Serverens HTTP-headerkontroltjeneste

For any website, it's crucial to configure HTTP headers correctly. Many articles have been written on the topic of headers. Here, we have summarized accumulated experience and RFC documentation. Some headers are mandatory, some are outdated, and some can lead to confusion and contradictions. We have created a tool for automatic checking of the web server's HTTP headers. Unlike many other services that simply display headers, this service allows you to:

1. set values for standard headers;
2. add your custom headers;
3. specify the version of the HTTP protocol: 1.0, 1.1, 2 (checks if HTTP/2 is supported);
4. specify the request method, timeout, and post data to send to the server;
5. the tool also checks the correctness of responses to If-Modified-Since, If-None-Match requests if the server's response contains Last-Modified or ETag.

We do not claim to be the absolute authority. For specific content and individual projects, there may be deviations. But this service will definitely guide you on what to pay attention to; it may be useful for you to edit your headers. Below is the list of what the verification service focuses on. To understand why, read the articles on Habr.

Mandatory headers

• Dato
• Content-Type indicating charset for text content preferably utf-8
• Content-Encoding compression for text content

Outdated and unnecessary headers

• Server with detailed version of the web server
• X-Power-By
• X_ASPNET-Version
• Expires
• Pragma
• P3P
• Via
• X-UA-Compatible

Desirable headers for security

• X-Content-Type-Options
• X-XSS-Protection
• Strict-Transport-Security
• Referrer-Policy
• Feature-Policy
• Content-Security-Policy or Content-Security-Policy-Report-Only to prohibit embedded scripts and styles.

Headers for caching

Are mandatory for static content with a long caching time and highly desirable for dynamic content with a short caching time.

• Last-Modified
• ETag
• Cache-Control
• Vary
• It's important for the server to respond correctly to the headers: If-Modified-Since and If-None-Match

HTTP/2

The server must now support HTTP/2. By default, the service checks server operation using HTTP/2. If your server does not support HTTP/2, choose HTTP/1.1.

Kilde: habr.com