Type a domain, hit enter, and before anything paints, your server and the browser have already had a short conversation. The server sends back response headers — and to anyone who knows how to read them, those headers are a fairly candid statement about how seriously that site takes its own security.
Type a domain, hit enter, and before anything paints, your server and the browser have already had a short conversation.
The server sends back response headers — and to anyone who knows how to read them, those headers are a fairly candid statement about how seriously that site takes its own security.
Not because headers are exciting, but because they're free: no login, no exploit, nothing in your logs.
The page is ready to read now. The fuller skim-friendly version will appear here automatically.
Type a domain, hit enter, and before anything paints, your server and the browser have already had a short conversation. The server sends back response headers — and to anyone who knows how to read them, those headers are a fairly candid statement about how seriously that site takes its own security. Not because headers are exciting, but because they're free: no login, no exploit, nothing in your logs.
One request tells them whether you're worth more attention.
Strict-Transport-Security — does your HTTPS actually mean anything? A max-age far under a year is a weak commitment. No includeSubDomains → protection stops at the apex.
Open the app view to save this story, compare related coverage, and continue from the same source.