HTTP Headers Analysis for https://accounts.cmp-dev.optimizely.com

Detected Technologies from Headers

See all in URL Inspect 7

Adobe Fonts (Typekit)

Google API JS Client

Google Search

Google Static File Front End

Optimizely

Zendesk

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=15552000; includeSubDomains

Content-Security-Policy

Basic

style-src; script-src; img-src; +3 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Vary

Performance

Accept-Encoding

connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

no-cache,no-store,must-revalidate,private

Etag

Caching

W/"16a0-5jiFzc9j6Qekw8otR4G6rV893xU"

Pragma

Caching

no-cache

cache-control: no-cache,no-store,must-revalidate,private
etag: W/"16a0-5jiFzc9j6Qekw8otR4G6rV893xU"
pragma: no-cache

Content Headers

Content-Length

Content

5792

Content-Type

Content

text/html; charset=utf-8

content-length: 5792
content-type: text/html; charset=utf-8

Server Headers

No server headers found

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _csrf=wgE9gYMohDd8DD6ZjT-NvsTa; Domain=accounts.cmp-dev.optimizely.com; Path=/; HttpOnly; Secure; SameSite=Strict
cmp.accounts.sid=s%3AAiGC0uxMHU8TZWcx2WYTagK9dN2_8n1u.C4gkgaCt0%2F%2B2OBGbJTaDMmd4Rd9t4UrYPamJVD3CBUQ; Domain=accounts.cmp-dev.optimizely.com; Path=/; Expires=Thu, 24 Sep 2026 21:26:44 GMT; HttpOnly; Secure; SameSite=None

Other Headers

Date

Other

Tue, 25 Aug 2026 21:26:44 GMT

X-Content-Security-Policy

Other

style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Webkit-Csp

Other

style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

date: Tue, 25 Aug 2026 21:26:44 GMT
x-content-security-policy: style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:
x-dns-prefetch-control: off
x-download-options: noopen
x-webkit-csp: style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

Recommendations

Enable compression (gzip/brotli) to improve performance