HTTP Headers Analysis for https://www-int.uio.no

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31536000

Content-Security-Policy

Weak

frame-ancestors; upgrade-insecure-requests; object-src

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Present

fullscreen=(self "https://*.uio.no" "https://*.youtube.com" "https://uio.cloud.panopto.eu"), picture-in-picture=(self "https://*.uio.no" "https://uio.cloud.panopto.eu"), interest-cohort=(), browsing-topics=(), join-ad-interest-group=(), run-ad-auction=(), conversion-measurement=(), accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), layout-animations=(self), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), oversized-images=(self), payment=(), publickey-credentials-create=(self), publickey-credentials-get=(), speaker-selection=(), sync-xhr=(), unoptimized-images=(self), unsized-media=(self), usb=(), screen-wake-lock=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), hid=(), serial=(), cross-origin-isolated=(), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), keyboard-map=(), navigation-override=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), otp-credentials=(), window-management=(), storage-access=()

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Significantly strengthen CSP directives

Performance Headers

2 headers

Accept-Ranges

Performance

bytes

Vary

Performance

Cookie, Origin, Accept-Encoding

Caching Headers

2 headers

Age

Caching

94

Cache-Control

Caching

max-age=300

Content Headers

2 headers

Content-Length

Content

50685

Content-Type

Content

text/html;charset=utf-8

Server Headers

1 headers

Server

nginx

CORS Headers

0 headers

No CORS headers found

Cookies Headers

0 headers

No cookies headers found

Other Headers

8 headers

Date

Other

Sun, 23 Nov 2025 23:36:49 GMT

Origin-Agent-Cluster

Other

?1

Uio-Cache-Status

Other

MISS

Via

Other

1.1 varnish (Varnish

X-Cacheable

Other

YES

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Permitted-Cross-Domain-Policies

Other

none

Recommendations

Enable compression (gzip/brotli) to improve performance