The `Expect-CT` header is deprecated and will be removed

[JanSchatz80]

Hello together,

I get this lighthouse warning for all my pw sites (see screenshot). I'm not sure if this is set by pw itself but on other CMS sites on the same server this warning did not appear. Can anyone help me if this header comes from pw and when how to remove this. I tried to remove the header via htaccess 

Header always unset Expect-CT

but with no luck.

Greetings Jan
 

[BrendonKoz]

I'm not finding the "Expect-CT" text coming up in a file search for my ProcessWire sites, nor did I get any results when I searched the ProcessWire GitHub repo. Do you have any 3rd party modules that might inject its own headers? I know you said that other CMSs aren't providing this warning, but have you tried your project on another server just to see if it's definitely PW and not the local development server?

(My hunch would be a 3rd party module, but hard to know.)

[JanSchatz80]

Hey @BrendonKoz, that is weird. I also did a full text search without any hint. But this appears not only on localhost here are links to two processwire powered sites on complete different webhosting companies and there is always the chrome lighthouse warning:
https://www.piluweri.de/
https://www.mobilo.net/

And this is a Craft CMS powered site on the same webhosting like the mobilo website and there is no Expect-CT header set:
https://www.jutt-immobilien.de/

I also investigated the htaccess default file from pw without any hint. Do you have any idea what causes this warning? or anyone else?

[JanSchatz80]

OK, the problem with the two mentioned pages is the usage of webfonts with a required counter call from myfonts.net:
https://hello.myfonts.net/count/379b36

In this request the Expect-CT header is set ?‍♂️ - so that is not caused by processwire.