Open
Cached
·
just now
19
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=604800
Content-Security-Policy
Basic
default-src; frame-ancestors; img-src; +1 more
default-src blob: data: fingi-development.s3-accelerate.amazonaws.com fingi.s3-accelerate.amazonaws.com fingi.s3.amazonaws.com *.froala.com *.googleapis.com *.gstatic.com *.line.me *.pusher.com *.pusherapp.com *.smooch.io *.typekit.net *.unlayer.com 'self' 'unsafe-eval' 'unsafe-inline' okkami-data.s3-ap-southeast-1.amazonaws.com okkami-edm-develop.s3.ap-southeast-1.amazonaws.com okkami-property-develop.s3.amazonaws.com okkami-web-fonts.s3.ap-southeast-1.amazonaws.com okkami.instatus.com property-guest-services.s3.amazonaws.com res.cloudinary.com wss: fingi.s3.ap-southeast-1.amazonaws.com fingi.s3-ap-southeast-1.amazonaws.com okkami-data.s3.amazonaws.com okkami-data.s3-accelerate.amazonaws.com okkami-data.s3.ap-southeast-1.amazonaws.com okkami-edm.s3.amazonaws.com okkami-edm.s3-accelerate.amazonaws.com okkami-edm.s3.ap-southeast-1.amazonaws.com okkami-edm.s3-ap-southeast-1.amazonaws.com okkami-property.s3.amazonaws.com okkami-property.s3-accelerate.amazonaws.com okkami-property.s3.ap-southeast-1.amazonaws.com okkami-property.s3-ap-southeast-1.amazonaws.com okkami-brand.s3.amazonaws.com okkami-brand.s3-accelerate.amazonaws.com okkami-brand.s3.ap-southeast-1.amazonaws.com okkami-brand.s3-ap-southeast-1.amazonaws.com okkami-web-fonts.s3.amazonaws.com okkami-web-fonts.s3-accelerate.amazonaws.com okkami-web-fonts.s3-ap-southeast-1.amazonaws.com *.facebook.net *.facebook.com *.google.com *.line-scdn.net *.fbsbx.com *.gravatar.com *.anantara.com *.fbcdn.net evermoreresort.com *.evermoreresort.com *.pantheonsite.io *.stripe.com *.googletagmanager.com *.google-analytics.com; frame-ancestors "" 'self'; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.froala.com *.googleapis.com *.gstatic.com *.pusher.com *.pusherapp.com *.smooch.io *.unlayer.com okkami-data.s3-ap-southeast-1.amazonaws.com fingi.s3-accelerate.amazonaws.com fingi-development.s3-accelerate.amazonaws.com okkami.instatus.com fingi.s3.us-east-1.amazonaws.com fingi.s3.amazonaws.com fingi.s3.ap-southeast-1.amazonaws.com fingi.s3-ap-southeast-1.amazonaws.com okkami-data.s3.amazonaws.com okkami-data.s3-accelerate.amazonaws.com okkami-data.s3.ap-southeast-1.amazonaws.com okkami-edm.s3.amazonaws.com okkami-edm.s3-accelerate.amazonaws.com okkami-edm.s3.ap-southeast-1.amazonaws.com okkami-edm.s3-ap-southeast-1.amazonaws.com okkami-property.s3.amazonaws.com okkami-property.s3-accelerate.amazonaws.com okkami-property.s3.ap-southeast-1.amazonaws.com okkami-property.s3-ap-southeast-1.amazonaws.com okkami-brand.s3.amazonaws.com okkami-brand.s3-accelerate.amazonaws.com okkami-brand.s3.ap-southeast-1.amazonaws.com okkami-brand.s3-ap-southeast-1.amazonaws.com okkami-web-fonts.s3.amazonaws.com okkami-web-fonts.s3-accelerate.amazonaws.com okkami-web-fonts.s3.ap-southeast-1.amazonaws.com okkami-web-fonts.s3-ap-southeast-1.amazonaws.com *.facebook.net *.facebook.com *.google.com *.line-scdn.net *.fbsbx.com *.gravatar.com *.anantara.com *.fbcdn.net evermoreresort.com *.evermoreresort.com *.pantheonsite.io *.stripe.com *.googletagmanager.com *.google-analytics.com
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Present
origin-when-cross-origin, strict-origin-when-cross-origin
Permissions-Policy
Missing
Not configured
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Consider adding Permissions-Policy to control browser features
Performance Headers
2 headers
Connection
Performance
close
Vary
Performance
Accept-Encoding
Caching Headers
2 headers
Cache-Control
Caching
max-age=0, private, must-revalidate
Etag
Caching
W/"e0ee7c42644f4757af92fea7fdddc8f3"
Content Headers
2 headers
Content-Length
Content
273002
Content-Type
Content
text/html; charset=utf-8
Server Headers
1 headers
X-Runtime
Server
0.084517
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
_fingi_session=9ObDJURvit75dprBKb7izkWaIqO%2F1NX%2B6PtMVobzavnN8hE44PZLEwebzoSxMKFlcDo7PkZsYc%2BiOzbplJftj8vMsJLxETiz5co062yAEUn381ctttAlg0%2F41AWBSF7RlC2vEJqi6NDnkUCnS7%2FsDK9tD%2FfYypCoEN43wuU6mFSN%2B4Nu%2FDoiQn5YTIoRrp5uYA8rnLZzPdnUoaCZXVrKAHsg52fAYUNpdFk69Vzc2XjgA8pHRy%2BgPsHZ%2BgGpMm7YXwXqby2OrBZ3ZE%2BLOrHF6XCssSJ0%2BjQVqU6dWKPbp%2F470AUbwHc%3D--pI3rucFjeJd8jbed--G5SgVP8P59rxMk56Byvn2Q%3D%3D; path=/; httponly; samesite=lax; secure
Other Headers
5 headers
Date
Other
Sun, 25 Jan 2026 01:23:09 GMT
Link
Other
<https://fingi.s3-accelerate.amazonaws.com/assets/devise-bf15bf74039cb8a23aab6caacd889067ca766c5f900f5680363d0fa8a82607af.css>; rel=preload; as=style; nopush,<https://fingi.s3-accelerate.amazonaws.com/assets/application-2bf0c5e0d9a49040cd690f32e7283e98a9f190d4679676e84ed336986a85b293.js>; rel=preload; as=script; nopush,<https://fingi.s3-accelerate.amazonaws.com/assets/facebook-82a6b570aa6da28af25492dc56d87b03b549c0262685385dfe6ee2484ef31985.js>; rel=preload; as=script; nopush
X-Download-Options
Other
noopen
X-Permitted-Cross-Domain-Policies
Other
none
X-Request-Id
Other
9f3cd0b1-24dd-4116-9783-75288015c949
Recommendations
Enable compression (gzip/brotli) to improve performance