HTTP Headers for nextjs.org

Responds with HTTP 200 OK from Vercel — 5 of 6 security headers present.

URL to Check
200 OKhttps://nextjs.org/
Security Headers5/6
HSTS
CSP
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy
All Response Headers (24)
age375
cache-controlpublic, max-age=0, must-revalidate
connectionclose
content-encodingbr
content-security-policydefault-src 'self' nextjs.org *.nextjs.org vercel.com *.vercel.com *.vercel.sh vercel.live wss://*.vercel.com wss://*.nextjs.org localhost:*;script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google.com www.google-analytics.com www.googleadservices.com www.gstatic.com *.youtube.com *.youtube-nocookie.com *.ytimg.com *.twimg.com cdn.ampproject.org www.googletagmanager.com *.googleapis.com *.fides-cdn.ethyca.com *.ethyca.com cdn.ethyca.com cdn.vercel-insights.com va.vercel-scripts.com app.cal.com *.cr-relay.com vercel.com *.vercel.com *.vercel.sh vercel.live nextjs.org *.nextjs.org localhost:* chrome-extension://*;child-src *.youtube.com *.youtube-nocookie.com *.stripe.com www.google.com td.doubleclick.net github.com calendly.com vercel.cal.com nextjs.org *.nextjs.org vercel.com *.vercel.com *.vercel.sh vercel.live wss://*.vercel.com wss://*.nextjs.org localhost:*;style-src 'self' 'unsafe-inline' *.googleapis.com nextjs.org *.nextjs.org vercel.com *.vercel.com *.vercel.sh vercel.live wss://*.vercel.com wss://*.nextjs.org localhost:*;img-src * blob: data:;media-src 'self' videos.ctfassets.net user-images.githubusercontent.com replicate.delivery *.public.blob.vercel-storage.com blob: data: nextjs.org *.nextjs.org vercel.com *.vercel.com *.vercel.sh vercel.live wss://*.vercel.com wss://*.nextjs.org localhost:*;connect-src 'self' data: vercel.com *.vercel.com *.vercel.sh vercel.live wss://*.vercel.com wss://*.nextjs.org nextjs.org *.nextjs.org localhost:* cdn.vercel-insights.com va.vercel-scripts.com cdp.vercel.com www.google-analytics.com www.googletagmanager.com *.googleapis.com *.cr-relay.com *.ethyca.com cdn.ethyca.com risk.clearbit.com *.ingest.sentry.io *.ingest.us.sentry.io *.public.blob.vercel-storage.com;font-src 'self' *.nextjs.org *.vercel.com *.gstatic.com vercel.live *.vercel.sh;worker-src 'self' *.nextjs.org *.vercel.com blob:
content-typetext/html; charset=utf-8
dateFri, 24 Apr 2026 08:02:34 GMT
feature-policyfullscreen 'self'; camera 'none'
link</_next/static/media/797e433ab948586e.p.3f30ggp2vw8zj.woff2?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/caa3a2e1cccd8315.p.400zotvijr2rn.woff2?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/logo-github-light.0j2vz9_zw2uex.svg?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="image", </_next/static/media/logo-github-dark.3cps0n_-l5sia.svg?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="image", </_next/static/media/logo-twitter-x-light.3lfl0ys_vh_gz.svg?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="image", </_next/static/media/logo-twitter-x-dark.2ms8a02663zmn.svg?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="image", </_next/static/media/logo-bluesky-light.0oj6yf53-gzbh.svg?dpl=dpl_BeyD2GDQUCeuew4FXAujJFmhtBkD>; rel=preload; as="image"
referrer-policyorigin-when-cross-origin
serverVercel
strict-transport-securitymax-age=31536000; includeSubDomains; preload
varyrsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
x-content-type-optionsnosniff
x-dns-prefetch-controlon
x-download-optionsnoopen
x-frame-optionsDENY
x-matched-path/home/none
x-nextjs-prerender1
x-nextjs-stale-time300
x-powered-byNext.js
x-vercel-cacheHIT
x-vercel-idcle1:iad1::cle1::v554x-1777025347808-07c52ea6a4b1
x-xss-protection0
Related
HTTP Headers for nextjs.org — Vercel | ProfileMyIP