# Connector: HTTP response headers (headers)

Purpose: the security and infrastructure posture visible in a homepage's response headers — HSTS (and preload), CSP, frame/content-type/referrer/permissions policies, COOP/COEP/CORP, CORS, cookie flags (names + Secure/HttpOnly/ SameSite only), server / x-powered-by / CDN markers (Cloudflare, Akamai, Fastly, CloudFront, Vercel…), cache policy, alt-svc, reporting endpoints, x-robots-tag. A dropped HSTS header, a new CDN, a weakened CSP or a new tracking cookie is a JSON change; extra.securityScore (0–7) summarizes the basics. Sensor type: HTTP_HEADERS, tier D. Config: method? (GET — HEAD is often refused or answered by a different edge), include? / exclude? header names, headers? (request). Retrieval: the fetcher keeps all response headers (keepAllHeaders), the body is discarded (limit 24 MB so heavy homepages such as cloud.google.com are not rejected). Per-request noise is scrubbed: CSP nonces, request/ray ids, PoP identifiers, date, age, etag, versioned asset query strings in link. Known quirks: bot-managed sites (openai.com, x.ai) answer 403 to any automated client — the 403 itself is observed, not treated as an outage; some CDNs vary headers per PoP (x-served-by reduced to present). Tests: covered live by the validator. Verified: 2026-09-08 on the founding tier S/A homepages.