Questions tagged [http-headers]
In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.
0
votes
0answers
24 views
SEO Ajax loaded pages - noindex X-Robots-tag
I have on my homepage (page A) html content (ajax) loaded on click of a button (load more) from multiple pages (page B).
Googlebot does see content and does follow links loaded from the ajax calls on ...
1
vote
0answers
13 views
Download link expired, going back to software presentation page, what redirect method to use?
When someone (user or bot) reaches an old download link like /download/yellow-wallpaper.zip?key=some-expired-download-key , user is sent back to file details page, e.g /yellow-wallpaper.html, where ...
5
votes
1answer
148 views
Will it hurt SEO to remove the '.html' extension from static pages such that they get served as 'text/x-generic'?
If we want to go with static website, we generate static html files of pages with names like contacts.html and we may add to our .htaccess file the lines like
RewriteEngine On
RewriteRule ^(([^/]+/)*[...
1
vote
0answers
447 views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
423 views
Request Missing a User Agent Header
I activated ModSecurity on a cheap web hosting but I have no control over it: that is, the only thing the service provider lets you do is reading logs but, unfortunately, you can't really configure ...
3
votes
0answers
23 views
Header to describe available `content-type` responses?
It's a little cumbersome to scrape through the HTTP RFC for this particular question, so I'm hoping someone can help me short-circuit an answer:
Does the HTTP spec contain functionality for a server ...
3
votes
1answer
34 views
Status code vs. Response Header Status: what is the rule for bots?
Assuming we have a page, which has as Status Code 200 OK and as Response Headers Status HTTP/1.1 410 Gone, like on image:
What is the behavior of bots / Googlebot? To crawl/index or not?
2
votes
2answers
91 views
Chrome isn't loading static content due to HTTP2_SESSION_RECV_INVALID_HEADER - Invalid character in header name - last-modified
HTTP2_SESSION_RECV_INVALID_HEADER
--> error = "Invalid character in header name."
--> header_name = "last-modified:"
--> header_value = "Thursday,%2009-Aug-2018%2001:21:53%20GMT"
This error ...
3
votes
0answers
63 views
Responding other 'Content-Type' different from 'Accept' list
As all you know (else follow this question) the requesting Accept header allows client to specify the expected MIME types for response content.
But my case is:
client indicates an Accept of type ...
1
vote
2answers
48 views
Should I be concerned that Google Ads sometimes shows Passive mixed content (insecure images) in some Ads?
In some pages that have Google Ads, Chrome Dev Tools console shows the warning for a Passive Mixed Content:
Mixed Content: The page at '...' was loaded over HTTPS, but requested
an insecure image
...
0
votes
0answers
13 views
When entering an Url in CSP will the domain name be enough
I'm trying to add CSP to my web site and I wonder how to enter Urls.
When entering an Url in CSP will www.foo.com mean http://www.foo.com and https://www.foo.com?
Since more and more sites are ...
1
vote
1answer
1k views
Does a 504 Gateway Timeout error mean a server has crached?
I am running a php script on a website that creates thumbnails from a big image. The script uses imagick to generates 10 thumbnails per image.
It runs on first page load, when the thumbnails don't ...
2
votes
1answer
453 views
404 status code for HTTP/2
How does a correct 404 status code look like on using HTTP/2 protocol? HTTP/1.1 404 Not Found seems to be for the previous protocol version, but I can't find anywhere something meaningful about status ...
3
votes
2answers
223 views
HTTP-header canonical and link tag canonical on same page?
I've come across websites using both a HTTP-header based canonical as well as a tag-based canonical. Sometimes they are not referencing the same URL which brings me to my question - does one have ...
1
vote
0answers
730 views
How to disable http method verb tunneling in nginx
Our security team ran a web-inspect security scan on our site and asked us to disable verb tunneling using headers or query parameters such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, ...
1
vote
0answers
91 views
Why is my Last-Modified header always sent using GMT timezone?
I want to send the last-modified in IST timezone, But it always sends in GMT. What is wrong with this PHP code?
echo "Timezone " . date_default_timezone_get () ; //==>verified, timezone set ...
1
vote
1answer
1k views
Apache Reverse Proxy Rewrite Remote_User
Running httpd 2.4.6 on CentOS 7 as a reverse proxy for Splunk with SSO.
