Questions tagged [http-headers]

In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.

Filter by
Sorted by
Tagged with
3
votes
1answer
44 views

Why does Chrome show 304 in Response Headers section but 200 in Status code?

Why does Chrome show 304 in Response Headers section but 200 in Status code? Why doesn't it show 304 in Status code (BTW, that is NOT 200 memory cache.)? If it shows 200 I can't know it is ...
1
vote
1answer
21 views

Are these expiration headers wrong or could they hurt SEO?

I cannot figure out why my rankings dropped, at the same time I deployed 4 Nginx cache servers on different continents. When I serve the PHP pages, I set this expiration header from the origin server,...
3
votes
3answers
4k views

CloudFlare Not Sending If-Modified-Since Headers

I'm trying to reduce my server load by providing 304 Not Modified responses for content where appropriate. CloudFlare is my middle man, so they should be sending If-Modified-Since headers whenever a ...
3
votes
1answer
135 views

What headers used in request by google bot?

What headers used in request by google bot? Must be user agent, but what else? I'm interested in cache control headers, does bot try to get fresh page, but not from cache? The related question: Do ...
2
votes
1answer
150 views

Can a JS redirect to a not found page work in place of a real 404?

I need assistance with some issues on a Big Commerce site. To preface, it is not my site and the IT team has a complex technology stack being utilized to build the site. The issue is that adding an ...
5
votes
2answers
105 views

Do browsers send different HTTP headers on page reload so that server side caches can be flushed?

I'm implementing caching at the server application level, because my hosting doesn't provide Apache caching modules and it's not possible to use a reverse proxy there. Its cheap and fast hosting, so I ...
2
votes
1answer
82 views

If the content is fetched by wget, could there be an issue if I don't know the content-type in the HTTP response?

It's a question about wget. I have a simple file uuid.html in the document root that contains a single line 54da5638-099d-4cf3-9319-c436fcb81334. I get the line in a shell script with content=$(wget ...
1
vote
0answers
20 views

Apache: using %{DOCUMENT_ROOT} inside <Directory> section

My virtualhost configuration file sites-available/site.conf contains (some lines omitted): <VirtualHost *:443> <Directory /var/www/html/my_website> # set options </Directory>...
0
votes
1answer
15 views

What the HTTP specification says about HTTP requests on a plain text without header

Some times in small shell scripts, I use an http request on a raw text file with no header, only a uuid string for identification. For example, in the apache document root, I might have a file uuid....
123
votes
5answers
181k views

Difference between the Accept and Content-Type HTTP headers

So the Accept header tells the server the MIME-type of the resource the browser is looking for. For example, the server can send plain text, HTML, JSON, etc. OK, that makes sense, but when I look at ...
16
votes
2answers
80k views

Font blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin'

we are experiencing this error in Google Chrome. We thought everything was set-up correct. But maybe not? Font from origin http://skin.cdn.com has been blocked from loading by Cross-Origin ...
8
votes
2answers
11k views

How to get keywords from Google HTTP referrer?

Can the http referrer URL from Google be decoded so that I can see the specific keywords? http://www.google.sk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=11&sqi=2&ved=...
1
vote
0answers
43 views

Using Post method in Faceook Graph API

When I use graph API to post on a Facebook page it's not working, it responds with an ID and URL but instead it should be responding with a post id. When I open the URL it gives this error: { "...
1
vote
5answers
4k views

Is no cache meta tag bad for performance?

I see many websites, seemingly arbitrarily adding the no cache meta tag on every page. Like this: <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"> <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-...
8
votes
1answer
15k views

Is it necessary to specify content-type in http response header?

Except for the html document, currently all the files (css, javascript and images) served from my web server do not specify the content-type in the http response header. I happen to notice this as I ...
1
vote
2answers
3k views

What response headers encourage 304-Not Modified upon reloads?

When looking at the network waterfall in Firebug/Chrome/IE9, I keep seeing "200-OK" instead of "304-Not Modified" for many cache-able files (images, js, css) on this page, for example. I believe it ...
1
vote
0answers
16 views

Download link expired, going back to software presentation page, what redirect method to use?

