Questions tagged [http-headers]

In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.

Filter by
Sorted by
Tagged with
2 votes
1 answer
65 views

How can I add HTTP headers in Cloudflare?

I have a Cloudflare website and it is hosted on Cloudflare Pages, but I want to add HTTP headers to this website. There are a lot of DNS and HTTP related settings in Cloudflare. I am undecided which ...
Caymen's user avatar
  • 23
0 votes
0 answers
61 views

Does the Referrer-Policy header affect Google Analytics tracking?

I'd like to use the Referrer-Policy header in my site. Depending on which value I use, it will send more, less or no referrer information to a link's target site. If I use a restrictive value, e.g. ...
lonix's user avatar
  • 101
0 votes
0 answers
14 views

Are there any headers to suggest a web request is done to retrieve metadata?

Since polling metadata (e.g. open graph protocol metadata) from web request responses to display a preview of a url has become common, e.g. on social media and messengers, is there currently any ...
Zaarthras's user avatar
1 vote
1 answer
35 views

How can I stop the browser identifying my server

When I check my headers with some of the websites around, they can tell that I am using Apache. For example - Headers returned from: https://example.com Cache-Control: no-store, no-cache, must-...
Rohit Gupta's user avatar
  • 2,231
0 votes
1 answer
1k views

nginx Content-Security-Policy headers: why do they have to be all on the same line? (version 1.18 vs 1.22)

I have two different servers, one using nginx 1.18 and another using 1.22. The headers on the 1.18 version are: add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; ...
ehtio's user avatar
  • 103
2 votes
1 answer
55 views

Should I always use 410 instead of 404?

A 410 HTTP header means the deleted content is gone forever. When I remove a page from my website, I never put it back and it is gone forever. I want Google to index nothing other than the existing ...
HOY's user avatar
  • 504
1 vote
0 answers
987 views

.htaccess security headers for IONOS

I need to implement security headers for a website hosted by IONOS. I've used the following code, which works on sites hosted elsewhere, but not here. <IfModule mod_headers.c> Header set ...
Andrew's user avatar
  • 119
0 votes
0 answers
106 views

X-Robots-Tag across Multiple URL

I need to add X-Robots-Tag in my Apache config where it can be applied to multiple URLs which are read from a file and apply the X-Robots-Tag HTTP header, is this possible? Any pointers on how to ...
temperature's user avatar
5 votes
1 answer
733 views

Why does it cause issues to use robots.txt and a meta robots tag at the same time?

It seems common wisdom that using X-Robots-Tag/meta robots with robots.txt to block a URL from being indexed "can cause issues", e.g.: Using both X-Robots-Tag and meta robots on a URL is ...
jII's user avatar
  • 153
2 votes
1 answer
32 views

Recording / Logging CSP Violations

I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss ...
Mark Bosky's user avatar
6 votes
1 answer
2k views

Cannot add "Host" header in Cloudfront

I am trying to add the "Host" header as a custom header when creating an Amazon Cloudfront Distribution. However, I always get the error "The parameter HeaderName : Host is not allowed&...
alancc's user avatar
  • 439
1 vote
1 answer
1k views

Configure nginx to set the content type from the URL only when there is an allowed user

I implemented a location configuration like this (legituser is set by a map lookup): location / { if ($legituser = 0) { return 200 "you are not allowed to access this url, please do bla bla ...
Marged's user avatar
  • 133
2 votes
0 answers
202 views

Why Vary Header is different for CURL --head and Chrome's F12 Dev Tools

I am trying to study the HTTP response headers in popular websites. The objective is that I can cross-check with my website and adapt good things. I tried to find how Vary header looks in the response ...
Kannan's user avatar
  • 2,323
1 vote
1 answer
181 views

Default cache-control directives (and behaviour) when header returns only private

I just checked the cache-control header returned by webmasters.stackexchange.com. The only directive present in the response is cache-control: private. In this case, what are the default values for ...
Kannan's user avatar
  • 2,323
0 votes
1 answer
316 views

SEO Impact of Vary: User-Agent header

Vary: User-Agent header is used to tell browsers, CDNs, etc., (for caching purposes) that the content differs by user agents (especially for mobile and desktop versions). But do search engine robots ...
Kannan's user avatar
  • 2,323
1 vote
1 answer
47 views

Minor variations in content based on user-agent - SEO Precautions like http vary header

I am planning minor variations to HTML based on user-agent. Specifically, I would not be implementing ad codes (adsense and other third party ads) for certain user-agents (certain old browsers both on ...
Kannan's user avatar
  • 2,323
2 votes
0 answers
25 views

Dynamic Serving via 'vary http': Is still valid? Why the industry prefer full responsive websites instead?

I have a client that asked me to develop a website using a dynamic serving technique, basically he uses the vary http header in order to serve different versions of the front-end discerning them based ...
Santiago's user avatar
  • 121
0 votes
1 answer
194 views

HTTP "Vary: User-Agent" header for a Single Page React App that does SSR for robots?