This works with no proxying:
RewriteCond %{LA-U:REMOTE_USER} "user" [NC]
RewriteRule ^.*$ - [F,L]
The above does NOT work ...
2
votes
1answer
247 views
Is it OK for SEO to send a 200 status when I'm actually rewriting the request to a controller and then outputting content to a page dynamically?
After reading endless pages about redirects and best practice, I'm still unsure if what I'm doing here is good, bad, or indifferent as far as SEO is concerned.
I have a table in a database that holds ...
3
votes
3answers
1k views
Why does Pingdom suggest that I add a “Vary: Accept-Encoding” header?
I have tried a tool to measure the speed of my web site. It is Pingdom https://tools.pingdom.com
There is an answer I do not understand
"The following publicly cacheable, compressible resources ...
1
vote
1answer
705 views
X-Frame-Options Enabling on GoDaddy
I am currently developing a website which runs on a GoDaddy Windows with Plesk hosting option. I am doing this as an experimental/learning site so I am trying to be as security conscious as possible ...
0
votes
3answers
68 views
Website <head> section questions
I've been doing some tidying up on my site recently and have been making some minor adjustments to the section of each page (primarily to cut out any potential duplication). However, I just have a ...
1
vote
0answers
26 views
Google Analytics stopped registering hits 10 minutes after implementing measurement protocol
I'm trying to implement google analytics on server-side. In order to (loosely) identify visitors, I'm generating an md5 based on IP and user-agent and send the result to Google for tracking the ...
4
votes
1answer
204 views
Deleting many pages SEO check
I need to delete many pages (recipes) on my website because the recipes were made with products that don't exist any more. Links to those pages are all over social media so I can't just use a 410 ...
2
votes
1answer
286 views
When should I not to use page meta security headers
When should I not to use page meta security headers?
For example, I configured the web server server-side with a powerful content security policy and other hardened security headers, but when review ...
8
votes
1answer
304 views
How is HTTP 418 treated by Google and others as it is not a “real” error?
I was wondering if you know how Google and other search engines treat a website with HTTP status code 418 I'm a teapot.
According to this Wikipedia article, it can be used as a client error code (...
2
votes
3answers
407 views
Does setting a Referrer-Policy header have any effect on non-HTML pages?
The Referrer-Policy header controls how much referrer information the browser exposes to a site when navigating to it. I understand the purpose of this header when set on HTML files; does it make ...
1
vote
1answer
115 views
Access resources of secondary server running different port apache2
I'm currently running a main server from a raspberry pi (32 GB) and a secondary server (4 TB) running as the file storage server. Both servers are running Debian Linux with Apache2 installed. I've ...
3
votes
3answers
287 views
Can browser caching be controlled by HTTP headers alone without using hash names for asset files?
I'm reading it in Webpack docs:
The way it works has a pitfall: if we don’t change filenames of our resources when deploying a new version, browser might think it hasn’t been updated and client ...
1
vote
0answers
408 views
How do I implement “If-Modified-Since” header on a node server?
My web-application is running on a node server on azure. I need to implement the "If-Modified-Since" header on this server. Could you please guide me how to do this?
I tried implementing by setting ...
2
votes
2answers
497 views
CSP3 Report-To header implementation
Issue
Many CSP validators like cspvalidator.org tell me that:
A draft of the next version of CSP deprecates report-uri in favour of
a new report-to directive.
I found more information about ...
1
vote
1answer
74 views
Why everyone uses unsafe content security policy?
I see that all big websites like Google or Facebook, even my bank uses content-security-policy header with unsafe-eval and unsafe-inline. Is there point in using csp if such big companies disable it? ...
2
votes
0answers
737 views
What are these headers and values: HTTP_X_FB_HTTP_ENGINE = Liger, HTTP_X_PURPOSE = preview and HTTP_X_REQUESTED_WITH = com.facebook.katana? [closed]
I'm trying to debug an issue in my website, and i see these headers in my page view log:
[HTTP_X_FB_HTTP_ENGINE] => Liger
[HTTP_X_PURPOSE] => preview
[HTTP_X_REQUESTED_WITH] => com.facebook.katana
...
2
votes
0answers
52 views
Browser's auto request detection with X-Purpose
3 to 4 months ago, I found out that safari/chrome/firefox all have feature that automatically send request with X-Purpose header (with preview value for Safari) to get live thumbnail or top sites ...
