HTTP Response Headers Inspector
Check HTTP status codes (200, 301, 404), server technologies, compression, and security headers (CSP, HSTS).
HTTP Response for nytimes.com
HTTP/1.1 403 Forbidden| Header Field | Value |
|---|---|
| Status | HTTP/1.1 403 Forbidden |
| Connection | close, close |
| Content-Length | 0, 774 |
| Server | Varnish |
| Retry-After | 0 |
| trace | fastly_error_code=770 |
| Location | https://www.nytimes.com/ |
| Accept-Ranges | bytes |
| Date | Sun, 04 Oct 2026 11:20:43 GMT, Sun, 04 Oct 2026 11:20:43 GMT |
| X-Served-By | cache-del-vibw2260034-DEL, cache-del-vibw2260020-DEL, cache-del-vibw2260020-DEL, cache-del-vibw2260020-DEL |
| X-Cache | HIT, MISS, MISS |
| X-Cache-Hits | 0, 0, 0 |
| Set-Cookie | nyt-gdpr=0; Expires=Sun, 04 Oct 2026 17:20:43 GMT; Path=/; Domain=.nytimes.com, datadome=0; Domain=.nytimes.com; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT; SameSite=Lax; Secure, nyt-a=s_HzAJgVCwkKTSHcisX8t4; Expires=Mon, 04 Oct 2027 11:20:43 GMT; Path=/; Domain=.nytimes.com; SameSite=none; Secure, nyt-gdpr=0; Expires=Sun, 04 Oct 2026 17:20:43 GMT; Path=/; Domain=.nytimes.com, nyt-purr=cfhhenahhudlhulssdds2fdndd; Expires=Mon, 04 Oct 2027 11:20:43 GMT; Path=/; Domain=.nytimes.com; SameSite=Lax; Secure, nyt-geo=IN; Expires=Sun, 04 Oct 2026 17:20:43 GMT; Path=/; Domain=.nytimes.com, nyt.et.dd=iv=607B5EA3481F47DB98AE73F724AB0E7A&val=va37Vrjl/PMMHuFmzs72ytbjTaTYSwifdm3SfHUgHLPrLh/ePOgbdplrJr8Mg5AlUzfrvKzKn8IBx8VV/xlS5EcIPYHgGFyQnH7fDdGW9Ftz3EMTI5QVX2kiadRDS7S7dEOhHjfz14DlCglgFOG37ThdDI+aYCc3iUp8i/mDmXTz6/EDUw62lfdfOCWixJeYACmJI/YMPr11zvXjTcxzndXkf0jJPzlplwUrChCRewSFVPyeQ5JYVY40LHabN5Xv6QaKmRftRSSbPSZlmyL5vOEYIWA72q9TKtiX3JrRQtqhqnKK8TWEfSV4HwVgy5MtZocpk0H7o3v2ZjRIqCD7/A==; Max-Age=60; Path=/; Domain=.nytimes.com; SameSite=none; Secure, datadome=0; Domain=.nytimes.com; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT; SameSite=Lax; Secure, nyt-s-present=0; Path=/; Domain=.nytimes.com; Expires=Sun, 04 Oct 2026 11:20:46 GMT, nyt-traceid=000000000000000048e9767b31439447; Path=/; Domain=.nytimes.com; SameSite=none; Secure |
| x-gdpr | 0, 0 |
| Permissions-Policy | browsing-topics=(), browsing-topics=() |
| X-Frame-Options | DENY, DENY |
| X-API-Version | F-0, F-X |
| Content-Security-Policy | upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https: nytresource:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: nytresource:; style-src data: 'unsafe-inline' https: nytresource:; img-src data: https: blob: android-webview-video-poster: nytresource:; font-src data: https: nytresource:; connect-src data: https: wss: blob: nytresource:; media-src data: https: blob: nytresource:; object-src https:; child-src https: data: blob: nytresource:; form-action https: nytimes: nytcooking: nytxwd:; report-uri https://csp.nytimes.com/report;, upgrade-insecure-requests; default-src data: 'unsafe-inline' 'unsafe-eval' https: nytresource:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob: nytresource:; style-src data: 'unsafe-inline' https: nytresource:; img-src data: https: blob: android-webview-video-poster: nytresource:; font-src data: https: nytresource:; connect-src data: https: wss: blob: nytresource:; media-src data: https: blob: nytresource:; object-src https:; child-src https: data: blob: nytresource:; form-action https: nytimes: nytcooking: nytxwd:; report-uri https://csp.nytimes.com/report; |
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload |
| Access-Control-Expose-Headers | X-Nyt-Mktg-Group, X-Nyt-Mktg-Group |
| x-nyt-mktg-group | group8, group8 |
| x-nyt-edge-cache | HIT, MISS |
| x-nyt-app-webview | 0, 0 |
| x-nyt-app-map | webview=false,preloaded=false,service-worker-enabled=false, webview=false,preloaded=false,service-worker-enabled=false |
| Access-Control-Allow-Headers | traceparent, tracestate, X-B3-Sampled, X-B3-SpanId, X-B3-TraceId, x-datadog-origin, x-datadog-parent-id, x-datadog-sampling-priority, x-datadog-trace-id, x-nyt-entitlements, x-nyt-internal-meter-override, traceparent, tracestate, X-B3-Sampled, X-B3-SpanId, X-B3-TraceId, x-datadog-origin, x-datadog-parent-id, x-datadog-sampling-priority, x-datadog-trace-id, x-nyt-entitlements, x-nyt-internal-meter-override |
| server | DataDome |
| pragma | no-cache |
| x-datadome | protected |
| x-timer | S1791112844.970987,VS0,VE4 |
| content-type | text/html;charset=utf-8 |
| cache-control | max-age=0, private, no-cache, no-store, must-revalidate |
| accept-ch | Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory,Sec-CH-UA-Platform-Version |
| x-datadome-cid | AHrlqAAAAAMAKXOZqgFHNNUAZ9Idyg== |
| accept-ranges | bytes |
| charset | utf-8 |
| x-dd-b | 259 |
| x-datadome-riskscore | 0.9930074875394097 |
| set-cookie | datadome=H6rt2F1brHVk6nxohuLvDc~GzmMEfGW6Ps3G6_M0u_OPUuYDNmFHfAgkAKKaj2MApWoHLbjX_WQ6enDgBbDmFg6A1G6CNvAI0poPQlrcKtsQE53uIJSYSoy1u7LUa8Iw; Max-Age=31536000; Domain=www.nytimes.com; Path=/; Secure; SameSite=Lax |
| x-datadome-timer | S1791112844.956168,VS0,VE18 |
| X-Origin-Time | 2026-10-04 11:20:43 UTC |
| Vary | Fastly-SSL |
| x-nyt-route | homepage |