HTTP Headers Analyzer

4 / 10

https://telegra.ph/Kupit-poppers-amsterdam-11-08-4

Website → Nginx → Browser
8 missing headers, 2 warnings, 2 notices
JSON API

Header	Value	Explanation
server	nginx/1.30.1	Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare). Warning The server header exposes a specific version number (1.30.1). This makes it easier for attackers to find known vulnerabilities for that version. Remove or suppress the version number.
date	sun, 18 oct 2026 05:09:51 gmt	The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against `Max-Age` or `Expires`.
content-type	text/html; charset=utf-8	The type of the message body, specified as a MIME type.
content-length	7215	The size of the message body, in bytes.
x-frame-options	sameorigin	`X-Frame-Options` prevents this URL from being embedded in an `iframe`. This protects against clickjacking attacks. `sameorigin` allows this page to be displayed in an `iframe` on the same origin. This is the recommended setting.
pragma	no-cache	Notice `Pragma: no-cache` forces revalidation with the origin server on every request. `Pragma` is a legacy HTTP/1.0 directive, superseded by `Cache-Control`. Remove `Pragma` to save bandwidth and processing power.
cache-control	no-store	Warning `no-store` means the response may not be stored in any cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using `public` with an appropriate `max-age`. Notice Using `Pragma: no-cache` without `Cache-Control: no-cache` is not recommended. `Pragma` is a legacy HTTP/1.0 directive. Use `Cache-Control` instead.
content-encoding	gzip	Specifies how the resource is compressed. Not to be confused with `Transfer-Encoding` which specifies how the data is transferred. `gzip` means that the data is compressed with `gzip`.
strict-transport-security	max-age=31536000; includesubdomains; preload	The `Strict-Transport-Security` header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking. `max-age` specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain. `includesubdomains` instructs the browser that all subdomains are HTTPS-only as well. `preload` recommends the domain for inclusion in browsers' preload lists. If accepted, the domain would get hardcoded into browsers as HTTPS-only.
content-security-policy		missing Add a `Content-Security-Policy` header. The `Content-Security-Policy` header helps browsers prevent cross site scripting (XSS) and data injection attacks.
referrer-policy		missing Add a `Referrer-Policy` header. When a visitor navigates from one page to another, browsers often pass along referrer information. The `Referrer-Policy` header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.
permissions-policy		missing Add a `Permissions-Policy` header. Restrict access to device features like the camera, microphone, location, accelerometer and much more.
cross-origin-embedder-policy		missing Add a `Cross-Origin-Embedder-Policy` header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with `Cross-Origin-Opener-Policy`, it enables cross-origin isolation and access to `SharedArrayBuffer`.
cross-origin-opener-policy		missing Add a `Cross-Origin-Opener-Policy` header. It prevents other sites from retaining a `window` reference to this page when opened via `window.open()` or navigation, blocking script-based attacks through shared browsing contexts.
cross-origin-resource-policy		missing Add a `Cross-Origin-Resource-Policy` header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks.
x-content-type-options		missing Add an `X-Content-Type-Options: nosniff` header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities.
x-permitted-cross-domain-policies		missing Add a `X-Permitted-Cross-Domain-Policies` header to prevent Flash, Adobe Reader and other clients from sharing data across domains.