HTTP Headers Analysis for https://api.squareup.com

Open Cached · 7h ago

30 Headers

Detected Technologies from Headers

See all in URL Inspect 30

Adobe Marketo

AppNexus (Xandr)

Chili Piper

Cloudflare CDN

Contentful

Contentsquare

Datadog

Drift Active incidents

Envoy

Facebook

Google Analytics

Google Cloud Functions

Google Conversion Tracking

Google DoubleClick

Google Search

Google Tag Manager

Marketlinc

OneTrust

Optimizely

Qualified

Sentry Active incidents

6sense

Sprig

Square

SvelteKit

The Trade Desk

YouTube

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=631152000; includeSubDomains; preload

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Good

child-src; default-src; frame-src; +11 more Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Add Content-Security-Policy header to prevent XSS attacks
• Consider adding Permissions-Policy to control browser features

Performance Headers

Accept-Ranges

Performance

bytes

Connection

Performance

Vary

Performance

Accept-Encoding

accept-ranges: bytes
connection: close
vary: Accept-Encoding

Caching Headers

Age

Caching

215

Cache-Control

Caching

max-age=0, public, must-revalidate

Etag

Caching

"sltgzs"

age: 215
cache-control: max-age=0, public, must-revalidate
etag: "sltgzs"

Content Headers

Content-Length

Content

1957250

Content-Type

Content

text/html; charset=utf-8

content-length: 1957250
content-type: text/html; charset=utf-8

Server Headers

Server

cloudflare

server: cloudflare

CORS Headers

Access-Control-Allow-Headers

Cors

x-kpsdk-cd, x-kpsdk-ct

access-control-allow-headers: x-kpsdk-cd, x-kpsdk-ct

Cookies Headers

Set-Cookie

set-cookie: squareGeo=DELETE; path=/; SameSite=Strict; Secure; max-age=0
squareGeo=US-VA; Domain=squareup.com; path=/; SameSite=Strict; Secure; max-age=2419200
__cf_bm=k3.ZTITFaR3b5yIOdvbi6w7quU7LyC23jlY.CV0a9iU-1778582803.361706-1.0.1.1-sI7FylK40NBayHtuEzgYDD2Ava4HOZI4Ut6VQqkqOHpcSDLbSl6uKu5DzwBBa1mDvVaKSP64WrX9nBGRRVaUsctcNVlJEbrDsHnLyzwC1bMLIbqD19m2vksU.60NvL8e; HttpOnly; SameSite=None; Secure; Path=/; Domain=squareup.com; Expires=Tue, 12 May 2026 11:16:43 GMT

Other Headers

Cf-Cache-Status

Other

HIT

Cf-Ray

Other

9fa8d7590ac31ee7-IAD

Date

Other

Tue, 12 May 2026 10:46:43 GMT

Link

Other

URL

https://pw-renderer-production-c.squarecdn.com

rel=preconnect crossorigin=anonymous

URL

https://images.ctfassets.net

rel=preconnect crossorigin=anonymous

URL

https://assets.ctfassets.net

rel=preconnect crossorigin=anonymous

URL

https://cdn.cookielaw.org

rel=preconnect crossorigin=anonymous

Origin-Agent-Cluster

Other

Report-To

Other

Group browser-intake-datadoghq max-age: 18w

Endpoint 1 https://browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pubd9af00759e65a48ba7ee3ff1dfa4260b&dd-evp-origin=content-security-policy&ddsource=csp-report

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Envoy-Decorator-Operation

Other

/{locale}

X-Permitted-Cross-Domain-Policies

Other

none

X-Sveltekit-Page

Other

true

cf-cache-status: HIT
cf-ray: 9fa8d7590ac31ee7-IAD
date: Tue, 12 May 2026 10:46:43 GMT
link: <https://pw-renderer-production-c.squarecdn.com>; rel="preconnect"; crossorigin="anonymous", <https://images.ctfassets.net>; rel="preconnect"; crossorigin="anonymous", <https://assets.ctfassets.net>; rel="preconnect"; crossorigin="anonymous", <https://cdn.cookielaw.org>; rel="preconnect"; crossorigin="anonymous", <https://pw-assets-production-c.squarecdn.com>; rel="preconnect"; crossorigin="anonymous", <https://cash-f.squarecdn.com/static/fonts/cashsans/woff2/CashSans-Regular.woff2>; rel="preload"; crossorigin="anonymous"; as="font"; type="font/woff2", <https://cash-f.squarecdn.com/static/fonts/cashsans/woff2/CashSans-Medium.woff2>; rel="preload"; crossorigin="anonymous"; as="font"; type="font/woff2", <https://campaign-hub-production-f.squarecdn.com/static/fonts/exact/ExactBlock-Regular.woff2>; rel="preload"; crossorigin="anonymous"; as="font"; type="font/woff2",
origin-agent-cluster: ?1
report-to: {"group":"browser-intake-datadoghq","max_age":10886400,"endpoints":[{"url":"https://browser-intake-datadoghq.com/api/v2/logs?dd-api-key=pubd9af00759e65a48ba7ee3ff1dfa4260b&dd-evp-origin=content-security-policy&ddsource=csp-report"}]}
x-dns-prefetch-control: off
x-download-options: noopen
x-envoy-decorator-operation: /{locale}
x-permitted-cross-domain-policies: none
x-sveltekit-page: true

Recommendations

Enable compression (gzip/brotli) to improve performance