Tjeneste for sjekk av HTTP-serveroverskrifter

For any website, it's crucial to configure HTTP headers correctly. A lot has been written on the topic of headers. Here, we have summarized the accumulated experience and RFC documentation. Some headers are mandatory, some are outdated, and some may cause confusion and contradictions. We've created a tool for automatically checking web server HTTP headers. Unlike many other services that simply display headers, this service allows you to:

1. set values for standard headers;
2. add custom headers;
3. specify the version of the HTTP protocol: 1.0, 1.1, 2 (checks if HTTP/2 is supported);
4. specify the request method, timeout, and postdata to send to the server;
5. the tool also checks the correctness of responses to If-Modified-Since, If-None-Match requests if the server's response contains Last-Modified or ETag.

We do not claim to have the ultimate truth. For individual content and specific projects, there could be deviations. However, this service will certainly point out what you should pay attention to; you might find it useful to adjust your headers. Below is a list of what the header checking service focuses on. To understand why, read the articles on Habr.

Mandatory Headers

• Dato
• Content-Type with charset specified for text content preferably utf-8
• Content-Encoding for compression of text content

Outdated and unnecessary headers

• Server with detailed version of the web server
• X-Power-By
• X_ASPNET-Version
• Expires
• Pragma
• P3P
• Via
• X-UA-Compatible

Desirable headers for security

• X-Content-Type-Options
• X-XSS-Protection
• Strict-Transport-Security
• Referrer-Policy
• Feature-Policy
• Content-Security-Policy or Content-Security-Policy-Report-Only to prohibit inline scripts and styles.

Headers for caching

are mandatory for static content with a long caching period and highly desirable for dynamic content with a short caching period.

• Last-Modified
• ETag
• Cache-Control
• Vary
• It is important for the server to respond correctly to the headers: If-Modified-Since and If-None-Match

HTTP/2

The server must now support HTTP/2. By default, the service checks the server's operation via HTTP/2. If your server does not support HTTP/2, choose HTTP/1.1.

Kilde: habr.com