HTTP Headers Analysis for https://staging.bestpractices.dev

Detected Technologies from Headers

See all in URL Inspect 5

GitHub

Gravatar

Fastly

Heroku

Varnish

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=300

Content-Security-Policy

Strong

default-src; base-uri; form-action; +5 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Excellent

DENY

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

no-referrer-when-downgrade

Permissions-Policy

Present

fullscreen=(), geolocation=(), midi=(); +10 more

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains

Performance Headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Vary

Performance

Accept-Encoding

accept-ranges: bytes
connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

private, no-store

Etag

Caching

W/"327d70ba555fc8a9f22a64a8859fbdb7"

cache-control: private, no-store
etag: W/"327d70ba555fc8a9f22a64a8859fbdb7"

Content Headers

Content-Length

Content

20794

Content-Type

Content

text/html; charset=utf-8

content-length: 20794
content-type: text/html; charset=utf-8

Server Headers

Server

Heroku

X-Runtime

Server

0.006506

server: Heroku
x-runtime: 0.006506

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _BadgeApp_session=GiqeC3mZZn6oGKcYN0TtW1vmzOczdvpEnHRr3Ix2cSNjftDIXFscmSiVBwLYGXfBYCnUxMXO3yZQjCABxlbfwHuokpnPY83phZ0hkv7iC1liVJ95zh%2FOyw8VKZuu0nIJSmw9Oqt9%2BpnrIHpI3X%2BlDWiGxcNAORM6AYIlfd5qwqKgTSniwNL2aQGAeKruol0S%2BOq9HOQxdR%2Bq4xr6Pv18yloCNrV3zpxnXuptevvx%2F8HBtAU%2B8%2F%2B5b9p2wSWAoVC89WSFmd5krG7RUxMcsvzLbjiIk3OWsTBReg%3D%3D--IpPd84nv4uPoWNkj--XcszisgP3b%2FF9wAvXhcC%2Fw%3D%3D; path=/; secure; httponly; samesite=lax

Other Headers

Date

Other

Sun, 26 Apr 2026 20:07:12 GMT

Feature-Policy

Other

fullscreen 'none'; geolocation 'none'; midi 'none';notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none';camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none';vibrate 'none'; payment 'none'

Nel

Other

Report-To Group heroku-nel max-age: 1h

success: 1.0% failure: 10.0%

Report-To

Other

Group heroku-nel max-age: 1h

Endpoint 1 https://nel.heroku.com/reports?s=ZOLyZ3TzCQpysBTaKHPEjvgjtnhB47FSckQuWiVGD6A%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1777234032

Reporting-Endpoints

Other

heroku-nel="https://nel.heroku.com/reports?s=ZOLyZ3TzCQpysBTaKHPEjvgjtnhB47FSckQuWiVGD6A%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1777234032"

Via

Other

1.1 heroku-router, 1.1 varnish

X-Cache

Other

MISS

X-Cache-Hits

Other

0

X-Download-Options

Other

noopen

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

461b5653-12b3-f187-e229-8aa2a55bbf94

X-Served-By

Other

cache-nyc-kteb1890086-NYC

X-Timer

Other

S1777234032.227724,VS0,VE51

date: Sun, 26 Apr 2026 20:07:12 GMT
feature-policy: fullscreen 'none'; geolocation 'none'; midi 'none';notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none';camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none';vibrate 'none'; payment 'none'
nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
report-to: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=ZOLyZ3TzCQpysBTaKHPEjvgjtnhB47FSckQuWiVGD6A%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1777234032"}],"max_age":3600}
reporting-endpoints: heroku-nel="https://nel.heroku.com/reports?s=ZOLyZ3TzCQpysBTaKHPEjvgjtnhB47FSckQuWiVGD6A%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1777234032"
via: 1.1 heroku-router, 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-request-id: 461b5653-12b3-f187-e229-8aa2a55bbf94
x-served-by: cache-nyc-kteb1890086-NYC
x-timer: S1777234032.227724,VS0,VE51

Recommendations

Enable compression (gzip/brotli) to improve performance