Technical: what the server says HTTP · Security

Status code, redirects, headers and security. What the browser normally hides is here at a glance, with ready-made Apache code for the security headers.

1What is it?

The Technical section shows the HTTP status, the redirect chain, important response headers (Content-Type, cache, X-Robots-Tag), server software, IPv4 and IPv6, certificate and the security headers with a grade from A to F.

2Why it matters

A chain of three redirects costs time and ranking. An X-Robots-Tag: noindex in the header is invisible in the HTML and still removes the page from search. Missing security headers leave the page vulnerable.

3What TagSpion checks

4How to fix it

• Point redirects straight to the target, not via intermediate stops.
• Set security headers in .htaccess or the vHost. The ready-made block is available via "Fix".
• Test CSP in report-only mode first, otherwise it blocks your own scripts.

# .htaccess or vHost - security headers (grade A)
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  # Test CSP first with Content-Security-Policy-Report-Only
  Header always set Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'"
</IfModule>