Lessons

Configuring HTTP Headers

There are hundreds of different kinds of HTTP headers. We check the ones that are useful for each site:

  • Specifying the encoding for HTML documents via Content-Type. Without this, browsers may display the page incorrectly.
  • Refrain from the Link header to specify language versions. It is better to use the rel=alternate meta tags. They are easier to check. The exceptions are text files of PDF, DJVU and other formats, the contents of which are indexed by search engines. They don’t have the ability to use an HTML tag to specify different language versions, and the Link header is the only tool.
  • The absence of outdated headers Public-Key-Pins, Expect-CT, X-XSS-Protection.
  • Using X-Frame-Options, Content-Security-Policy only for HTML pages.
  • Using X-Content-Type-Options only for HTML, XML, CSS, JavaScrit files.
  • Specifying the Secure flag for cookies.
Example of headers returned by the server when loading a CSS file. Each line performs a specific task.
Example of headers returned by the server when loading a CSS file. Each line performs a specific task.

Remark: It is not possible to delete the Server header from the Apache web server, you can only make it empty. To do this, add/change the following directives in the /etc/apache2/conf-available/security.conf file: “ ServerTokens Prod ServerSignature Off SecServerSignature ” ” “`

PRO subscription for working with the service

Promo
Checking 50 pages in the tool "Checking the page"
190 ₽
The subscription is activated for 10 days and is linked to a specific site.
PRO subscription
3,500 pages per week in tools "Checking the page" and "Full site scan".
1 580 ₽
The subscription is activated for 30 days and you can scan any site.
Wallet
Additional pages that are credited to a separate balance. For checking large sites.
200 ₽
Number of pages
An active PRO subscription is required.
We use cookies. By continuing to use the site, you agree to the processing of personal data in accordance with privacy policy. I agree