HTTP security headers API

{
  "query": {
    "url": "https://github.com/",
    "ua": "chrome"
  },
  "finalUrl": "https://github.com/",
  "finalStatus": 200,
  "redirects": 0,
  "httpVersion": "1.1",
  "http2": true,
  "http3": false,
  "headersExact": true,
  "headerCount": 20,
  "headers": [
    {
      "name": "Date",
      "value": "Sun, 25 Oct 2026 08:13:40 GMT"
    },
    {
      "name": "Content-Type",
      "value": "text/html; charset=utf-8"
    },
    {
      "name": "Vary",
      "value": "X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Accept-Language, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With"
    },
    {
      "name": "content-language",
      "value": "en-US"
    },
    {
      "name": "ETag",
      "value": "W/\"73f87ca5b67703b238ecb2e0d277aac4\""
    },
    {
      "name": "Cache-Control",
      "value": "max-age=0, private, must-revalidate"
    },
    {
      "name": "Strict-Transport-Security",
      "value": "max-age=31536000; includeSubdomains; preload"
    },
    {
      "name": "X-Frame-Options",
      "value": "deny"
    },
    {
      "name": "X-Content-Type-Options",
      "value": "nosniff"
    },
    {
      "name": "X-XSS-Protection",
      "value": "0"
    },
    {
      "name": "Referrer-Policy",
      "value": "origin-when-cross-origin, strict-origin-when-cross-origin"
    },
    {
      "name": "Content-Security-Policy",
      "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com wss://production-copilot-host-centralus.webpubsub.azure.com wss://production-copilot-host-centralus-02.webpubsub.azure.com wss://production-copilot-host-westus.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-6AKuI+cDd1MoUL1u4eqrA9PXmnPAkOB4h7421hPUUm0='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/"
    },
    {
      "name": "Server",
      "value": "github.com"
    },
    {
      "name": "Accept-Ranges",
      "value": "bytes"
    },
    {
      "name": "Set-Cookie",
      "value": "_gh_sess=‹…›; path=/; HttpOnly; secure; SameSite=Lax"
    },
    {
      "name": "Set-Cookie",
      "value": "_octo=‹…›; expires=Mon, 25 Oct 2027 08:13:49 GMT; domain=.github.com; path=/; secure; SameSite=Lax"
    },
    {
      "name": "Set-Cookie",
      "value": "logged_in=‹…›; expires=Mon, 25 Oct 2027 08:13:49 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax"
    },
    {
      "name": "X-GitHub-Request-Id",
      "value": "2F4C:10C7C1:118181:1A2B78:6ADDBA3D"
    },
    {
      "name": "x-github-edge-region",
      "value": "centralindia"
    },
    {
      "name": "Transfer-Encoding",
      "value": "chunked"
    }
  ],
  "grade": {
    "letter": "A+",
    "score": 115,
    "graded": true,
    "notGradedReason": null,
    "provisional": [],
    "testsPassed": 11,
    "testsFailed": 1,
    "basis": "mdn-http-observatory 1.7.1 (algorithm 6)"
  },
  "tests": [
    {
      "id": "content-security-policy",
      "name": "Content-Security-Policy",
      "result": "csp-implemented-with-unsafe-inline-in-style-src-only",
      "summary": "set; 'unsafe-inline' only in style-src",
      "pass": true,
      "modifier": 0,
      "evidence": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob…",
      "fix": "Remove `'unsafe-inline'` from style-src too, for the last 5 points."
    },
    {
      "id": "cookies",
      "name": "Cookies",
      "result": "cookies-secure-with-httponly-sessions-and-samesite",
      "summary": "all Secure, sessions HttpOnly, SameSite set",
      "pass": true,
      "modifier": 5,
      "evidence": "_gh_sess; Secure; HttpOnly; SameSite=lax | _octo; Secure; SameSite=lax | logged_in; Secure; HttpOnly; SameSite=lax",
      "fix": null
    },
    {
      "id": "cross-origin-embedder-policy",
      "name": "Cross-Origin-Embedder-Policy",
      "result": "coep-not-implemented",
      "summary": "not sent",
      "pass": true,
      "modifier": 0,
      "evidence": null,
      "fix": "Send `Cross-Origin-Embedder-Policy: require-corp` (or credentialless) once embedded content allows it."
    },
    {
      "id": "cross-origin-opener-policy",
      "name": "Cross-Origin-Opener-Policy",
      "result": "coop-not-implemented",
      "summary": "not sent",
      "pass": true,
      "modifier": 0,
      "evidence": null,
      "fix": "Send `Cross-Origin-Opener-Policy: same-origin`."