I have React web app. It's a single page app, so there's basically an "empty" HTML file with a JS bundle that does it all. But to improve SEO capabilities, I'm doing SSR for robot crawlers ...
cbdeveloper's user avatar
3 votes
0 answers
234 views

Cross origin resource policy violation for JS file when setting COEP, COOP and CORP headers

What is the best way to deal with the new security headers? Cross-Origin-Embedder-Policy (COEP) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy Cross-Origin-...
qräbnö's user avatar
  • 141
1 vote
0 answers
24 views

Can you specify the max-snippet length in a X-robots-tag header?

The specs by Google does not address this issue. So, I would like to know what is the x-robots-tag equivalent for: <meta name="googlebot" content="max-snippet:20"/> Is it ...
Jesske's user avatar
  • 11
1 vote
1 answer
433 views

POSTing authorization headers with no $_SERVER['HTTP_AUTHORIZATION'] and no 'authorization' value in apache_request_headers()

I'm developing a web application that interacts with a GraphQL instance on another server (not mine). The GraphQL instance requires me to send an authorization header ("Bearer [token]"). The ...
Eye Teeth's user avatar
0 votes
0 answers
814 views

Chrome dev tools reports “Stalled' and ”Initial connection" under mobile mode only

One of my static pages(generated by Hugo) is loading slow on mobile mode, but the exact same page was fine on desktop mode. (google page load speed desktop score 97, but failed Core Web Vitals on ...
Swiftlet's user avatar
2 votes
0 answers
191 views

Prevent indexing of text loaded by javascript from XHR-ed JSON file

I have a web document, https://example.com/page.html, where a javascript, like <script src="https://example.com/script.js"> loads a <div class="content"></div> ...
Evgeniy's user avatar
  • 10.1k
2 votes
1 answer
170 views

Double redirect - referrer in headers

let's say we have redirects like this: (1) my shortener link -> (2) bit.ly -> (3) target URL Is it possible to check on the end (3) that user visit came from (1) my shortened link?
Tony's user avatar
  • 63
5 votes
1 answer
589 views

What is difference between robots.txt, sitemap, robots meta tag, robots header tag?

So I am trying to learn SEO and I am honestly confused and have following 8 questions. Do I tell a bot not to visit a certain link through X-Robots-Tag or through robot meta tag or robots.txt? Is it ...
Quillion's user avatar
  • 175
2 votes
1 answer
1k views

When my origin serves a "304 Not Modified", Cloudflare sends "200 OK" and makes the user download the page again

I'm using Cloudflare to cache certain APIs. I'm setting the below headers in my Origin server: Cache-Control: public, must-revalidate, max-age=300 Basically, I'm instructing the browser here to cache ...
Jayaram's user avatar
  • 133
1 vote
1 answer
100 views

How does the server distinguish between 2 host names being pointed to the same IP address?

How does a Windows server distinguish between 2 host names being directed by DNS to the same IP address? I started a new job recently. We have files.example.com pointing to x.x.x.x IP address. I got ...
JDoe's user avatar
  • 13
1 vote
0 answers
50 views

Chrome gives a content-security-policy warning when viewing an image in its own tab on my site

I'm setting Content-Security-Policy in htaccess. I use a pretty basic and strict policy: Header always set Content-Security-Policy "default-src 'self'; script-src 'self' http: https: *.googleapis....
mowgli's user avatar
  • 312
9 votes
1 answer
3k views

Why does Chrome show 304 in Response Headers section but 200 in Status code?

Why does Chrome show 304 in Response Headers section but 200 in Status code? Why doesn't it show 304 in Status code (BTW, that is NOT 200 memory cache.)? If it shows 200 I can't know it is ...
Qiulang 邱朗's user avatar
1 vote
1 answer
287 views

Are these expiration headers wrong or could they hurt SEO?

I cannot figure out why my rankings dropped, at the same time I deployed 4 Nginx cache servers on different continents. When I serve the PHP pages, I set this expiration header from the origin server,...
adrianTNT's user avatar
  • 203
5 votes
1 answer
4k views

What headers used in request by google bot?

What headers used in request by google bot? Must be user agent, but what else? I'm interested in cache control headers, does bot try to get fresh page, but not from cache? The related question: Do ...
LeonidMew's user avatar
  • 605
2 votes
1 answer
899 views

Can a JS redirect to a not found page work in place of a real 404?

I need assistance with some issues on a Big Commerce site. To preface, it is not my site and the IT team has a complex technology stack being utilized to build the site. The issue is that adding an ...
Rob T's user avatar
  • 561
5 votes
2 answers
1k views

Do browsers send different HTTP headers on page reload so that server side caches can be flushed?