When someone (user or bot) reaches an old download link like /download/yellow-wallpaper.zip?key=some-expired-download-key , user is sent back to file details page, e.g /yellow-wallpaper.html, where ...
5
votes
1answer
509 views

Will it hurt SEO to remove the '.html' extension from static pages such that they get served as 'text/x-generic'?

If we want to go with static website, we generate static html files of pages with names like contacts.html and we may add to our .htaccess file the lines like RewriteEngine On RewriteRule ^(([^/]+/)*[...
31
votes
5answers
54k views

Headers to prevent 304/If-modified-since/HEAD requests

What headers should I be sending to outright stop all requests to the server after the content has been cached? We have a very high latency server (Sigh, VMWare) so even sending a HEAD request to the ...
1
vote
0answers
837 views

Append basic authentication header NGINX to existing authentication header of upstream application

Assume the following setup: The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
1k views

Request Missing a User Agent Header

I activated ModSecurity on a cheap web hosting but I have no control over it: that is, the only thing the service provider lets you do is reading logs but, unfortunately, you can't really configure ...
4
votes
0answers
28 views

Header to describe available `content-type` responses?

It's a little cumbersome to scrape through the HTTP RFC for this particular question, so I'm hoping someone can help me short-circuit an answer: Does the HTTP spec contain functionality for a server ...
3
votes
1answer
67 views

Status code vs. Response Header Status: what is the rule for bots?

Assuming we have a page, which has as Status Code 200 OK and as Response Headers Status HTTP/1.1 410 Gone, like on image: What is the behavior of bots / Googlebot? To crawl/index or not?
1
vote
2answers
59 views

Should I be concerned that Google Ads sometimes shows Passive mixed content (insecure images) in some Ads?

In some pages that have Google Ads, Chrome Dev Tools console shows the warning for a Passive Mixed Content: Mixed Content: The page at '...' was loaded over HTTPS, but requested an insecure image ...
2
votes
2answers
211 views

Chrome isn't loading static content due to HTTP2_SESSION_RECV_INVALID_HEADER - Invalid character in header name - last-modified

HTTP2_SESSION_RECV_INVALID_HEADER --> error = "Invalid character in header name." --> header_name = "last-modified:" --> header_value = "Thursday,%2009-Aug-2018%2001:21:53%20GMT" This error ...
4
votes
0answers
83 views

Responding other 'Content-Type' different from 'Accept' list

As all you know (else follow this question) the requesting Accept header allows client to specify the expected MIME types for response content. But my case is: client indicates an Accept of type ...
1
vote
2answers
2k views

HTTP Header broken? Browsers don't open our pdf, but open all other pdfs [closed]

My Firefox and Chrome usually open PDF files very nicely, without asking and within the browser window. When clicking on a link to a PDF on our own website: Firefox asks if it should download them, ...
32
votes
1answer
20k views

What is recommended minimum object size for gzip performance benefits?

I'm working on improving page speed display times, and one of the methods is to gzip content from the webserver. Google recommends: Note that gzipping is only beneficial for larger resources. Due ...
7
votes
2answers
19k views

Setting X-Forwarded-Proto under Apache 2.4

Ive been advised that I need to set the RequestHeader X-Forwarded-Proto for a node.js application (NodeBB) to resolve an issue with sessions / csrf tokens. Here's the relevant excerpt from my ...
3
votes
2answers
292 views

HTTP-header canonical and link tag canonical on same page?

I've come across websites using both a HTTP-header based canonical as well as a tag-based canonical. Sometimes they are not referencing the same URL which brings me to my question - does one have ...
1
vote
1answer
2k views

Does a 504 Gateway Timeout error mean a server has crached?

I am running a php script on a website that creates thumbnails from a big image. The script uses imagick to generates 10 thumbnails per image. It runs on first page load, when the thumbnails don't ...
2
votes
1answer
1k views

404 status code for HTTP/2

How does a correct 404 status code look like on using HTTP/2 protocol? HTTP/1.1 404 Not Found seems to be for the previous protocol version, but I can't find anywhere something meaningful about status ...
1
vote
0answers
938 views

How to disable http method verb tunneling in nginx

Our security team ran a web-inspect security scan on our site and asked us to disable verb tunneling using headers or query parameters such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, ...
1
vote
0answers
171 views

Why is my Last-Modified header always sent using GMT timezone?

