policy	frame-ancestors 'self'	The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load. `frame-ancestors` defines what parents may embed a page using `<frame>`, `<iframe>`, `<object>`, `<embed>` or `<applet>`. Notice Consider adding the `upgrade-insecure-requests` directive to automatically upgrade HTTP requests to HTTPS, helping to prevent mixed content issues. Notice No `default-src` directive is set. Without it, directives that are not explicitly defined have no fallback restriction. Notice Consider adding `base-uri 'self'` or `base-uri 'none'` to prevent base tag injection, which can redirect relative URLs to an attacker-controlled domain.
x-xss-protection	1; mode=block	A legacy header that enables the browser's built-in cross-site scripting (XSS) filter. Modern browsers ignore it in favor of `Content-Security-Policy`. `1` enables XSS filtering. `mode=block` blocks the response entirely if an attack is detected, instead of sanitizing the page.
content-length	42971	The size of the message body, in bytes.
server	gse	Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare). Notice Consider removing or minimizing the `Server` header. Even without a version number, it reveals the server software, which aids reconnaissance.
alt-svc	h3=":443"; ma=2592000,h3-29=":443"; ma=2592000	The `alt-svc` header tells the browser that the same content is available over a different protocol. This allows the browser to upgrade to a faster protocol (e.g. HTTP/3 over QUIC) on subsequent requests without a separate negotiation step. `h3` indicates that HTTP/3 is supported. HTTP/3 uses the QUIC protocol (UDP-based) instead of TCP, which eliminates the TCP handshake delay and performs better on lossy networks. Variants like `h3-29` refer to specific drafts of the HTTP/3 protocol. `ma=2592000` specifies that the alternative service information is fresh for 2592000 seconds. `ma=2592000` specifies that the alternative service information is fresh for 2592000 seconds.
strict-transport-security		missing Add a `Strict-Transport-Security` header. The `Strict-Transport-Security` header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.
referrer-policy		missing Add a `Referrer-Policy` header. When a visitor navigates from one page to another, browsers often pass along referrer information. The `Referrer-Policy` header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.
permissions-policy		missing Add a `Permissions-Policy` header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.
cross-origin-embedder-policy		missing Add a `Cross-Origin-Embedder-Policy` header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with `Cross-Origin-Opener-Policy`, it enables cross-origin isolation and access to `SharedArrayBuffer`.
cross-origin-opener-policy		missing Add a `Cross-Origin-Opener-Policy` header. It prevents other sites from retaining a `window` reference to this page when opened via `window.open()` or navigation, blocking script-based attacks through shared browsing contexts.
cross-origin-resource-policy		missing Add a `Cross-Origin-Resource-Policy` header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks.
x-permitted-cross-domain-policies		missing Add a `X-Permitted-Cross-Domain-Policies` header to prevent Flash, Adobe Reader and other clients from sharing data across domains.