    },
    {
      "id": "cross-origin-resource-sharing",
      "name": "Cross-Origin Resource Sharing",
      "result": "cross-origin-resource-sharing-not-implemented",
      "summary": "no CORS headers",
      "pass": true,
      "modifier": 0,
      "evidence": null,
      "fix": null
    },
    {
      "id": "redirection",
      "name": "Redirection to HTTPS",
      "result": "redirection-all-redirects-preloaded",
      "summary": "every hop on the HSTS preload list",
      "pass": true,
      "modifier": 0,
      "evidence": "http://github.com/ → https://github.com/",
      "fix": null
    },
    {
      "id": "referrer-policy",
      "name": "Referrer-Policy",
      "result": "referrer-policy-private",
      "summary": "a private value",
      "pass": true,
      "modifier": 5,
      "evidence": "origin-when-cross-origin, strict-origin-when-cross-origin",
      "fix": null
    },
    {
      "id": "strict-transport-security",
      "name": "Strict-Transport-Security",
      "result": "hsts-preloaded",
      "summary": "on the preload list",
      "pass": true,
      "modifier": 5,
      "evidence": "max-age=31536000; includeSubdomains; preload",
      "fix": null
    },
    {
      "id": "subresource-integrity",
      "name": "Subresource Integrity",
      "result": "sri-not-implemented-but-external-scripts-loaded-securely",
      "summary": "external scripts over HTTPS, no integrity=",
      "pass": false,
      "modifier": -5,
      "evidence": "https://github.githubassets.com/assets/high-contrast-cookie-141c17800ca6ba23.js | https://github.githubassets.com/assets/environment-9c4682c5715f3b80.js | https://github.githubassets.com/assets/github-elements-3b31060462951f7e.js | https://github.githubassets.com/assets/element-registry-8f2242d8ab39e777.js | https://github.githubassets.com/assets/behaviors-aae3017816009922.js | https://github.githubassets.com/assets/marketing-essentials-15557679ec4049c8.js | https://github.githubassets.com/assets/landing-pages-b8f11f093a587ea8.js | https://github.githubassets.com/assets/global-banner-disable-750ad87f36b8e45f.js",
      "fix": "Add `integrity=\"sha384-…\" crossorigin=\"anonymous\"` to each external script: a page change, not a header."
    },
    {
      "id": "x-content-type-options",
      "name": "X-Content-Type-Options",
      "result": "x-content-type-options-nosniff",
      "summary": "nosniff",
      "pass": true,
      "modifier": 0,
      "evidence": "nosniff",
      "fix": null
    },
    {
      "id": "x-frame-options",
      "name": "X-Frame-Options",
      "result": "x-frame-options-implemented-via-csp",
      "summary": "via CSP frame-ancestors",
      "pass": true,
      "modifier": 5,
      "evidence": "frame-ancestors 'none'",
      "fix": null
    },
    {
      "id": "cross-origin-resource-policy",
      "name": "Cross-Origin-Resource-Policy",
      "result": "corp-not-implemented",
      "summary": "not sent",
      "pass": true,
      "modifier": 0,
      "evidence": null,
      "fix": "Send `Cross-Origin-Resource-Policy: same-origin` (same-site if your subdomains embed it)."
    }
  ],
  "hstsPreload": {
    "status": "preloaded",
    "preloadedBy": null
  },
  "software": [
    {
      "id": "github",
      "name": "GitHub",
      "version": null,
      "header": "server"
    }
  ],
  "cookies": [
    {
      "name": "_gh_sess",
      "host": "github.com",
      "secure": true,
      "httpOnly": true,
      "sameSite": "lax",
      "partitioned": false,
      "path": "/",
      "domain": null,
      "maxAge": null,
      "valueLength": 354,
      "problems": []
    },
    {
      "name": "_octo",
      "host": "github.com",
      "secure": true,
      "httpOnly": false,
      "sameSite": "lax",
      "partitioned": false,
      "path": "/",
      "domain": "github.com",
      "maxAge": 31535999,
      "valueLength": 26,
      "problems": []
    },
    {
      "name": "logged_in",
      "host": "github.com",
      "secure": true,
      "httpOnly": true,
      "sameSite": "lax",
      "partitioned": false,
      "path": "/",
      "domain": "github.com",
      "maxAge": 31535999,
      "valueLength": 2,
      "problems": []
    }
  ],
  "issues": [
    {
      "severity": "warning",
      "code": "sri_not_implemented_but_external_scripts_loaded_securely",
      "message": "Subresource Integrity: external scripts over HTTPS, no integrity= (-5). Add `integrity=\"sha384-…\" crossorigin=\"anonymous\"` to each external script: a page change, not a header."
    },
    {
      "severity": "info",
      "code": "permissions_policy_missing",
      "message": "No Permissions-Policy. Not scored; only Chromium browsers read it, where it can switch off the camera, microphone and location for embedded content."
    }
  ],
  "tookMs": 963
}