What are HTTP Response Headers?

HTTP headers are key-value metadata fields transmitted in HTTP/1.1 (RFC 9110), HTTP/2 (RFC 9113), and HTTP/3 (RFC 9114) messages. Response headers control caching via RFC 9111, enforce security policies per W3C CSP Level 3, and define content negotiation following RFC 7231 content negotiation.

This analyzer performs real-time HTTP HEAD/GET requests to examine server response headers, identifying missing OWASP Secure Headers, misconfigured cache directives, and information disclosure vulnerabilities. Critical for PCI DSS compliance, penetration testing, and hardening web servers against CWE-693 protection bypass attacks. Verify your headers then check SSL/TLS certificates, test HTTP status codes, and analyze server IP geolocation.

Essential Security Headers (OWASP)

Security headers defend against XSS (Cross-Site Scripting), clickjacking, information disclosure (CWE-200), and protocol downgrade attacks. The OWASP Secure Headers Project defines critical HTTP response headers for defense-in-depth security:

Content-Security-Policy (CSP)

W3C CSP Level 3 mitigates CWE-79 XSS by whitelisting content sources

• default-src 'self' restricts origins
• script-src controls JavaScript sources
• report-uri enables violation monitoring
• Prevents inline scripts and eval() exploitation

Strict-Transport-Security (HSTS)

RFC 6797 enforces HTTPS preventing SSL stripping attacks

• max-age=31536000 (1 year minimum)
• includeSubDomains protects all subdomains
• preload enables HSTS preload list
• Prevents MitM downgrade to HTTP

Critical Security Headers Checklist

Headers required for OWASP WSTG compliance and passing securityheaders.com audit with A+ grade:

Header Name	Attack Mitigation	Example Value	Priority
X-Frame-Options	CWE-1021 clickjacking	DENY	Critical
X-Content-Type-Options	MIME-sniffing XSS	nosniff	Critical
Referrer-Policy	CWE-200 info disclosure	strict-origin-when-cross-origin	High
Permissions-Policy	Feature abuse (camera, geolocation)	geolocation=(), camera=()	Medium
Cross-Origin-Opener-Policy	Spectre/Meltdown isolation	same-origin	Medium
Cross-Origin-Embedder-Policy	Cross-origin resource isolation	require-corp	Medium

Testing tools: Validate header configurations with curl -I https://example.com, Mozilla Observatory, or SecurityHeaders.com. Automate scans with HTTP Observatory CLI. After securing headers, verify TLS certificate chain and test endpoint accessibility.

HTTP Caching Headers (RFC 9111)

HTTP caching, standardized in RFC 9111, controls browser/CDN caching reducing latency, bandwidth costs, and server load. Correct cache directives per RFC 9111 Section 5.2 improve Core Web Vitals (LCP, FID, CLS) for Google PageSpeed metrics. Misconfigured caching causes stale content, privacy leaks, or excessive origin requests.

Critical Caching Directives

Cache-Control (RFC 9111)

Primary caching directive per RFC 9111 Section 5.2.2 with granular cache policy control

max-age=31536000: Cache duration in seconds (1 year for immutable assets)
no-cache: Revalidate with origin via If-None-Match/If-Modified-Since
no-store: Never cache (sensitive data, banking sessions)
private vs public: Browser-only vs shared CDN caching
immutable: Asset never changes (content-hashed filenames)
stale-while-revalidate: Serve stale while fetching fresh copy

ETag (Entity Tag Validation)

RFC 9110 Section 8.8.3 conditional request identifier enabling 304 Not Modified responses

• Strong ETags: "33a64df551425fcc55e" (byte-perfect match)
• Weak ETags: W/"0815" (semantic equivalence)
• Sent with If-None-Match header for validation
• Reduces bandwidth for unchanged resources

Last-Modified & Expires

Legacy HTTP/1.0 caching per RFC 9110. Use Cache-Control instead for modern applications

Last-Modified: Timestamp sent with If-Modified-Since
Expires: Absolute expiration date (superseded by max-age)
• ETags preferred over timestamps (handles file restoration)

Cache optimization strategy: Use Cache-Control: max-age=31536000, immutable for versioned assets (app.abc123.js), no-cache for HTML, no-store for sensitive data. Test with REDbot cache analyzer or curl -I. Validate CDN behavior at edge locations using IP geolocation to identify PoP.

