Compression changes the selected HTTP representation
Test compressed and uncompressed requests separately so caches and validators describe the bytes actually served.
Field notes
3 / 4
Cache headers are a contract with two clocks
Separate browser freshness from origin validation, then verify the response headers that implement both.
HSTS should be rolled out with a recovery plan
HSTS is cached browser policy, so a configuration mistake can outlive the server change that created it.
HEAD should describe the same representation as GET
HEAD is a metadata view of GET; status and representation headers should tell the same story.
DNS changes need a cache-aware rollback window
Prepare the TTL ahead of time, observe authoritative and recursive answers, and keep both endpoints valid through the cache window.
CAA records should authorize the issuer you actually use
CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.
Cookie scope should be narrower than the application boundary
A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.
Content-Type should describe the bytes you actually send
A filename is only a hint; the response header is the browser-facing contract for the representation.