HTTP Headers Analysis for https://www.hex.pm

Detected Technologies from Headers

See all in URL Inspect 7

Gravatar

Asciinema

Cowboy

Google Fonts

hCaptcha

Sentry

Stripe

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31536000

Content-Security-Policy

Strong

base-uri; report-uri; script-src; +10 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Vary

Performance

accept-encoding

connection: close
vary: accept-encoding

Caching Headers

Cache-Control

Caching

max-age=0, private, must-revalidate

cache-control: max-age=0, private, must-revalidate

Content Headers

Content-Length

Content

32001

Content-Type

Content

text/html; charset=utf-8

content-length: 32001
content-type: text/html; charset=utf-8

Server Headers

Server

Cowboy

server: Cowboy

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _hexpm_key=185600670++q2ti-y06Q5xWlYD5Az4YJDOuTSA8_wqMOu0dOP4G_QM=; path=/; expires=Mon, 20 Apr 2026 08:39:09 GMT; max-age=2592000; secure; HttpOnly

Other Headers

Alt-Svc

Other

h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Date

Other

Sat, 21 Mar 2026 08:39:08 GMT

Report-To

Other

Group csp-endpoint max-age: 18w

Endpoint 1 https://o4508469207040000.ingest.us.sentry.io/api/4508474076758016/security/?sentry_key=c8465d3ef299e77266c567d3d790d3a3

Reporting-Endpoints

Other

csp-endpoint="https://o4508469207040000.ingest.us.sentry.io/api/4508474076758016/security/?sentry_key=c8465d3ef299e77266c567d3d790d3a3"

Via

Other

1.1 google

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

GJ7OfzL0F079OpYBnjYC

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 21 Mar 2026 08:39:08 GMT
report-to: {"endpoints":[{"url":"https://o4508469207040000.ingest.us.sentry.io/api/4508474076758016/security/?sentry_key=c8465d3ef299e77266c567d3d790d3a3"}],"group":"csp-endpoint","include_subdomains":true,"max_age":10886400}
reporting-endpoints: csp-endpoint="https://o4508469207040000.ingest.us.sentry.io/api/4508474076758016/security/?sentry_key=c8465d3ef299e77266c567d3d790d3a3"
via: 1.1 google
x-permitted-cross-domain-policies: none
x-request-id: GJ7OfzL0F079OpYBnjYC

Recommendations

Enable compression (gzip/brotli) to improve performance