HTTP Headers

Show the HTTP headers for a URL, with a full break-down of details. Will follow redirects.

Summary

Response
200
Total Requests
1
Total Time
115 ms

  • https://www.ted.com/profiles/51210357

    Status
    200
    Message
    OK
    Time
    115 ms
  • IP
    151.101.34.132
    View Map

  • Timing

    Wait

    0 ms

    DNS

    7 ms

    TCP

    4 ms

    Request

    0 ms

    First Byte

    98 ms

    Download

    1 ms

    Total

    115 ms

  • HTTP Headers

    Connection

    keep-alive

    Control options for the current connection and list of hop-by-hop response fields.

    keep-alive - The client would like to keep the connection open.

    Content-Length

    131447(131 kB)

    The length of the response body in octets (8-bit bytes).

    Content-Type

    text/html; charset=utf-8

    The MIME type of this content.

    Problems were detected with this header

    • Unknown MIME type.
    Server

    nginx/1.27.5

    A name for the server.

    • Server

      nginx

      Description of the server software.

    • Version

      1.27.5

      Version number.

    Content-Security-Policy

    base-uri 'self'; object-src 'none'

    The content security policy allows the server to determine what resources the user is allowed to load.

    • Base-URI

      Define what can be used in the base element.

      • 'self'

    • Object-Src

      Define sources for object, embed, and applet elements.

      • 'none'
    X-Frame-Options

    SAMEORIGIN

    Clickjacking protection.

    SAMEORIGIN - No rendering if origin mismatch.

    X-Xss-Protection

    1; mode=block

    Cross-site scripting (XSS) filter.

    • 1

      Enable XSS filtering.

    • Mode

      Filtering mode.

      • block - Block page if XSS is detected.
    X-Content-Type-Options

    nosniff

    Prevents Internet Explorer from MIME-sniffing a response away from the declared content-type.

    nosniff - Block requests if type 'style' or 'script'.

    X-Download-Options

    noopen

    X-Permitted-Cross-Domain-Policies

    none

    Specifies if a cross-domain policy is allowed.

    none - No policy is allowed.

    Referrer-Policy

    strict-origin-when-cross-origin

    Controls what referrer information is sent with requests.

    strict-origin-when-cross-origin - Send the full referrer for a same origin request. Send the origin only for cross-domain requests where the protocol level is the same. Otherwise do not send the referrer.

    Cache-Control

    no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

    Inform all caching mechanisms from server to client whether they may cache this object.

    • no-store

      May not be stored by any cache.

    • no-cache

      May be stored by any cache but must be validated by the server.

    • must-revalidate

      Stale caches must not be used.

    • proxy-revalidate

      Stale shared caches must no be used.

    • Max-Age

      0

      The time a browser should remember a site can only be accessed with https (seconds).

    Content-Security-Policy-Report-Only

    script-src 'self' https: 'sha256-nnO6ShlseiFs9zwKowmVFDXpDIbg8I08xFcWgBkuj/s=' 'sha256-JJYlnyLSKxj9EM5/2qrqKYk2RvAVx+Y2y1NqfxakKn4=' 'sha256-pSyOPOZfzGYpsBASD0gCYzwXUF0iVQzuvsQxf4EMUYg=' 'sha256-zKAGgeFl38GCHbIjkg7WuuAvQj70cPnnG8mdIQLvNmk=' 'sha256-E0rBkU5IFJfoiLYTuUeOWCaSB4cA5ONS2eZrdsm16DI=' 'sha256-5v5lygPd6fqBbJH4LUon42pOzlCcrxPdcBRK95OS32k=' 'sha256-wX1Wi9HkXs0Ted7h/E0ES65E+4bv4s2jO1fhxMuAjJw=' 'sha256-i76JSM/SJztCqWYP0RCLYX9y0X4BsVtOBQe23YFnpi8=' 'sha256-5cfWr7egsIvFMFU+6HGi6iHexSVqD6cSsZVUJKDxfdo=' 'sha256-rcXZcFtqBa4+jAlx9v+VAdDUdYMngyHPIUDRQ3efB64=' 'sha256-8t/HKD39aScbP6Wz4KpU1E2xskBxorqPWdjCxhEB+4s=' 'sha256-xx2Zw3DGmNIm1y7TPYyfAZCQi/QhA7EgrKeVQI5MhI8=' 'sha256-zaK+YwwUS4oXF3BxVug1WYcMcAF7AE5L/paK/FplXMI='; script-src-attr 'none'; worker-src 'self' blob:

    The content security policy, reporting only.

