HTTP Headers

Show the HTTP headers for a URL, with a full break-down of details. Will follow redirects.

Summary

Response
200
Total Requests
1
Total Time
91 ms
  • IP
    142.251.211.78
    View Map

  • Timing

    Wait

    0 ms

    DNS

    18 ms

    TCP

    6 ms

    Request

    0 ms

    First Byte

    51 ms

    Download

    1 ms

    Total

    91 ms

  • HTTP Headers

    Content-Type

    text/html; charset=utf-8

    The MIME type of this content.

    Problems were detected with this header

    • Unknown MIME type.
    Vary

    Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site

    Indicates that different content may be provided to different clients, depending on the vary header.

    • Headers

      • Sec-Fetch-Dest
      • Sec-Fetch-Mode
      • Sec-Fetch-Site
    X-Ua-Compatible

    IE=edge

    Recommends the preferred rendering engine (often a backward-compatibility mode) to use to display the content.

    IE=edge - Use highest level rendering.

    Cache-Control

    no-cache, no-store, max-age=0, must-revalidate

    Inform all caching mechanisms from server to client whether they may cache this object.

    • no-cache

      May be stored by any cache but must be validated by the server.

    • no-store

      May not be stored by any cache.

    • Max-Age

      0

      The time a browser should remember a site can only be accessed with https (seconds).

    • must-revalidate

      Stale caches must not be used.

    Pragma

    no-cache

    HTTP/1.0 backwards compatible cache handling.

    no-cache - Force requests to the origin server before releasing a cache.

    Expires

    Mon, 01 Jan 1990 00:00:00 GMT

    The time at which the response is considered stale.

    Date

    Sat, 31 Oct 2026 21:27:47 GMT

    The date and time that the message was sent.

    Content-Length

    0

    The length of the response body in octets (8-bit bytes).

    Accept-Ch

    Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version

    Specify what client hints should be included in subsequent requests.

    • sec-ch-ua-arch

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-bitness

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-full-version

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-full-version-list

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-model

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-wow64

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-form-factors

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-platform

      Problems were found.

      • Option is not one of known values.

    • sec-ch-ua-platform-version

      Problems were found.

      • Option is not one of known values.
    Permissions-Policy

    ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*

    Enable and disable browser features.

    • ch-ua-arch

      Control access to the user agent architecture.

      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-bitness

      Control access to the user agent bitness.

      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-full-version

      Control access to the user agent full version.

      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-full-version-list

      Problems were found.

      • Unknown option
      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-model

      Control access about the user agent device.

      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-wow64

      Problems were found.

      • Unknown option
      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-form-factors

      Problems were found.

      • Unknown option
      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-platform

      Control access to the user agent platform.

      • * - Allowed on this page and all nested contexts of any origin.

    • ch-ua-platform-version

      Control access to the user agent platform version.

      • * - Allowed on this page and all nested contexts of any origin.
    Content-Security-Policy

    script-src 'report-sample' 'nonce-RBYFtgkdKyK5y009e2iGOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self'

    The content security policy allows the server to determine what resources the user is allowed to load.

    • Script-Src

      Define sources for JavaScript.

      • 'report-sample'
      • 'nonce-RBYFtgkdKyK5y009e2iGOw'
      • 'unsafe-inline'

    • Object-Src

      Define sources for object, embed, and applet elements.

      • 'none'

    • Base-URI

      Define what can be used in the base element.

      • 'self'

    • Report-URI

      /_/DurableDeepLinkUi/cspreport

      URI for violation reports.

    • Worker-Src

      Define sources for Worker, SharedWork, and ServiceWorker scripts.

      • 'self'
    Content-Security-Policy

    script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport/allowlist

    The content security policy allows the server to determine what resources the user is allowed to load.

    • Script-Src

      Define sources for JavaScript.

      • 'unsafe-inline'
      • 'unsafe-eval'
      • blob:
      • data:
      • 'self'
      • https://apis.google.com
      • https://ssl.gstatic.com
      • https://www.google.com
      • https://www.googletagmanager.com
      • https://www.gstatic.com
      • https://www.google-analytics.com
      • https://www.googleapis.com/appsmarket/v2/installedApps/

    • Report-URI

      /_/DurableDeepLinkUi/cspreport/allowlist

      URI for violation reports.

    Problems were detected with this header

    • Duplicate header. There is another header with this name and this may cause problems.
    Content-Security-Policy

    require-trusted-types-for 'script';report-uri /_/DurableDeepLinkUi/cspreport

    The content security policy allows the server to determine what resources the user is allowed to load.

    • Require-Trusted-Types-For

      Enforce trusted types for DOM XSS.

      • 'script'

    • Report-URI

      /_/DurableDeepLinkUi/cspreport

      URI for violation reports.

    Problems were detected with this header

    • Duplicate header. There is another header with this name and this may cause problems.
    Cross-Origin-Resource-Policy

    same-site

    The cross-origin policy.

    same-site - Allow same site requests only.

    Cross-Origin-Opener-Policy

    unsafe-none

    Isolate the document from cross-origin windows.

    unsafe-none - Allow document to be added to its openered browsing context group.

    Reporting-Endpoints

    default="/_/DurableDeepLinkUi/web-reports?context=eJzj8tDikmLw0JBiaL15jnU6EJcsOs_aBsRdQDwHiA0VLrE6A3GRxBXWFiD-VHWDVaT6Buu3Yl82jhJfNpa3_mx_u2PZhHg4Lu-aeZ1NoKN_wSdGJY2k_ML4lNKixKSc1JTU1IKczLzs4tSistSieCMDIzNDINYzMI8vMAAApI4wWA"

    Server

    ESF

    A name for the server.

    ESF - Description of the server software.

    X-Xss-Protection

    0

    Cross-site scripting (XSS) filter.

    0 - Disable XSS filtering.

    X-Frame-Options

    SAMEORIGIN

    Clickjacking protection.

    SAMEORIGIN - No rendering if origin mismatch.

    X-Content-Type-Options

    nosniff

    Prevents Internet Explorer from MIME-sniffing a response away from the declared content-type.

    nosniff - Block requests if type 'style' or 'script'.

    Alt-Svc

    h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

    Indicate a resource should be loaded from a different server while still appearing to be loaded from this server.

    • Service

      • h3 - :443

    • Service

      • ma - 2592000 (30 days)

        Max age for the alternative (seconds).

      • h3-29 - :443

        HTTP/3 (draft 29)

    • Service

      • ma - 2592000 (30 days)

        Max age for the alternative (seconds).