2
votes
0answers
41 views
Detect prerender view in PHP? [closed]
How can I detect a prerender page view in PHP?
When I use prerender it messes up my page view counter.
2
votes
2answers
9k views
Setting X-Forwarded-Proto under Apache 2.4
Ive been advised that I need to set the RequestHeader X-Forwarded-Proto for a node.js application (NodeBB) to resolve an issue with sessions / csrf tokens.
Here's the relevant excerpt from my ...
2
votes
1answer
78 views
How to pass requested domain to server when behind MaxCDN?
I have a bit of a problem getting our server to know what domain was requested to get to the server.
The scenario is like this.
site1.tld, site2.tld, site3.tld and site4.tld are all pointing to ...
6
votes
1answer
170 views
Is it feasible to use Vary: headers with If-none-match: to improve caching?
As we all know, sending a response header Vary: Some-Header causes (or should cause) caches to store different variants of the response, one for each value of Some-Header: it encounters in requests.
...
2
votes
0answers
39 views
How lenient should I be when checking the range header parameters?
I made more of my URLs now accept the HTTP range request so that only user requested bytes of the document can be parsed. This is the range header my code supports:
range: bytes=s-e
where s is the ...
5
votes
2answers
170 views
Is it an overkill to specify the accept-ranges header for small HTML pages?
I tested my site homepage through rigor.com (formerly zoompf.com) and they believe all resources should have an accept-ranges header, but since my HTML code size is under 20 KB (mostly under 10 KB), I ...
2
votes
1answer
328 views
How to invalidate Google Search results?
Due to a misconfiguration all HTTPS traffic to a specific server showed the wrong content for a while.
Google indexed this content including urls that don't exist in the affected sites.
For example: ...
3
votes
3answers
88 views
If i use 301 redirects (to bounce the requests), will the other destination be aware of my Server IP?
(Just for the knowledge)
I wonder, let's say one day, when my Site is suddenly having some attacks at the login page (e.g: /login.php). If i don't bother about my Login page anymore, and i want to ...
5
votes
1answer
249 views
Looking for explanation of Apache behavior on manipulating headers
Tried to get an answer at ServerFault - they don't know, all real gurus are sitting here.
The background of the issue: Googlebot creates non-existing URLs and tries to crawl them. On some URLs Apache ...
3
votes
1answer
163 views
Googlebots request types
Does Google's bot send HEAD requests as well as GET requests?
I wondering about this because I'm running a Tornado application that does not support HEAD request and I have a lot of 404 errors in ...
2
votes
2answers
2k views
Is there a way to block wget from crawling and downloading my website?
I do not want ANY of my alleged website to be crawled and downloaded (css, images, html, etc). Is there a way to block wget completely?
3
votes
2answers
48 views
Handling bots that request URLs in paths
In my server log, I found at least one IP address to be requesting a full URL in an awkward place. For example, the header the client sends to my server is this:
GET http://www.3rdpartysite.com/file....
1
vote
0answers
271 views
Is a Server and Date HTTP header really necessary for error or redirecting pages?
On practically every URL I visit using the command-line tool CURL, there is always a server identification header and date header outputted regardless of the status of the request.
For example, on my ...
1
vote
2answers
63 views
Is it a good idea to close the connection on a web hacker / spammer?
When I receive a request from a web spammer, such as a GET /wp-login.php, I am thinking of replying with an error (404) and closing the HTTP connection immediately with this header:
Connection: close
...
2
votes
0answers
3k views
What strings do %{HTTP_HOST} and other mod_rewrite variables return? [closed]
If I have a htaccess file that has RewriteCond %{HTTP_HOST} in it, what is the HTTP_HOST? This is something I've been struggling to find out. To help me understand, could you tell me, in each example ...
2
votes
1answer
49 views
requesting for downloadable files via HEAD
I bet google is checking web pages via HTTP HEAD and HTTP GET request methods. So I'm thinking I should also allow proper header output for downloadable files from my website via HTTP HEAD request but ...
1
vote
1answer
47 views
Can servers ever return headers not beginning with HTTP?
When I checked URLs for headers, they always start with HTTP. For example, HTTP/1.1 301 Moved Permanently.
If I remember, I think in the past, headers started with Status: followed by a code.
...