    • Script-Src

      Define sources for JavaScript.

      • 'self'
      • https:
      • 'sha256-nnO6ShlseiFs9zwKowmVFDXpDIbg8I08xFcWgBkuj/s='
      • 'sha256-JJYlnyLSKxj9EM5/2qrqKYk2RvAVx+Y2y1NqfxakKn4='
      • 'sha256-pSyOPOZfzGYpsBASD0gCYzwXUF0iVQzuvsQxf4EMUYg='
      • 'sha256-zKAGgeFl38GCHbIjkg7WuuAvQj70cPnnG8mdIQLvNmk='
      • 'sha256-E0rBkU5IFJfoiLYTuUeOWCaSB4cA5ONS2eZrdsm16DI='
      • 'sha256-5v5lygPd6fqBbJH4LUon42pOzlCcrxPdcBRK95OS32k='
      • 'sha256-wX1Wi9HkXs0Ted7h/E0ES65E+4bv4s2jO1fhxMuAjJw='
      • 'sha256-i76JSM/SJztCqWYP0RCLYX9y0X4BsVtOBQe23YFnpi8='
      • 'sha256-5cfWr7egsIvFMFU+6HGi6iHexSVqD6cSsZVUJKDxfdo='
      • 'sha256-rcXZcFtqBa4+jAlx9v+VAdDUdYMngyHPIUDRQ3efB64='
      • 'sha256-8t/HKD39aScbP6Wz4KpU1E2xskBxorqPWdjCxhEB+4s='
      • 'sha256-xx2Zw3DGmNIm1y7TPYyfAZCQi/QhA7EgrKeVQI5MhI8='
      • 'sha256-zaK+YwwUS4oXF3BxVug1WYcMcAF7AE5L/paK/FplXMI='

    • script-src-attr

      'none'

      Problems were found.

      • Option is not one of known values.

    • Worker-Src

      Define sources for Worker, SharedWork, and ServiceWorker scripts.

      • 'self'
      • blob:
    X-Powered-By

    Zenith

    The software powering this site.

    Expires

    0

    The time at which the response is considered stale.

    Etag

    "10z6dchq6l22sci"

    An identifier for a specific version of a resource.

    • Validator

      strong

      A weak tag is easier to generate and prevents byte range caching.

    • Tag

      10z6dchq6l22sci

    Accept-Ranges

    bytes

    What partial content range types this server supports via byte serving.

    bytes - Byte ranges are supported.

    Date

    Wed, 11 Nov 2026 21:39:31 GMT

    The date and time that the message was sent.

    Via

    1.1 varnish

    Added by proxies to track a request through proxies and to avoid loops.

    • Version

      1.1

      Protocol version.

    • Host

      Host name.

    X-Served-By

    cache-lga-kjfk8660060-LGA

    X-Cache

    MISS

    Indicates whether a cache was used to server this response.

    X-Cache-Hits

    0

    X-Timer

    S1794433172.752439,VS0,VE97

    Vary

    Accept-Encoding

    Indicates that different content may be provided to different clients, depending on the vary header.

    • Headers

      • Accept-Encoding
    X-Backend-Selected

    Zenith

    Strict-Transport-Security

    max-age=31557600

    A HSTS Policy informing the HTTP client how long to cache the HTTPS only policy and whether this applies to subdomains.

    • Max-Age

      31557600 (1 year 6 hours)

      The time a browser should remember a site can only be accessed with https (seconds).