Server Information Disclosure Headers

Server identification headers leak technology stack details enabling targeted exploitation. CWE-200 (Information Exposure) and CWE-209 classify excessive info disclosure as security weakness. OWASP WSTG fingerprinting guidance recommends removing version numbers to prevent automated vulnerability scanners from targeting known CVEs.

Information Leakage Headers

Headers Exposing Technology Stack

Server: Apache/2.4.41 (Ubuntu) → Version enables NVD CVE lookup
X-Powered-By: PHP/7.4.3 → Reveals backend language/version
X-AspNet-Version: 4.0.30319 → .NET Framework fingerprinting
X-Generator: WordPress 6.2 → CMS identification for exploit databases
X-Runtime: 0.182453 → Timing attack vectors
Via: 1.1 varnish → Proxy/cache infrastructure mapping

Hardening Recommendations

• Apache: Set ServerTokens Prod and ServerSignature Off in httpd.conf
• Nginx: Use server_tokens off; to suppress version
• PHP: Set expose_php = Off in php.ini to remove X-Powered-By
• Express.js: Disable app.disable('x-powered-by')
• ASP.NET: Remove via web.config customHeaders or Global.asax
• Verify removal with curl -I or this analyzer

Security testing: Use Shodan or Censys to see what attackers discover about your infrastructure. Scan with Nmap http-headers script: nmap --script http-headers example.com. After header hardening, verify certificate configuration and test for proper status codes.

Content Negotiation and CORS Headers

Content Representation Headers

Content headers define payload characteristics per RFC 9110 Section 8.3 enabling content negotiation, compression, and proper MIME type handling for browsers and API clients:

HTTP Content Headers

Content-Type: IANA MIME type (e.g., application/json; charset=utf-8). Prevents CWE-430 MIME confusion
Content-Length: Payload size in bytes per RFC 9110. Enables HTTP pipelining and request smuggling detection
Content-Encoding: Compression algorithm (gzip, br Brotli, deflate). Reduces bandwidth 60-80%
Content-Language: ISO 639 language tag (e.g., en-US, fr-CA) for i18n/l10n
Content-Disposition: attachment; filename="report.pdf" triggers browser download

Cross-Origin Resource Sharing (CORS)

CORS, defined by WHATWG Fetch Standard, relaxes Same-Origin Policy (RFC 6454) for controlled cross-domain requests. Misconfigured CORS causes CWE-942 overly permissive CORS enabling data theft via XSS.

Public API CORS

Permissive configuration for open REST APIs

• Access-Control-Allow-Origin: *
• Access-Control-Allow-Methods: GET, POST, OPTIONS
• Access-Control-Allow-Headers: Content-Type, Authorization
• Access-Control-Max-Age: 86400

Use case: CDN assets, public GraphQL endpoints

Authenticated CORS

Restrictive config for credentialed requests

• Access-Control-Allow-Origin: https://app.example.com
• Access-Control-Allow-Credentials: true
• Access-Control-Allow-Methods: GET, POST, DELETE
• Vary: Origin

Use case: Banking APIs, admin dashboards

CORS security: Never use Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true—browsers reject this. Validate origin whitelist to prevent PortSwigger CORS attacks. Test preflight OPTIONS requests with curl -X OPTIONS -H "Origin: https://evil.com". Debug CORS errors using browser DevTools Network tab or HTTP status checker.

HTTP Headers Implementation Best Practices

Security Header Deployment Strategy

Deploy security headers following OWASP guidelines using phased rollout to prevent breaking production applications. Test with Content-Security-Policy-Report-Only before enforcement:

Phased Security Header Rollout

Audit Phase: Scan with SecurityHeaders.com, Mozilla Observatory. Baseline current grade (F → A+)
Policy Design: Define CSP directives with Report-URI CSP Builder. Start permissive, tighten incrementally
Report-Only Mode: Deploy Content-Security-Policy-Report-Only to monitor violations without breaking functionality. Analyze violation reports
Staging Validation: Test all security headers in non-production environment. Verify no regressions in critical user flows
Gradual Production: Deploy headers to 10% traffic via A/B testing, monitor error rates, expand to 100%
Continuous Monitoring: Track CSP violations, adjust policies, maintain compliance with PCI DSS requirements

Performance Optimization with HTTP/2 and HTTP/3

Optimize headers for modern protocols per HTTP/2 (RFC 9113) and HTTP/3 (RFC 9114 over QUIC):

