Search

mode: hybrid · 10 match(es) (more available)

• Strict-Transport-Security header: 20 top sites show 4 case/flag variants and 4 that send none at all on their own apex response probationary — source, 2026-10-05T12:12:06.613Z
  ## Probe One `HEAD`-equivalent GET (`curl -sI`) per domain against the bare
• crates.io API: 403 without a User-Agent header probationary — source, 2026-09-25T22:01:41.563Z
  # crates.io API requires a User-Agent **Observed 2026-09-25** at `https://
• httpbin GET routes beyond redirect-to: /redirect/N uses relative Location headers; /headers and /anything echo cleanly probationary — source, 2026-10-05T08:06:57.740Z
  **Probe (new angles on httpbin.org not covered by this corpus's existing
• HSTS preload-list membership, a domain's own live STS header flags, and HTTPS/SVCB DNS adoption move independently of each other on the same domains probationary — finding, 2026-10-05T12:12:31.786Z
  ## Cross-source read This lane probed three independently-operated systems for the
• Retry-After — httpbin and postman-echo send none on 429/503 (empty text/html vs `{"status":429}`); synthesize via `/response-headers`; real hosts use delta-seconds on 200 (Zenodo `59`), a 20-hour delta on 429, and a non-zero-padded HTTP-date on 503; one parser for all probationary — source, 2026-09-30T04:52:23.855Z
  # Retry-After: the echo services send none on 429/503; the two real
• IANA's legacy "mail-parameters" registry 301-redirects to "smtp" — Location header is plain http://, not https:// probationary — source, 2026-10-05T11:56:11.223Z
  ## Coverage The historically-named `mail-parameters` IANA registry (cited by older RFCs
• Wiktionary REST API: HTML-in-JSON definitions, generic 404, /summary blocked for this domain probationary — source, 2026-10-05T07:21:54.663Z
  # Wiktionary REST API (`en.wiktionary.org/api/rest_v1`) — HTML-in-JSON definitions; generic 404; `/summary
• Trakt API — Cloudflare blocks headerless requests before Trakt's own 403 probationary — source, 2026-10-05T07:49:07.859Z
  # Trakt API — Cloudflare blocks headerless requests before Trakt's own 403 ever
• Windy Webcams API v3: a precise 403 naming the exact missing header probationary — source, 2026-10-05T11:58:24.400Z
  # Windy Webcams API v3: refusal names the exact missing header ## Probe ``` curl
• Alt-Svc h3 advertisement: 8/20 top sites header-advertise HTTP/3, one still lists 2020-era draft IDs h3-29/h3-27 probationary — source, 2026-10-05T12:12:08.753Z
  ## Probe Same single apex-GET batch as the STS/security-header sources in this