HTTP Headers

Show the HTTP headers for a URL, with a full break-down of details. Will follow redirects.

Summary

Response
200
Total Requests
1
Total Time
115 ms
  • IP
    104.18.7.29
    View Map

  • Timing

    Wait

    1 ms

    DNS

    18 ms

    TCP

    5 ms

    Request

    0 ms

    First Byte

    82 ms

    Download

    1 ms

    Total

    115 ms

  • HTTP Headers

    Date

    Sun, 09 Aug 2026 13:13:49 GMT

    The date and time that the message was sent.

    Content-Type

    text/html; charset=utf-8

    The MIME type of this content.

    Problems were detected with this header

    • Unknown MIME type.
    Connection

    keep-alive

    Control options for the current connection and list of hop-by-hop response fields.

    keep-alive - The client would like to keep the connection open.

    Server

    cloudflare

    A name for the server.

    cloudflare - Description of the server software.

    Vary

    Accept-Encoding

    Indicates that different content may be provided to different clients, depending on the vary header.

    • Headers

      • Accept-Encoding
    Vary

    Cookie, Accept-Language

    Indicates that different content may be provided to different clients, depending on the vary header.

    • Headers

      • Cookie
      • Accept-Language

    Problems were detected with this header

    • Duplicate header. There is another header with this name and this may cause problems.
    Content-Security-Policy

    font-src 'self' data: https://ka-p.fontawesome.com https://app-assets.readthedocs.org/; base-uri 'self'; frame-ancestors 'none'; connect-src 'self' https://*.ingest.us.sentry.io https://ka-p.fontawesome.com https://kit.fontawesome.com https://plausible.io/api/event ws://app.readthedocs.org:10001/ws; style-src 'self' 'unsafe-inline' https://app-assets.readthedocs.org/; form-action 'self' https://github.com https://gitlab.com https://bitbucket.org https://id.atlassian.com https://accounts.google.com https://billing.stripe.com https://checkout.stripe.com https://webhook.frontapp.com/forms/036c4169294f3b04abaa/dXtihffn7rLqYHi1tASB_7ppEgrNQcUXDNE-2JAXNZac3pdQ85Vjn3agjSnZSnCVomF1u6PT98oAyid-I_OMwE2JtwXXiVoXlaTj0VAn_7NPjQCEQcvjrB6QZZ8; frame-src https://js.stripe.com/; img-src 'self' data: https:; script-src 'self' 'unsafe-eval' https://kit.fontawesome.com https://js.stripe.com/ https://app-assets.readthedocs.org/; default-src 'none'; report-uri https://o40776.ingest.us.sentry.io/api/148442/security/?sentry_key=48196e632bb14305ad3fe47c6570e363

    The content security policy allows the server to determine what resources the user is allowed to load.

    • Font-Src

      Define sources for fonts.

      • 'self'
      • data:
      • https://ka-p.fontawesome.com
      • https://app-assets.readthedocs.org/

    • Base-URI

      Define what can be used in the base element.

      • 'self'

    • Frame-Ancestors

      Define valid parents for frame, iframe, embed, object, and applet.

      • 'none'

    • Connect-Src

      Define sources for script interfaces.

      • 'self'
      • https://*.ingest.us.sentry.io
      • https://ka-p.fontawesome.com
      • https://kit.fontawesome.com
      • https://plausible.io/api/event
      • ws://app.readthedocs.org:10001/ws

    • Style-Src

      Define sources for stylesheets.

      • 'self'
      • 'unsafe-inline'
      • https://app-assets.readthedocs.org/

    • Form-Action

      Define what can be used as the target for forms.

      • 'self'
      • https://github.com
      • https://gitlab.com
      • https://bitbucket.org
      • https://id.atlassian.com
      • https://accounts.google.com
      • https://billing.stripe.com
      • https://checkout.stripe.com
      • https://webhook.frontapp.com/forms/036c4169294f3b04abaa/dXtihffn7rLqYHi1tASB_7ppEgrNQcUXDNE-2JAXNZac3pdQ85Vjn3agjSnZSnCVomF1u6PT98oAyid-I_OMwE2JtwXXiVoXlaTj0VAn_7NPjQCEQcvjrB6QZZ8

    • Frame-Src

      Define sources for frames.

      • https://js.stripe.com/

    • Img-Src

      Define sources for images and favicons.

      • 'self'
      • data:
      • https:

    • Script-Src

      Define sources for JavaScript.

      • 'self'
      • 'unsafe-eval'
      • https://kit.fontawesome.com
      • https://js.stripe.com/
      • https://app-assets.readthedocs.org/

    • Default-Src

      Fallback for all fetches.

      • 'none'
    X-Frame-Options

    DENY

    Clickjacking protection.

    DENY - No rendering within frame.

    X-Content-Type-Options

    nosniff

    Prevents Internet Explorer from MIME-sniffing a response away from the declared content-type.

    nosniff - Block requests if type 'style' or 'script'.

