HTTP Headers Analysis for https://api.cookieyes.com

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains

Content-Security-Policy

Basic

default-src; script-src; style-src; +10 more

default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://bam.nr-data.net https://cdn-cookieyes.com https://googleads.g.doubleclick.net https://js-agent.newrelic.com https://js.intercomcdn.com https://js.stripe.com https://script.tapfiliate.com https://*.hotjar.com https://widget.intercom.io https://*.googletagmanager.com https://challenges.cloudflare.com https://cdn.mxpnl.com https://*.cookieyes.com https://www.googleadservices.com https://www.google.com https://pagead2.googlesyndication.com https://code.tidio.co https://widget-v4.tidiochat.com https://www.clarity.ms https://bat.bing.com https://e9f87d8c82343264e6ba-2977c39e5e9390b1a89ab5ed2a171102.ssl.cf1.rackcdn.com https://static.cloudflareinsights.com https://*.tinymce.com https://*.tiny.cloud; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://*.hotjar.com https://*.googletagmanager.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api-iam.intercom.io https://bam.nr-data.net https://cdn-cookieyes.com https://directory.cookieyes.com https://log.cookieyes.com wss://nexus-websocket-a.intercom.io https://*.hotjar.com https://*.hotjar.io wss://*.hotjar.com https://*.cookieyes.com https://frstre.com https://*.mixpanel.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://pagead2.googlesyndication.com https://www.google.com sentry-new.tidio.co socket.tidio.co api-v2.tidio.co https://static.cloudflareinsights.com https: wss:; font-src 'self' https://fonts.gstatic.com https://*.hotjar.com https://widget-v4.tidiochat.com https://fonts.intercomcdn.com; frame-src 'self' https://js.stripe.com https://challenges.cloudflare.com https://bid.g.doubleclick.net https://td.doubleclick.net https://www.googletagmanager.com https://template.geniusreferrals.com https://static.cloudflareinsights.com https://assets.calendly.com; img-src 'self' * data: https://*.hotjar.com https://*.google-analytics.com https://*.googletagmanager.com https://googleads.g.doubleclick.net https://www.google.com cdnjs.cloudflare.com data: https:; manifest-src 'self'; media-src 'self' widget-v4.tidiochat.com; worker-src 'none'; frame-ancestors https://*.wix.com;

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Present

no-referrer, strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Consider adding Permissions-Policy to control browser features

Performance Headers

3 headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Origin

Caching Headers

1 headers

Cache-Control

Caching

no-cache, private

Content Headers

1 headers

Content-Type

Content

application/json

Server Headers

2 headers

Server

cloudflare

X-Powered-By

Server

PHP/8.1.28

CORS Headers

0 headers

No CORS headers found

Cookies Headers

1 headers

Set-Cookie

Cookies

cookieyes_session=eyJpdiI6InFLMHRhUkZVcytUalVUc3VqOUcwbmc9PSIsInZhbHVlIjoiUXJDR05HVFFGREE3MkhkVDhOSXV0U3ZudUFlVld0MnhIZEo2emhieW95elBpREs5ZTRHK1BVNkRWYnMrTERJQ014UGZKYU44V011RlFYVDJJM1JHbzlSbWZwc3ZCeXR0Y2FHemszdWtoVXhDSVJKSHdtVksvbllCRTU3WGpvaXciLCJtYWMiOiI0MDE3YjFlZGE5NTgyMTJjMTI4ZTFjYWIwOTA2NWMzYTQ4OGVjODI5OTUyYjFmMjNkOGVkM2I5NTYzNTQ1OTIyIiwidGFnIjoiIn0%3D; expires=Tue, 13 Jan 2026 08:06:40 GMT; Max-Age=7200; path=/; secure; httponly; samesite=strict