HTTP Headers Analysis for https://acare.com.co

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Weak

frame-ancestors

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Present

accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=*, publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=*, usb=(), xr-spatial-tracking=(), gamepad=(), serial=()

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Significantly strengthen CSP directives

Performance Headers

4 headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding, Cookie, Cookie

Caching Headers

2 headers

Age

Caching

0

Cache-Control

Caching

public, max-age=604800

Content Headers

1 headers

Content-Type

Content

text/html; charset=UTF-8

Server Headers

1 headers

Server

nginx

CORS Headers

2 headers

Access-Control-Allow-Headers

Cors

Content-Type, Authorization

Access-Control-Allow-Methods

Cors

GET,POST

Cookies Headers

1 headers

Set-Cookie

Cookies

pll_language=es; expires=Sat, 26 Dec 2026 22:30:19 GMT; Max-Age=31536000; path=/; secure; SameSite=Lax

Other Headers

13 headers

Cross-Origin-Embedder-Policy-Report-Only

Other

unsafe-none; report-to='default'

Cross-Origin-Opener-Policy-Report-Only

Other

unsafe-none; report-to='default'

Date

Other

Fri, 26 Dec 2025 22:30:19 GMT

Link

Other

<https://www.acare.com.co/>; rel=shortlink

Via

Other

1.1 varnish, 1.1 varnish

X-Cache

Other

MISS, MISS

X-Cache-Hits

Other

0, 0

X-Content-Security-Policy

Other

default-src 'self'; img-src *; media-src * data:;

X-Pantheon-Styx-Hostname

Other

styx-fe1-a-67747dcd96-8xb6w

X-Permitted-Cross-Domain-Policies

Other

none

X-Served-By

Other

cache-chi-kigq8000117-CHI, cache-pdk-kfty8610071-PDK

X-Styx-Req-Id

Other

758014fd-e2aa-11f0-9a77-424e73edc06f

X-Timer

Other

S1766788219.185643,VS0,VE530

Recommendations

Enable compression (gzip/brotli) to improve performance