I want to send the last-modified in IST timezone, But it always sends in GMT. What is wrong with this PHP code? echo "Timezone " . date_default_timezone_get () ; //==>verified, timezone set ...
2
votes
1answer
80 views

How to pass requested domain to server when behind MaxCDN?

I have a bit of a problem getting our server to know what domain was requested to get to the server. The scenario is like this. site1.tld, site2.tld, site3.tld and site4.tld are all pointing to ...
10
votes
2answers
1k views

Why is “29030400” seconds used as a common value for cache expiration?

I noticed that 29030400 is used very often in the Expires directives for static files. Google recommends to cache this kind of files up to 1 year (1 month at least). I did the math: 29030400 seconds ...
1
vote
1answer
1k views

Apache Reverse Proxy Rewrite Remote_User

Running httpd 2.4.6 on CentOS 7 as a reverse proxy for Splunk with SSO. This works with no proxying: RewriteCond %{LA-U:REMOTE_USER} "user" [NC] RewriteRule ^.*$ - [F,L] The above does NOT work ...
2
votes
1answer
445 views

Is it OK for SEO to send a 200 status when I'm actually rewriting the request to a controller and then outputting content to a page dynamically?

After reading endless pages about redirects and best practice, I'm still unsure if what I'm doing here is good, bad, or indifferent as far as SEO is concerned. I have a table in a database that holds ...
2
votes
3answers
1k views

Why does Pingdom suggest that I add a “Vary: Accept-Encoding” header?

I have tried a tool to measure the speed of my web site. It is Pingdom https://tools.pingdom.com There is an answer I do not understand "The following publicly cacheable, compressible resources ...
1
vote
1answer
1k views

X-Frame-Options Enabling on GoDaddy

I am currently developing a website which runs on a GoDaddy Windows with Plesk hosting option. I am doing this as an experimental/learning site so I am trying to be as security conscious as possible ...
1
vote
0answers
29 views

Google Analytics stopped registering hits 10 minutes after implementing measurement protocol

I'm trying to implement google analytics on server-side. In order to (loosely) identify visitors, I'm generating an md5 based on IP and user-agent and send the result to Google for tracking the ...
6
votes
1answer
228 views

Is it feasible to use Vary: headers with If-none-match: to improve caching?

As we all know, sending a response header Vary: Some-Header causes (or should cause) caches to store different variants of the response, one for each value of Some-Header: it encounters in requests. ...
0
votes
3answers
68 views

Website <head> section questions

I've been doing some tidying up on my site recently and have been making some minor adjustments to the section of each page (primarily to cut out any potential duplication). However, I just have a ...
2
votes
1answer
210 views

Deleting many pages SEO check

I need to delete many pages (recipes) on my website because the recipes were made with products that don't exist any more. Links to those pages are all over social media so I can't just use a 410 ...
7
votes
1answer
437 views

How is HTTP 418 treated by Google and others as it is not a “real” error?

I was wondering if you know how Google and other search engines treat a website with HTTP status code 418 I'm a teapot. According to this Wikipedia article, it can be used as a client error code (...
1
vote
3answers
509 views

Does setting a Referrer-Policy header have any effect on non-HTML pages?

The Referrer-Policy header controls how much referrer information the browser exposes to a site when navigating to it. I understand the purpose of this header when set on HTML files; does it make ...
2
votes
2answers
892 views

CSP3 Report-To header implementation

Issue Many CSP validators like cspvalidator.org tell me that: A draft of the next version of CSP deprecates report-uri in favour of a new report-to directive. I found more information about ...
1
vote
1answer
835 views

When should I not to use page meta security headers

When should I not to use page meta security headers? For example, I configured the web server server-side with a powerful content security policy and other hardened security headers, but when review ...
0
votes
2answers
82 views

What is the proper response header when an address is not available but its parent is available and is displayed?

My website addresses has a hierarchy structure. When one page is requested, and it is not a valid address, it tries to find its parent, and if the later exists, it will show it. Now, my question is ...
1
vote
1answer
123 views

Access resources of secondary server running different port apache2

I'm currently running a main server from a raspberry pi (32 GB) and a secondary server (4 TB) running as the file storage server. Both servers are running Debian Linux with Apache2 installed. I've ...