What ‘Content-Type’ header to use when serving gzipped files?

Compressed content in the response is indicated in the Content-Encoding. The Content-Type should remain the same, that is, it should reflect the underlying media type that is compressed. Content-Type: application/javascript Content-Encoding: gzip See sections 14.11 Content-Encoding and 3.5 Content Codings of RFC 2616 for more information.

Remove http referer

As of 2015 this is how you prevent sending the Referer header: Just add this to the head section of the web page: <meta name=”referrer” content=”no-referrer” /> This works both for links and for Ajax requests made by JavaScript code on the page. Other valid meta options include: <meta name=”referrer” content=”unsafe-url” /> <meta name=”referrer” content=”origin” … Read more

Content-Length header with HEAD requests?

To me it looks like the HTTP 1.1 RFC is pretty specific: The Content-Length entity-header field indicates the size of the entity-body, in decimal number of OCTETs, sent to the recipient or, in the case of the HEAD method, the size of the entity-body that would have been sent had the request been a GET.

Does the order of headers in an HTTP response ever matter?

No, it does not matter for headers with different names. See RFC 2616, section 4.2: The order in which header fields with differing field names are received is not significant. However, it is “good practice” to send general-header fields first, followed by request-header or response- header fields, and ending with the entity-header fields. It DOES … Read more