HTTP Headers of bbcidentity.id.training.tools.bbc.co.uk: Response & Security Headers | OrbitProbe

HTTP headers of bbcidentity.id.training.tools.bbc.co.uk

Add to portfolio Watch for changes Open full report

Security headers

strict-transport-security: Present
max-age=31536000; includeSubDomains
content-security-policy: Present
default-src 'self';script-src 'self';frame-ancestors https://som-myit.onbmc.com https://*.bbc.co.uk https://portal.bbcstudios.cloud https://*.bbcsap.co.uk
x-content-type-options: Present
nosniff
x-frame-options: Present
ALLOW-FROM https://som-myit.onbmc.com
referrer-policy: Present
no-referrer
permissions-policy: Not set (optional)

This is a presence check on one response. A present header does not prove its policy is strict, and other pages of the site may answer differently.

All response headers

200 · https://bbclogin.id.training.tools.bbc.co.uk/

Header	Value
accept-ranges	bytes
cache-control	public, max-age=0
content-security-policy	default-src 'self';script-src 'self';frame-ancestors https://som-myit.onbmc.com https://.bbc.co.uk https://portal.bbcstudios.cloud https://.bbcsap.co.uk
content-type	text/html; charset=utf-8
cross-origin-opener-policy	same-origin
cross-origin-resource-policy	same-origin

What this tool shows

OrbitProbe requests the home page over HTTPS, follows redirects and lists the headers of the final response exactly as the server sent them. Headers are how a server tells browsers and caches what to do: how long to keep a copy, whether the page may be framed, which scripts may run, and that the site must only be reached over HTTPS.

Cookie values are never displayed. A Set-Cookie header can carry a session identifier, so only the cookie name and its attributes (Secure, HttpOnly, SameSite, expiry) are shown. Those attributes are the part worth reviewing anyway.

HTTP header checker