What response headers are
Every time a browser asks for a page, the server answers with a status line and a set of headers before it sends any content. They are instructions for the browser, and you normally never see them.
Headers say what kind of file is coming, how long it may be kept, whether the visitor should go somewhere else, and what the page is allowed to do. When a site behaves oddly, such as an old version that keeps showing, a login that loops or a download that opens as text, the cause is usually visible here. A HEAD request asks for the headers only. GET asks for the whole page, the way a browser does. Most servers answer both the same way, but some refuse HEAD, so switch to GET if the result looks wrong.
Reading the status code
The first digit tells you the family: 2xx worked, 3xx points somewhere else, 4xx means the request was the problem, 5xx means the server was.
| Code | Name | What it means |
|---|---|---|
| 200 | OK | The page was served normally |
| 301 / 308 | Permanent redirect | The address has moved for good. Browsers and search engines remember it |
| 302 / 307 | Temporary redirect | Go elsewhere this time, but keep using the original address |
| 304 | Not Modified | The cached copy is still good, so no content was sent |
| 401 / 403 | Unauthorized / Forbidden | A login is needed, or the server refuses this visitor |
| 404 | Not Found | Nothing lives at this address. Check the link for typing errors |
| 500 | Internal Server Error | The site's own code failed. The server's error log has the reason |
| 502 / 503 / 504 | Gateway and availability errors | A proxy or CDN could not get an answer from the server behind it, or the server is overloaded or down for maintenance |
Caching headers
- Cache-Control sets the rules.
max-age=3600allows reuse for an hour,no-cachemeans check with the server before each reuse, andno-storemeans never keep a copy. - ETag and Last-Modified identify a version of the file. The browser sends them back on the next visit, and the server replies 304 if nothing changed.
- Age shows how many seconds a copy has sat in a shared cache. If it is present, a CDN or proxy answered, not the origin server.
- Expires is the older way to set a lifetime. It is ignored when
max-ageis present.
The redirect chain
Each redirect is a full round trip before anything loads, so short chains are faster. The most important hop is from http:// to https://. Without it, visitors who type the bare name stay on an unencrypted connection that anyone on the same network can read or alter. A good setup gets from http://example.com to the final secure address in one or two hops, with a 301 so browsers remember it. A chain that returns to an address it has already visited is a loop, and browsers give up on it with a "too many redirects" error.
Security headers
The checklist looks for six headers that tell browsers to be stricter with your pages. Strict-Transport-Security closes the gap the first redirect leaves open: after one secure visit, the browser goes straight to HTTPS without asking. Content-Security-Policy is the most capable of the six and takes the most care to set up, because a wrong policy blocks your own scripts. Its frame-ancestors rule replaces the older X-Frame-Options, so either one passes the framing check. A missing header is not a vulnerability by itself. Each one removes a class of attack for the cost of one line of server configuration. Headers can differ from page to page, so check the pages that matter, such as the login form.