It's important to configure HTTP headers correctly for any website. Many articles have been written on the topic of headers. Here, we have summarized the accumulated experience and RFC documentation. Some headers are mandatory, some are outdated, and some may introduce confusion and contradictions. We created a tool for . Unlike many other services that simply display headers, this service allows you to:
- set values for standard headers;
- add your custom headers;
- specify the version of the HTTP protocol: 1.0, 1.1, 2 (checks if HTTP/2 is supported);
- specify the request method, timeout, and postdata to be sent to the server;
- the tool also checks the correctness of responses to If-Modified-Since and If-None-Match requests if the server's response includes Last-Modified or ETag headers.
We do not claim to have the final word on this matter. For specific content and individual projects, there may be deviations. However, this service will definitely point out what to pay attention to; you may find it useful to edit your headers. Below is a list of what the header checking service focuses on. To find out why, read .
Mandatory Headers
- Date
- Content-Type with charset specification for text content, preferably utf-8
- Content-Encoding for text content compression
Outdated and unnecessary headers
- Server with detailed version of the web server
- X-Power-By
- X_ASPNET-Version
- Expires
- Pragma
- P3P
- Via
- X-UA-Compatible
Desirable headers for security
- X-Content-Type-Options
- X-XSS-Protection
- Strict-Transport-Security
- Referrer-Policy
- Feature-Policy
- Content-Security-Policy or Content-Security-Policy-Report-Only to prohibit inline scripts and styles.
Cache-Control Headers
Mandatory for static content with long cache durations and highly desirable for dynamic content with shorter cache durations.
- Last-Modified
- ETag
- Cache-Control
- Vary
- It's important for the server to respond correctly to If-Modified-Since and If-None-Match headers.
HTTP/2
The server must support HTTP/2. By default, the service checks the server's operation with HTTP/2. If your server does not support HTTP/2, choose HTTP/1.1.
Source: habr.com
