HTTP Headers of emails.github.com: Response & Security Headers | OrbitProbe

HTTP headers of emails.github.com

Add to portfolio Watch for changes Open full report

Security headers

strict-transport-security: Missing
content-security-policy: Present
default-src 'self'; img-src 'self';script-src 'self' 'sha256-J+Y4l+yfxXd4cYzH9LhXUSHSb7zZu2bgddfCumVZJMo=';object-src 'none';form-action 'none';frame-src 'none';style-src 'self' 'sha256-OU0LTytxyR8kjQ+DRjRCDKhUAKEeH7rb0D5nBWOzRlQ='
x-content-type-options: Present
nosniff
x-frame-options: Present
SAMEORIGIN
referrer-policy: Present
strict-origin
permissions-policy: Not set (optional)

This is a presence check on one response. A present header does not prove its policy is strict, and other pages of the site may answer differently.

All response headers

200 · https://emails.github.com/

Header	Value
date	Sun, 20 Sep 2026 21:40:37 GMT
content-type	text/html;charset=UTF-8
transfer-encoding	chunked
connection	close
x-request-id	cf68c149adca8656
cache-control	private, no-cache, no-store, max-age=0

What this tool shows

OrbitProbe requests the home page over HTTPS, follows redirects and lists the headers of the final response exactly as the server sent them. Headers are how a server tells browsers and caches what to do: how long to keep a copy, whether the page may be framed, which scripts may run, and that the site must only be reached over HTTPS.

Cookie values are never displayed. A Set-Cookie header can carry a session identifier, so only the cookie name and its attributes (Secure, HttpOnly, SameSite, expiry) are shown. Those attributes are the part worth reviewing anyway.

HTTP header checker