When serving the majority of my HTTPS pages, I have these HTTP headers included in the response (to the browser):
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=77777777
Content-Type: text/html; charset=utf-8
The problem, they can be an overkill for small assets such as the file robots.txt. My robots.txt file now is sitting at 55 bytes (and 71 bytes when gzipped. pretty strange).
So to cut down on size, I removed the above header for robots.txt and sitemap.xml and for robots.txt the total network payload went down from about 1.2KB to 321 bytes (about an 80% savings).
So what I'd like to know is, are there short-form headers I could use to replace the headers above that would be compatible with today's web browsers?
I did think about injecting the headers into my HTML with meta-http equiv but some headers injected that way may come with a price I think.
Someone guide me. My end goal is to reduce the grand total payload (so people need to use much less data to load the web page).