Tag Info

Hot answers tagged

21

As you correctly note, the Accept header is used by HTTP clients to tell the server what content types they'll accept. The server will then send back a response, which will include a Content-Type header telling the client what the content type of the returned content actually is. However, as you may have noticed, HTTP requests can also contain Content-Type ...


16

It is referring to Response Headers and not document body ("Content-Type tag"). If you check Response Headers of your page with any HTTP Debugger (for example, Net panel of Firebug for Firefox, or similar tab of Developer Tools in Google Chrome/Internet Explorer/Safari/Opera), you will see this line: Content-Type: text/html At the same time, if you check ...


15

It might come from 60 * 60 * 24 * 7 * 4 * 12 = 29030400 where each month consists of exactly 4 weeks.


12

After the site is closed sending a 410 Gone HTTP status code would be the proper way to do it as this will tell search engines those pages are gone for good and to remove them from their index. 404 will do this, too, but may take longer as the search engines will keep retrying to reach it several times before removing it from their index. Also, make sure ...


12

No, it is not used for anything important. (Netcraft's server market share surveys probably use it, as presumably do other 3rd party surveys.) Yes, it is a (very) small security issue. Of course your server should be secured and up to date at all times, but having an extra layer of 'obscurity' on top of a well secured server is only beneficial. If nothing ...


12

You can't really control what headers user agents decide to send to you. If the file in question is in the browser's cache and it decides it need to check for a new version then it will. According to this article, these are the situations browsers will request using If-Modified-Since: The cached entry has no expiration date and the content is being ...


12

According to the current version of the HTTP/1.1 standard, RFC 2616, the value of the Location header must be an absolute URI. However, in the draft standard prepared by the HTTPbis Working Group to eventually replace RFC 2616, this has been changed to allow relative URIs as well, apparently because: "The definition of the Location header [in RFC 2616] ...


9

TCP already has error correction, but this only helps you on the TCP layer. An intermediary HTTP proxy or load balancer can corrupt the data on the HTTP layer, and then retransmit it. A HTTP MD5 makes it possible to detect this corruption. The reason why nobody really talks about this need is that the problem is very rare indeed; most HTTP proxies etc "just ...


7

Here's some I use: # Don't allow any pages to be framed by my site or any others # Defends against Clickjacking! Header set X-Frame-Options DENY # Only allow JavaScript from the same domain to be run. # Also, don't allow inline JavaScript to run. Header set X-Content-Security-Policy "allow 'self';" # Turns on IE 8 XSS prevention tools Header set ...


7

ETags are an alternative to (but can be used in combination with) "Last-Modified-Time" in order to determine cache validation. The client can send a pre-condition such as if-matches or if-none-matches based on the ETag. This is not just for GET requests (which is what webpagetest.org does) you can use "opportunistic updating" so that a PUT request has a ...


6

Section 14.30 of the HTTP 1.1 RFC http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.30 is not significantly different. I don't know that you're going to see any actual practical limitations for this. The only time I've seen even a warning about this issue is when I used to test in Lynx and the location was not absolute it would warn you "Location ...


6

If the page is not replaced by new content Send a 410 GONE HTTP status message which tells search engines that the page doesn't exist anymore. Have the page's content tell the user why the page is gone and give them options for finding existing content on your website. This should links to your home page, site map (if one exists), search page (if one ...


6

"Is there a common way to override the server headers send to the browser from within the HTML document?" AFAIK no, you do what you can do already. The defined charset via Header trumps your definition in the META tag. If you have access to the server, e.g. Apache, it is configured by this statement (see the comment lines): # Read the documentation before ...


5

To paraphrase Coding Horror's excellent evaluation of the YSlow Firebug plugin (which it appears WebPageTest.org is using as a basis for their evaluation): "Yahoo is one of the busiest websites in the world - its problems are probably not your problems." If you're not dealing in millions of uniques across your load-balanced network every day, there's a ...


