HTTP Headers

Show the HTTP headers for a URL, with a full break-down of details. Will follow redirects.

Summary

Response
200
Total Requests
1
Total Time
125 ms
  • IP
    104.18.7.29
    View Map

  • Timing

    Wait

    0 ms

    DNS

    16 ms

    TCP

    5 ms

    Request

    0 ms

    First Byte

    88 ms

    Download

    0 ms

    Total

    125 ms

  • HTTP Headers

    Date

    Fri, 25 Sep 2026 16:14:38 GMT

    The date and time that the message was sent.

    Content-Type

    text/html; charset=utf-8

    The MIME type of this content.

    Problems were detected with this header

    • Unknown MIME type.
    Connection

    keep-alive

    Control options for the current connection and list of hop-by-hop response fields.

    keep-alive - The client would like to keep the connection open.

    Server

    cloudflare

    A name for the server.

    cloudflare - Description of the server software.

    Vary

    Accept-Encoding

    Indicates that different content may be provided to different clients, depending on the vary header.

    • Headers

      • Accept-Encoding
    Vary

    Cookie, Accept-Language

    Indicates that different content may be provided to different clients, depending on the vary header.

    • Headers

      • Cookie
      • Accept-Language

    Problems were detected with this header

    • Duplicate header. There is another header with this name and this may cause problems.
    Content-Security-Policy

    frame-ancestors 'none'; script-src 'self' 'unsafe-eval' https://kit.fontawesome.com https://js.stripe.com/ https://app-assets.readthedocs.org/; base-uri 'self'; font-src 'self' data: https://ka-p.fontawesome.com https://app-assets.readthedocs.org/; form-action 'self' https://github.com https://gitlab.com https://bitbucket.org https://id.atlassian.com https://accounts.google.com https://billing.stripe.com https://checkout.stripe.com https://webhook.frontapp.com/forms/036c4169294f3b04abaa/dXtihffn7rLqYHi1tASB_7ppEgrNQcUXDNE-2JAXNZac3pdQ85Vjn3agjSnZSnCVomF1u6PT98oAyid-I_OMwE2JtwXXiVoXlaTj0VAn_7NPjQCEQcvjrB6QZZ8; default-src 'none'; img-src 'self' data: https:; frame-src https://js.stripe.com/; connect-src 'self' https://*.ingest.us.sentry.io https://ka-p.fontawesome.com https://kit.fontawesome.com https://plausible.io/api/event ws://app.readthedocs.org:10001/ws; style-src 'self' 'unsafe-inline' https://app-assets.readthedocs.org/; report-uri https://o40776.ingest.us.sentry.io/api/148442/security/?sentry_key=48196e632bb14305ad3fe47c6570e363

    The content security policy allows the server to determine what resources the user is allowed to load.

    • Frame-Ancestors

      Define valid parents for frame, iframe, embed, object, and applet.

      • 'none'

    • Script-Src

      Define sources for JavaScript.

      • 'self'
      • 'unsafe-eval'
      • https://kit.fontawesome.com
      • https://js.stripe.com/
      • https://app-assets.readthedocs.org/

    • Base-URI

      Define what can be used in the base element.

      • 'self'

    • Font-Src

      Define sources for fonts.

      • 'self'
      • data:
      • https://ka-p.fontawesome.com
      • https://app-assets.readthedocs.org/

    • Form-Action

      Define what can be used as the target for forms.

      • 'self'
      • https://github.com
      • https://gitlab.com
      • https://bitbucket.org
      • https://id.atlassian.com
      • https://accounts.google.com
      • https://billing.stripe.com
      • https://checkout.stripe.com
      • https://webhook.frontapp.com/forms/036c4169294f3b04abaa/dXtihffn7rLqYHi1tASB_7ppEgrNQcUXDNE-2JAXNZac3pdQ85Vjn3agjSnZSnCVomF1u6PT98oAyid-I_OMwE2JtwXXiVoXlaTj0VAn_7NPjQCEQcvjrB6QZZ8

    • Default-Src

      Fallback for all fetches.

      • 'none'

    • Img-Src

      Define sources for images and favicons.

      • 'self'
      • data:
      • https:

    • Frame-Src

      Define sources for frames.

      • https://js.stripe.com/

    • Connect-Src

      Define sources for script interfaces.

      • 'self'
      • https://*.ingest.us.sentry.io
      • https://ka-p.fontawesome.com
      • https://kit.fontawesome.com
      • https://plausible.io/api/event
      • ws://app.readthedocs.org:10001/ws

    • Style-Src

      Define sources for stylesheets.

      • 'self'
      • 'unsafe-inline'
      • https://app-assets.readthedocs.org/
    X-Frame-Options

    DENY

    Clickjacking protection.

    DENY - No rendering within frame.

    X-Content-Type-Options

    nosniff

    Prevents Internet Explorer from MIME-sniffing a response away from the declared content-type.

    nosniff - Block requests if type 'style' or 'script'.