Header Optimization Techniques

HTTP/2 HPACK compression: Reduces header overhead 85-95% via RFC 7541 HPACK static/dynamic table compression
HTTP/3 QPACK: RFC 9204 header compression for QUIC with out-of-order delivery tolerance
Remove redundant headers: Eliminate duplicate Set-Cookie, unnecessary X- custom headers. Audit with curl -I
Brotli compression: Enable Content-Encoding: br for 20% better compression than gzip on text assets
Vary header optimization: Use Vary: Accept-Encoding to enable CDN cache efficiency with compression variants
Connection: keep-alive: Reuse TCP connections reducing TLS handshake overhead (implicit in HTTP/2/3)

Performance measurement: Use PageSpeed Insights and WebPageTest to validate header optimization impact on Core Web Vitals. Monitor with Server-Timing header for backend metrics. Test compression with curl -H "Accept-Encoding: br,gzip" -I example.com.

Common HTTP Response Headers Reference

Based on analysis of top websites, here are the most frequently encountered HTTP response headers and their primary functions:

Header	Usage %	Primary Function
Content-Type	83.4%	Specifies media type of response
Date	83.3%	Response timestamp
Server	78.7%	Server software information
Set-Cookie	75.3%	Session and tracking cookies
Cache-Control	51.9%	Caching behavior control

HTTP Header Security Testing

Automated Security Header Testing

Integrate header validation into CI/CD pipelines using automated security scanners. Continuous compliance monitoring prevents regressions:

Security Header Audit Checklist

✓ Missing Headers: Identify absent OWASP required headers (CSP, HSTS, X-Frame-Options)
✓ Directive Validation: Verify CSP sources, HSTS max-age ≥ 31536000, X-Content-Type-Options: nosniff
✓ Info Disclosure: Remove Server, X-Powered-By versions. Test with curl -I or Nmap
✓ HTTPS Configuration: Validate HSTS with includeSubDomains, check SSL certificate with TLS 1.3
✓ CORS Policies: Test origin whitelist, validate credentialed request handling per Fetch Standard

CDN and Edge Computing Headers

CDN Identification and Cache Headers

CDN providers inject custom headers revealing caching behavior, edge locations, and request routing. Analyze these for performance debugging and cache optimization:

CDN-Specific Response Headers

CF-RAY: Cloudflare request ID (e.g., 8b3f2a1c6d4e5f7a-SJC). Correlate with edge logs, identify PoP datacenter
X-Cache: Cache status (HIT, MISS, STALE). Used by Fastly, Varnish, Apache Traffic Server
X-Amz-Cf-Pop: AWS CloudFront edge location code (e.g., IAD89-P2 = Virginia datacenter). Map with IP geolocation
X-Amz-Cf-Id: CloudFront request ID for AWS support tickets and CloudWatch correlation
Via: RFC 9110 proxy chain (e.g., 1.1 varnish (Varnish/6.0)). Reveals intermediary proxies/load balancers
X-Varnish: Varnish Cache request ID and age. Format: 98765 12345 (current age, original)
X-Served-By: Hostname of edge server serving response. Useful for debugging specific cache nodes
Age: RFC 9111 time in seconds since origin response. Indicates cache freshness

Performance Monitoring Headers

Modern applications expose backend timing metrics via W3C Server-Timing API enabling Real User Monitoring (RUM) and performance profiling:

Performance Instrumentation Headers

Server-Timing: db;dur=53, app;dur=47.2. Exposes database query time, application processing duration visible in Chrome DevTools Network tab
X-Runtime: Total backend execution time in seconds (e.g., 0.182453). Common in Rails applications
X-Request-Id: Distributed tracing correlation ID. Link frontend errors to backend logs using tools like Datadog, Sentry
X-Response-Time: Similar to X-Runtime, millisecond precision application response time
Timing-Allow-Origin: W3C Resource Timing CORS enabler for cross-origin performance data access

Performance analysis: Monitor Server-Timing metrics in browser Performance API: performance.getEntriesByType("navigation")[0].serverTiming. Track cache hit rates by analyzing X-Cache headers. Test CDN routing with IP geolocation from different regions, validate edge server responses.

Related Network Tools

Complement HTTP header analysis with comprehensive network security and performance diagnostic tools:

HTTP Headers Analyzer

Analyze Website Headers

Security Headers

Content-Security-Policy

Strict-Transport-Security

X-Frame-Options

X-Content-Type-Options

Referrer-Policy