5

Do a 307 temporary redirect on the server side. You can do this with PHP or .htaccess, it doesn't matter which. But definitely make sure you send the 307 header as that is what tells the search engines the redirect is temporary and to try again later. Without it they will consider the pages removed which is exactly what you don't want. PHP: ...


5

You're correct. RED implemented the requirements from HTTPbis http://tools.ietf.org/html/draft-ietf-httpbis-p4-conditional-18#section-4.1. Normally, HTTPbis requirements are backwards-compatible with RFC2616 (i.e., they don't make implementations that were conformant to 2616 non-conformance now), but this change slipped through -- we'll be opening an issue ...


5

The reason is that your directive in the X-Robots-Tag is for indexation, not crawling. [EDIT] Explicit reference to this point is made here: https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag This document details how Google handles the page-level indexing settings allow you to control how Google makes content available ...


4

Most likely attempts at referrer spam, but these could also be malicious (i.e. remote file inclusion attempts or contact form spam - particularly if you're running software which could be identified as vulnerable). If possible, set up a script to log the post contents to see exactly what you're dealing with and get in touch with the ISP's hosting the ...


4

I can't really answer the question of what information would be missed, though I will say from an analytics standpoint we do tend to care about the browser and OS our users are visiting with (to determine what HTML features we can get away with using). Philosophically I can give you my view on the sitiation-- What CAN be done falls in to two categories: ...


4

You could read the values of the cookies into ENV variables, unset the headers using mod_headers RequestHeader directives, and then set the headers again. Update: Solution for reading cookie values into ENV vars and then manipulating headers to control Set-Cookie header order. <IfModule mod_rewrite.c> RewriteEngine on # Read cookie1 into ...


4

Remove all white space (spaces and carriage returns) before any opening <?php or <? tags and after all closing ?> tags in all PHP files you've modified.


4

A .htaccess file works only on the Apache webserver, you're using Microsoft's IIS Webserver. See 'Add Expires or Cache Control Header to static content in IIS'


4

In client-server applications, the IP address of the client (i.e., the browser) is sent via the socket connection (the request) to the server (e.g., Apache). If the client is using a proxy server however, that may be the proxy's IP address instead of the client's IP. Remote_Addr is an ENV returned by the server and available to server-side ...


4

Some search engines and bots send HEAD request to pages before sending the GET request for reasons like: Checking if the page size has changed Checking the last modified date etc. (Any other info the head would give them!) This would help large crawlers save a lot of bandwidth if they know a page has not been changed meanwhile and they don't have to ...


4

By the HTTP protocol, clause 7.2.1, “Any HTTP/1.1 message containing an entity-body SHOULD include a Content-Type header field defining the media type of that body. If and only if the media type is not given by a Content-Type field, the recipient MAY attempt to guess the media type via inspection of its content and/or the name extension(s) of the URI used to ...


3

Use rel="nofollow" on all links that you don't want spiders to follow or index (i.e. days, months, etc.). Use robots.txt to specify paths that you want them to ignore. If your site is a web application, consider using robots.txt to disallow indexing of the whole app with: User-agent: * Disallow: /


3

SEO-wise it's not advised to use a meta-refresh or javascript, because they will not pass pagerank and it'll just evaporate. Instead, use a 302 redirect (htacess or php header()). This will ensure that the original homepage maintains it's pagerank while it's under construction. But really, can't you tinker with it on a test environment and just upload it to ...


3

Use 410 is it is deleted permanently. Use 307 if it is only disabled and will be back again. That will tell the search engines to keep trying and not to assume the page is gone forever.


3

As it stands, your cache settings don't appear to match your update cycle, so I think you're on the right track. Adding indicators that allow your site to be cached by your end users and inline caches will improve your users' experience and has the potential to reduce your bandwidth and server load. What you set the above to depends on your tolerance for ...


3

What's the best way to determine users' preferred language? Ask - include a language selection dialog on every page and abide by the user's choice. The easiest way to to manage user preferences with this method is to host localized/internationalized content under distinct domains or URI's - e.g. "domain.com":"domain.kr" or ...



Only top voted, non community-wiki answers of a minimum length are eligible