HTTP Headers

There are hundreds of different kinds of headlines. In this check we check the following:

Specify the encoding for HTML documents. Without this, browsers may display the page incorrectly.
Refrain from the Link header. It is better to use analog meta tags. They are easier to manage. The exceptions are text files of PDF, DJVU, etc. formats, the contents of which are indexed by search engines. They do not have the ability to use an HTML tag to specify different language versions.
Remove the outdated headers Public-Key-Pins, Expect-CT, `X-XSS-Protection’.
Use the ‘X-Frame-Options’ and Content-Security-Policy headers only for HTML pages.
Use the ‘X-Content-Type-Options` header only for HTML, XML, CSS, JavaScrit links.
For cookies, pass the Secure flag.

Remark: it is not possible to delete the Server header from the Apache web server, only to make it empty. To do this, add/change the following directives in the /etc/apache2/conf-available/security.conf file: “ ServerTokens Prod ServerSignature Off SecServerSignature ” ” “`

◀ IPv6 connection Erroneous extension of images ▶

Any comments or additions? Send us an email admin@site-alarm.com .

Check your website