HTTP Headers Analysis for https://api.cvshealth.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31104000 ; includeSubDomains

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add X-Content-Type-Options: nosniff
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

connection: close

Caching Headers

Cache-Control

Caching

max-age=0, no-cache, no-store

Expires

Caching

Wed, 26 Aug 2026 05:39:54 GMT

Pragma

Caching

no-cache

cache-control: max-age=0, no-cache, no-store
expires: Wed, 26 Aug 2026 05:39:54 GMT
pragma: no-cache

Content Headers

Content-Length

Content

340

Content-Type

Content

application/json

content-length: 340
content-type: application/json

Server Headers

No server headers found

CORS Headers

Access-Control-Allow-Credentials

Cors

true

Access-Control-Allow-Methods

Cors

GET, POST, PUT, HEAD, DELETE, OPTIONS, PATCH

access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, HEAD, DELETE, OPTIONS, PATCH

Cookies Headers

Set-Cookie

Cookies

set-cookie: _abck=D30D5144021810DE9D5773A171B54D50~-1~YAAQxAwDF7624DKgAQAASQWVPBCoT4Q2FB/9nHjgv+PXi8XF6GO8KVCxHIb/uhzbArr/QeWagCM1gU9bnuQs1f/nOYOZoHVVBU4lnamRZzLrYMFfW6iW9t0TJCgu5Bgx81g6Il2MsX1OV+9D8+NFoU2VCbc7ahq9S/zndBo3pKOUUoTxcOC6JNEkyuwSOCxrl8lSXQXeQvo/QIxD4aCUBd4aHbX0X1SH+C4mEbtm1z/tQik764ldzXQizKAUOqw4UrBhNoSWSUghCfAPuLQ0XD1OEwyg4B/r9cfy7BoWRvl0FBi0w+JxM+BVCWbI/iB70UC4mcRcCfm3w4U4ZzISQNkpxNuNYIzVa8AeyTK4yYeg2G51fqWVAeBk30BOOqMWcnXp0aYmXttiykUWfsIH0ao9HaczCAZkPfBzjq5KVAlEADCzjloiwmSY/68camadTHa7LzOVTQM=~-1~-1~-1~-1~-1; Domain=.cvshealth.com; Path=/; Expires=Thu, 26 Aug 2027 05:39:54 GMT; Max-Age=31536000; Secure
bm_sz=C15EB5F251FB625D85E58ADA23D709F0~YAAQxAwDF7+24DKgAQAASQWVPADPdUuX+1rrgXAR/XJ2u8hnUWyg5Z6n+QzDZbW6ZLLAVIdF3Ng7/KF0z2bIkFyLMuwDMLY4hMOnkiDiXIZJlUmohJ6OO4KOlStwDSJGqwI//IVceo2bGwv6L6nBxIycbxnQGbGKjj365Wclpbbioz7cGxM45cvXIqHLae6zSO+qKRj1yBPFptOLK+KxbRHIDmE7aZBXjNaiQRG8cVkwP2OnNyZLJRUryUgGyoEcJGrcpDovnZjNzMUK6HwWvJr7q0TIYHttU0MNl6mx8CY9UonrPy7qJ2c2HCMFed2ndHDNBs+8HeULWmFiGJ6Ae3CGDt6xi1qDQu9mFS0KU7s=~4342070~3486518; Domain=.cvshealth.com; Path=/; Expires=Wed, 26 Aug 2026 09:39:54 GMT; Max-Age=14400

Other Headers

Allow

Other

GET, POST, HEAD, OPTIONS, PUT, DELETE, PATCH

Date

Other

Wed, 26 Aug 2026 05:39:54 GMT

Server-Timing

Other

cdn-cache; desc=MISS, edge; dur=16, origin; dur=17, ak_p; desc="1787722793636_386075844_505413085_3288_7315_85_164_-";dur=1

X-Grid

Other

rrt-4504196454753320571-d-gea1-63184-3831065-49

X-Req

Other

a=allow;c=;d=desktop;g=0.c40c0317.1787722794.1e1ffddd;h=api.cvshealth.com;i=23.3.12.196;l=unk;t=ut;u=brw

allow: GET, POST, HEAD, OPTIONS, PUT, DELETE, PATCH
date: Wed, 26 Aug 2026 05:39:54 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=16, origin; dur=17, ak_p; desc="1787722793636_386075844_505413085_3288_7315_85_164_-";dur=1
x-grid: rrt-4504196454753320571-d-gea1-63184-3831065-49
x-req: a=allow;c=;d=desktop;g=0.c40c0317.1787722794.1e1ffddd;h=api.cvshealth.com;i=23.3.12.196;l=unk;t=ut;u=brw

Recommendations

Enable compression (gzip/brotli) to improve performance