Open
Cached
·
just now
19
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=604800
Content-Security-Policy
Basic
default-src; frame-ancestors; img-src; +1 more
default-src blob: data: fingi-development.s3-accelerate.amazonaws.com fingi.s3-accelerate.amazonaws.com fingi.s3.amazonaws.com *.froala.com *.googleapis.com *.gstatic.com *.line.me *.pusher.com *.pusherapp.com *.smooch.io *.typekit.net *.unlayer.com 'self' 'unsafe-eval' 'unsafe-inline' okkami-data.s3-ap-southeast-1.amazonaws.com okkami-edm-develop.s3.ap-southeast-1.amazonaws.com okkami-property-develop.s3.amazonaws.com okkami-web-fonts.s3.ap-southeast-1.amazonaws.com okkami.instatus.com property-guest-services.s3.amazonaws.com res.cloudinary.com wss: fingi.s3.ap-southeast-1.amazonaws.com fingi.s3-ap-southeast-1.amazonaws.com okkami-data.s3.amazonaws.com okkami-data.s3-accelerate.amazonaws.com okkami-data.s3.ap-southeast-1.amazonaws.com okkami-edm.s3.amazonaws.com okkami-edm.s3-accelerate.amazonaws.com okkami-edm.s3.ap-southeast-1.amazonaws.com okkami-edm.s3-ap-southeast-1.amazonaws.com okkami-property.s3.amazonaws.com okkami-property.s3-accelerate.amazonaws.com okkami-property.s3.ap-southeast-1.amazonaws.com okkami-property.s3-ap-southeast-1.amazonaws.com okkami-brand.s3.amazonaws.com okkami-brand.s3-accelerate.amazonaws.com okkami-brand.s3.ap-southeast-1.amazonaws.com okkami-brand.s3-ap-southeast-1.amazonaws.com okkami-web-fonts.s3.amazonaws.com okkami-web-fonts.s3-accelerate.amazonaws.com okkami-web-fonts.s3-ap-southeast-1.amazonaws.com *.facebook.net *.facebook.com *.google.com *.line-scdn.net *.fbsbx.com *.gravatar.com *.anantara.com *.fbcdn.net evermoreresort.com *.evermoreresort.com *.pantheonsite.io *.stripe.com *.googletagmanager.com *.google-analytics.com; frame-ancestors "" 'self'; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.froala.com *.googleapis.com *.gstatic.com *.pusher.com *.pusherapp.com *.smooch.io *.unlayer.com okkami-data.s3-ap-southeast-1.amazonaws.com fingi.s3-accelerate.amazonaws.com fingi-development.s3-accelerate.amazonaws.com okkami.instatus.com fingi.s3.us-east-1.amazonaws.com fingi.s3.amazonaws.com fingi.s3.ap-southeast-1.amazonaws.com fingi.s3-ap-southeast-1.amazonaws.com okkami-data.s3.amazonaws.com okkami-data.s3-accelerate.amazonaws.com okkami-data.s3.ap-southeast-1.amazonaws.com okkami-edm.s3.amazonaws.com okkami-edm.s3-accelerate.amazonaws.com okkami-edm.s3.ap-southeast-1.amazonaws.com okkami-edm.s3-ap-southeast-1.amazonaws.com okkami-property.s3.amazonaws.com okkami-property.s3-accelerate.amazonaws.com okkami-property.s3.ap-southeast-1.amazonaws.com okkami-property.s3-ap-southeast-1.amazonaws.com okkami-brand.s3.amazonaws.com okkami-brand.s3-accelerate.amazonaws.com okkami-brand.s3.ap-southeast-1.amazonaws.com okkami-brand.s3-ap-southeast-1.amazonaws.com okkami-web-fonts.s3.amazonaws.com okkami-web-fonts.s3-accelerate.amazonaws.com okkami-web-fonts.s3.ap-southeast-1.amazonaws.com okkami-web-fonts.s3-ap-southeast-1.amazonaws.com *.facebook.net *.facebook.com *.google.com *.line-scdn.net *.fbsbx.com *.gravatar.com *.anantara.com *.fbcdn.net evermoreresort.com *.evermoreresort.com *.pantheonsite.io *.stripe.com *.googletagmanager.com *.google-analytics.com
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Present
origin-when-cross-origin, strict-origin-when-cross-origin
Permissions-Policy
Missing
Not configured
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Consider adding Permissions-Policy to control browser features
Performance Headers
2 headers
Connection
Performance
close
Vary
Performance
Accept-Encoding
Caching Headers
2 headers
Cache-Control
Caching
max-age=0, private, must-revalidate
Etag
Caching
W/"93ec70b000901c55e118856ed97f8975"
Content Headers
2 headers
Content-Length
Content
273781
Content-Type
Content
text/html; charset=utf-8
Server Headers
1 headers
X-Runtime
Server
0.073676
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
_fingi_session=OAQvd%2BBC3RcULs3bpzHH12fpwi%2B%2FMQoD3HOLm34Fi4RYzIzdFR6rDCJuRyRbiZFwBzgRComUB9KcWXIZ93ACAbOrAfwHvqrysQwvgKoL1j%2BhCYS9TJWyckKgjdt7mg691S0YOxHEsBgcu6L%2FYDdXOHLfHMyJA2PU7GN4sucrt3%2F59m2MVPOo2qK0DYT1S%2B5vTLstQt4Ru3nr72WmOAMikVPYlKsKgFxpNfs4kkgRgza6AosVAj1y3P4AXI4bhbrzJ6zZO%2BHe1omMMtUw1DM3C14OJSoUeRDq%2F2uunZpf%2Ff7%2BD3LLlc4%3D--fE0J1cZwLkciLLqp--Jh0qLCWTIWJhiqAuhCvVsg%3D%3D; path=/; httponly; samesite=lax; secure
Other Headers
5 headers
Date
Other
Wed, 28 Jan 2026 23:40:40 GMT
Link
Other
<https://fingi.s3-accelerate.amazonaws.com/assets/devise-bf15bf74039cb8a23aab6caacd889067ca766c5f900f5680363d0fa8a82607af.css>; rel=preload; as=style; nopush,<https://fingi.s3-accelerate.amazonaws.com/assets/application-2bf0c5e0d9a49040cd690f32e7283e98a9f190d4679676e84ed336986a85b293.js>; rel=preload; as=script; nopush,<https://fingi.s3-accelerate.amazonaws.com/assets/facebook-82a6b570aa6da28af25492dc56d87b03b549c0262685385dfe6ee2484ef31985.js>; rel=preload; as=script; nopush
X-Download-Options
Other
noopen
X-Permitted-Cross-Domain-Policies
Other
none
X-Request-Id
Other
acec6e51-5d89-42e2-90ee-d4d24c9179c2
Recommendations
Enable compression (gzip/brotli) to improve performance