13 Headers

HTTP Security Headers

Status
Strict-Transport-Security
Present
max-age=2592000
Content-Security-Policy
Missing
Not configured Analyze
Content-Security-Policy-Report-Only
Missing
Not configured Analyze
X-Frame-Options
Missing
Not configured
X-Content-Type-Options
Missing
Not configured
Referrer-Policy
Missing
Not configured
Permissions-Policy
Missing
Not configured
Recommendations
  • Increase HSTS max-age to at least 1 year and add includeSubDomains
  • Add Content-Security-Policy header to prevent XSS attacks
  • Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
  • Add X-Content-Type-Options: nosniff
  • Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
  • Consider adding Permissions-Policy to control browser features

Performance Headers

Connection
Performance
close
Transfer-Encoding
Performance
chunked

Caching Headers

No caching headers found

Content Headers

No content headers found

Server Headers

Server
Server
cloudflare

CORS Headers

No CORS headers found

Cookies Headers

No cookies headers found

Other Headers

Alt-Svc
Other
h3=":443"; ma=86400
Cf-Cache-Status
Other
DYNAMIC
Cf-Ray
Other
9f8deb1c8af521cf-IAD
Date
Other
Sat, 09 May 2026 04:21:38 GMT
Nel
Other
Report-To Group cf-nel max-age: 1w
success: 0.0%
Request-Context
Other
appId=
Server-Timing
Other
cfCacheStatus;desc="DYNAMIC", cfEdge;dur=20,cfOrigin;dur=1443
Speculation-Rules
Other
"/cdn-cgi/speculation"

Recommendations

Enable compression (gzip/brotli) to improve performance

Add Cache-Control header to optimize caching