I'm implementing caching at the server application level, because my hosting doesn't provide Apache caching modules and it's not possible to use a reverse proxy there. Its cheap and fast hosting, so I ...
LeonidMew's user avatar
  • 605
1 vote
0 answers
108 views

Apache: using %{DOCUMENT_ROOT} inside <Directory> section

My virtualhost configuration file sites-available/site.conf contains (some lines omitted): <VirtualHost *:443> <Directory /var/www/html/my_website> # set options </Directory>...
builder-7000's user avatar
2 votes
1 answer
100 views

If the content is fetched by wget, could there be an issue if I don't know the content-type in the HTTP response?

It's a question about wget. I have a simple file uuid.html in the document root that contains a single line 54da5638-099d-4cf3-9319-c436fcb81334. I get the line in a shell script with content=$(wget ...
Dominic108's user avatar
0 votes
1 answer
25 views

What the HTTP specification says about HTTP requests on a plain text without header

Some times in small shell scripts, I use an http request on a raw text file with no header, only a uuid string for identification. For example, in the apache document root, I might have a file uuid....
Dominic108's user avatar
1 vote
0 answers
196 views

Using Post method in Faceook Graph API

When I use graph API to post on a Facebook page it's not working, it responds with an ID and URL but instead it should be responding with a post id. When I open the URL it gives this error: { "...
ashu's user avatar
  • 11
1 vote
0 answers
22 views

Download link expired, going back to software presentation page, what redirect method to use?

When someone (user or bot) reaches an old download link like /download/yellow-wallpaper.zip?key=some-expired-download-key , user is sent back to file details page, e.g /yellow-wallpaper.html, where ...
adrianTNT's user avatar
  • 203
5 votes
1 answer
1k views

Will it hurt SEO to remove the '.html' extension from static pages such that they get served as 'text/x-generic'?

If we want to go with static website, we generate static html files of pages with names like contacts.html and we may add to our .htaccess file the lines like RewriteEngine On RewriteRule ^(([^/]+/)*[...
stckvrw's user avatar
  • 247
1 vote
0 answers
2k views

Append basic authentication header NGINX to existing authentication header of upstream application

Assume the following setup: The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
VC_work's user avatar
  • 111
3 votes
1 answer
2k views

Request Missing a User Agent Header

I activated ModSecurity on a cheap web hosting but I have no control over it: that is, the only thing the service provider lets you do is reading logs but, unfortunately, you can't really configure ...
user avatar
4 votes
0 answers
31 views

Header to describe available `content-type` responses?

It's a little cumbersome to scrape through the HTTP RFC for this particular question, so I'm hoping someone can help me short-circuit an answer: Does the HTTP spec contain functionality for a server ...
Clev3r's user avatar
  • 141
3 votes
1 answer
176 views

Status code vs. Response Header Status: what is the rule for bots?

Assuming we have a page, which has as Status Code 200 OK and as Response Headers Status HTTP/1.1 410 Gone, like on image: What is the behavior of bots / Googlebot? To crawl/index or not?
Evgeniy's user avatar
  • 10.1k
2 votes
2 answers
459 views

Chrome isn't loading static content due to HTTP2_SESSION_RECV_INVALID_HEADER - Invalid character in header name - last-modified

HTTP2_SESSION_RECV_INVALID_HEADER --> error = "Invalid character in header name." --> header_name = "last-modified:" --> header_value = "Thursday,%2009-Aug-2018%2001:21:53%20GMT" This error ...
Michael C's user avatar
  • 141
4 votes
0 answers
109 views

Responding other 'Content-Type' different from 'Accept' list

As all you know (else follow this question) the requesting Accept header allows client to specify the expected MIME types for response content. But my case is: client indicates an Accept of type ...
lucasvc's user avatar
  • 141
1 vote
2 answers
124 views

Should I be concerned that Google Ads sometimes shows Passive mixed content (insecure images) in some Ads?

In some pages that have Google Ads, Chrome Dev Tools console shows the warning for a Passive Mixed Content: Mixed Content: The page at '...' was loaded over HTTPS, but requested an insecure image ...
JAT86's user avatar
  • 205
1 vote
1 answer
3k views

Does a 504 Gateway Timeout error mean a server has crached?

I am running a php script on a website that creates thumbnails from a big image. The script uses imagick to generates 10 thumbnails per image. It runs on first page load, when the thumbnails don't ...
web-tiki's user avatar
  • 199
2 votes
1 answer
5k views

404 status code for HTTP/2

How does a correct 404 status code look like on using HTTP/2 protocol? HTTP/1.1 404 Not Found seems to be for the previous protocol version, but I can't find anywhere something meaningful about status ...
Evgeniy's user avatar
  • 10.1k
3 votes
2 answers
328 views

HTTP-header canonical and link tag canonical on same page?

I've come across websites using both a HTTP-header based canonical as well as a tag-based canonical. Sometimes they are not referencing the same URL which brings me to my question - does one have ...
sboss's user avatar
  • 131
1 vote
1 answer
2k views

How to disable http method verb tunneling in nginx

Our security team ran a web-inspect security scan on our site and asked us to disable verb tunneling using headers or query parameters such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, ...
Sriram's user avatar
  • 11