    Referrer-Policy

    strict-origin-when-cross-origin

    Controls what referrer information is sent with requests.

    strict-origin-when-cross-origin - Send the full referrer for a same origin request. Send the origin only for cross-domain requests where the protocol level is the same. Otherwise do not send the referrer.

    Cross-Origin-Opener-Policy

    same-origin

    Isolate the document from cross-origin windows.

    same-origin - Isolated the browsing context to same-origin.

    Content-Language

    en

    The natural language or languages of the intended audience for the enclosed content.

    en - English

    Strict-Transport-Security

    max-age=31536000;

    A HSTS Policy informing the HTTP client how long to cache the HTTPS only policy and whether this applies to subdomains.

    • Max-Age

      31536000 (1 year)

      The time a browser should remember a site can only be accessed with https (seconds).

    X-Backend

    web-i-08434d3a7705a3aba

    Cf-Cache-Status

    DYNAMIC

    Encoded information about your request from Cloudflare.

    DYNAMIC - This is not cached by default.

    Set-Cookie

    csrftoken=PvOav1ymRcSVfW2YgvojDBO2AM6FscG2; expires=Sun, 25 Oct 2026 16:14:38 GMT; HttpOnly; Max-Age=2592000; Path=/; SameSite=Lax; Secure

    A cookie sent from the server to be set on the client

    • csrftoken

      PvOav1ymRcSVfW2YgvojDBO2AM6FscG2

      Cookie name and value.

    • Expires

      Sun, 25 Oct 2026 16:14:38 GMT

      When the cookie should expire.

    • HttpOnly

      Prevents access to the cookie through JavaScript.

    • Max-Age

      2592000 (30 days)

      Number of seconds until the cookie expires.

    • Path

      /

      The client will only send the cookie when requesting this path, or subdirectories, from the server.

    • Samesite

      Lax

      Cookie is not sent on cross-site requests but is when following a link to the origin.

    • Secure

      The cookie is only sent when requesting from a https domain.

    Set-Cookie

    __cf_bm=tNwkoOSABbRynAun4iCyfJMQsCAXLGmtc3KR40eRdkM-1790352878.3443587-1.0.1.1-r6zeoXBRADfKwdP0R9U4oZjrRTFxCe1rKIs0Jk5P3nriya.JKk0vzcEzr3UeanKD5dAyIOtsG..pwEupCvAd8_VqL.pmxJbka_7amhDrumMnInfQdzwcQujPSMHpvx44; HttpOnly; SameSite=None; Secure; Path=/; Domain=readthedocs.org; Expires=Fri, 25 Sep 2026 16:44:38 GMT

    A cookie sent from the server to be set on the client

    • __cf_bm

      tNwkoOSABbRynAun4iCyfJMQsCAXLGmtc3KR40eRdkM-1790352878.3443587-1.0.1.1-r6zeoXBRADfKwdP0R9U4oZjrRTFxCe1rKIs0Jk5P3nriya.JKk0vzcEzr3UeanKD5dAyIOtsG..pwEupCvAd8_VqL.pmxJbka_7amhDrumMnInfQdzwcQujPSMHpvx44

      Cookie name and value.

    • HttpOnly

      Prevents access to the cookie through JavaScript.

    • Samesite

      None

      Cookie sent with both cross-site and same-site requests..

    • Secure

      The cookie is only sent when requesting from a https domain.

    • Path

      /

      The client will only send the cookie when requesting this path, or subdirectories, from the server.

    • Domain

      readthedocs.org

      The client will only send the cookie when requesting from this domain.

    • Expires

      Fri, 25 Sep 2026 16:44:38 GMT

      When the cookie should expire.

    Set-Cookie

    _cfuvid=bFkSYwDbarzXDWJsqnANJDlZcg.Eco_StEN6T_BfWFs-1790352878.3443587-1.0.1.1-fyePJKht2Fn3WpSI.4PJsYJyJeKz.zilcJLkniPC78s; HttpOnly; SameSite=None; Secure; Path=/; Domain=readthedocs.org

    A cookie sent from the server to be set on the client

    • _cfuvid

      bFkSYwDbarzXDWJsqnANJDlZcg.Eco_StEN6T_BfWFs-1790352878.3443587-1.0.1.1-fyePJKht2Fn3WpSI.4PJsYJyJeKz.zilcJLkniPC78s

      Cookie name and value.

    • HttpOnly

      Prevents access to the cookie through JavaScript.

    • Samesite

      None

      Cookie sent with both cross-site and same-site requests..

    • Secure

      The cookie is only sent when requesting from a https domain.

    • Path

      /

      The client will only send the cookie when requesting this path, or subdirectories, from the server.

    • Domain

      readthedocs.org

      The client will only send the cookie when requesting from this domain.

    Cf-Ray

    a40b52b1ae350f3b-EWR

    Encoded information about your request from Cloudflare.