33 Headers

HTTP Security Headers

Status
Strict-Transport-Security
Good
max-age=31536000; includeSubDomains
Content-Security-Policy
Good
default-src; script-src; style-src; +8 more
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
no-referrer
Permissions-Policy
Missing
Not configured
Recommendations
  • Consider adding 'preload' to HSTS for maximum security
  • Strengthen CSP by removing 'unsafe-eval'
  • Consider adding Permissions-Policy to control browser features

Performance Headers

1 headers
Connection
Performance
keep-alive

Caching Headers

2 headers
Cache-Control
Caching
private
Expires
Caching
Tue, 18 Nov 2025 09:22:11 GMT

Content Headers

2 headers
Content-Length
Content
28
Content-Type
Content
application/json; charset=utf-8

Server Headers

1 headers
Server
Server
BunnyCDN-ASB1-1310

CORS Headers

1 headers
Access-Control-Allow-Credentials
Cors
true

Cookies Headers

1 headers
Set-Cookie
Cookies
sessionID=6ed87697-dd9a-48de-822e-872ba0474d3c; Max-Age=31536000; Path=/; HttpOnly; Secure; SameSite=Lax

Other Headers

17 headers
Cdn-Cache
Other
MISS
Cdn-Cachedat
Other
11/18/2025 09:22:11
Cdn-Edgestorageid
Other
1310
Cdn-Proxyver
Other
1.40
Cdn-Pullzone
Other
4807656
Cdn-Requestcountrycode
Other
US
Cdn-Requestid
Other
df76ed8f847a7dcc178b7ce1df10bcbc
Cdn-Requestpullcode
Other
200
Cdn-Requestpullsuccess
Other
True
Cdn-Requesttime
Other
0
Cdn-Status
Other
200
Date
Other
Tue, 18 Nov 2025 09:22:11 GMT
Origin-Agent-Cluster
Other
?1
X-Cloud-Trace-Context
Other
d0131efb0a04e105a1d7945d58e6025a
X-Dns-Prefetch-Control
Other
off
X-Download-Options
Other
noopen
X-Permitted-Cross-Domain-Policies
Other
none

Recommendations

Enable compression (gzip/brotli) to improve performance

Analysis completed in 379ms