    Referrer-Policy

    strict-origin-when-cross-origin

    Controls what referrer information is sent with requests.

    strict-origin-when-cross-origin - Send the full referrer for a same origin request. Send the origin only for cross-domain requests where the protocol level is the same. Otherwise do not send the referrer.

    Cross-Origin-Opener-Policy

    same-origin

    Isolate the document from cross-origin windows.

    same-origin - Isolated the browsing context to same-origin.

    Content-Language

    en

    The natural language or languages of the intended audience for the enclosed content.

    en - English

    Strict-Transport-Security

    max-age=31536000;

    A HSTS Policy informing the HTTP client how long to cache the HTTPS only policy and whether this applies to subdomains.

    • Max-Age

      31536000 (1 year)

      The time a browser should remember a site can only be accessed with https (seconds).

    X-Backend

    web-i-0f4cad48d3de62204

    Cf-Cache-Status

    DYNAMIC

    Encoded information about your request from Cloudflare.

    DYNAMIC - This is not cached by default.

    Set-Cookie

    csrftoken=ZanvfiH3DxUALh3uhgxtcP4odyWgdE74; expires=Tue, 08 Sep 2026 13:13:49 GMT; HttpOnly; Max-Age=2592000; Path=/; SameSite=Lax; Secure

    A cookie sent from the server to be set on the client

    • csrftoken

      ZanvfiH3DxUALh3uhgxtcP4odyWgdE74

      Cookie name and value.

    • Expires

      Tue, 08 Sep 2026 13:13:49 GMT

      When the cookie should expire.

    • HttpOnly

      Prevents access to the cookie through JavaScript.

    • Max-Age

      2592000 (30 days)

      Number of seconds until the cookie expires.

    • Path

      /

      The client will only send the cookie when requesting this path, or subdirectories, from the server.

    • Samesite

      Lax

      Cookie is not sent on cross-site requests but is when following a link to the origin.

    • Secure

      The cookie is only sent when requesting from a https domain.

    Set-Cookie

    __cf_bm=Vk6mVzBRd2Z95QYarOA7uK0Lqphoh0WZBMpYvQmexR4-1786281229.5632584-1.0.1.1-mjSQDotqPBJo92FUL1bLHYSe8kpufWvHBoU4.OfIO5DjxCaiEa3QkifVrjXoeQAilkzOIrSs7fudJxFqkwRPHqQgzQQ7QbKJEKrLh0jGbfO1ORvW2lETPtI0VXICRZP0; HttpOnly; SameSite=None; Secure; Path=/; Domain=readthedocs.org; Expires=Sun, 09 Aug 2026 13:43:49 GMT

    A cookie sent from the server to be set on the client

    • __cf_bm

      Vk6mVzBRd2Z95QYarOA7uK0Lqphoh0WZBMpYvQmexR4-1786281229.5632584-1.0.1.1-mjSQDotqPBJo92FUL1bLHYSe8kpufWvHBoU4.OfIO5DjxCaiEa3QkifVrjXoeQAilkzOIrSs7fudJxFqkwRPHqQgzQQ7QbKJEKrLh0jGbfO1ORvW2lETPtI0VXICRZP0

      Cookie name and value.

    • HttpOnly

      Prevents access to the cookie through JavaScript.

    • Samesite

      None

      Cookie sent with both cross-site and same-site requests..

    • Secure

      The cookie is only sent when requesting from a https domain.

    • Path

      /

      The client will only send the cookie when requesting this path, or subdirectories, from the server.

    • Domain

      readthedocs.org

      The client will only send the cookie when requesting from this domain.

    • Expires

      Sun, 09 Aug 2026 13:43:49 GMT

      When the cookie should expire.

    Set-Cookie

    _cfuvid=6ixKhjd1oIc2i050FtI7wedc5WpxwVkwPUX6WLbmr0c-1786281229.5632584-1.0.1.1-l7xENSBv.7IAEovoAVB.ZiOzy8T8V4XsJuWbOZh4rQY; HttpOnly; SameSite=None; Secure; Path=/; Domain=readthedocs.org

    A cookie sent from the server to be set on the client

    • _cfuvid

      6ixKhjd1oIc2i050FtI7wedc5WpxwVkwPUX6WLbmr0c-1786281229.5632584-1.0.1.1-l7xENSBv.7IAEovoAVB.ZiOzy8T8V4XsJuWbOZh4rQY

      Cookie name and value.

    • HttpOnly

      Prevents access to the cookie through JavaScript.

    • Samesite

      None

      Cookie sent with both cross-site and same-site requests..

    • Secure

      The cookie is only sent when requesting from a https domain.

    • Path

      /

      The client will only send the cookie when requesting this path, or subdirectories, from the server.

    • Domain

      readthedocs.org

      The client will only send the cookie when requesting from this domain.

    Cf-Ray

    a2870534caa48ae3-EWR

    Encoded information about your request from Cloudflare.