Open
Cached
·
just now
25
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=604800
Content-Security-Policy
Basic
default-src; frame-ancestors; img-src; +1 more
default-src blob: data: fingi-development.s3-accelerate.amazonaws.com fingi.s3-accelerate.amazonaws.com fingi.s3.amazonaws.com *.froala.com *.googleapis.com *.gstatic.com *.line.me *.pusher.com *.pusherapp.com *.smooch.io *.typekit.net *.unlayer.com 'self' 'unsafe-eval' 'unsafe-inline' okkami-data.s3-ap-southeast-1.amazonaws.com okkami-edm-develop.s3.ap-southeast-1.amazonaws.com okkami-property-develop.s3.amazonaws.com okkami-web-fonts.s3.ap-southeast-1.amazonaws.com okkami.instatus.com property-guest-services.s3.amazonaws.com res.cloudinary.com wss: fingi.s3.ap-southeast-1.amazonaws.com fingi.s3-ap-southeast-1.amazonaws.com okkami-data.s3.amazonaws.com okkami-data.s3-accelerate.amazonaws.com okkami-data.s3.ap-southeast-1.amazonaws.com okkami-edm.s3.amazonaws.com okkami-edm.s3-accelerate.amazonaws.com okkami-edm.s3.ap-southeast-1.amazonaws.com okkami-edm.s3-ap-southeast-1.amazonaws.com okkami-property.s3.amazonaws.com okkami-property.s3-accelerate.amazonaws.com okkami-property.s3.ap-southeast-1.amazonaws.com okkami-property.s3-ap-southeast-1.amazonaws.com okkami-brand.s3.amazonaws.com okkami-brand.s3-accelerate.amazonaws.com okkami-brand.s3.ap-southeast-1.amazonaws.com okkami-brand.s3-ap-southeast-1.amazonaws.com okkami-web-fonts.s3.amazonaws.com okkami-web-fonts.s3-accelerate.amazonaws.com okkami-web-fonts.s3-ap-southeast-1.amazonaws.com *.facebook.net *.facebook.com *.google.com *.line-scdn.net *.fbsbx.com *.gravatar.com *.anantara.com *.fbcdn.net evermoreresort.com *.evermoreresort.com *.pantheonsite.io *.stripe.com *.googletagmanager.com *.google-analytics.com; frame-ancestors "" 'self'; img-src 'self' https: data: blob:; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: *.froala.com *.googleapis.com *.gstatic.com *.pusher.com *.pusherapp.com *.smooch.io *.unlayer.com okkami-data.s3-ap-southeast-1.amazonaws.com fingi.s3-accelerate.amazonaws.com fingi-development.s3-accelerate.amazonaws.com okkami.instatus.com fingi.s3.us-east-1.amazonaws.com fingi.s3.amazonaws.com fingi.s3.ap-southeast-1.amazonaws.com fingi.s3-ap-southeast-1.amazonaws.com okkami-data.s3.amazonaws.com okkami-data.s3-accelerate.amazonaws.com okkami-data.s3.ap-southeast-1.amazonaws.com okkami-edm.s3.amazonaws.com okkami-edm.s3-accelerate.amazonaws.com okkami-edm.s3.ap-southeast-1.amazonaws.com okkami-edm.s3-ap-southeast-1.amazonaws.com okkami-property.s3.amazonaws.com okkami-property.s3-accelerate.amazonaws.com okkami-property.s3.ap-southeast-1.amazonaws.com okkami-property.s3-ap-southeast-1.amazonaws.com okkami-brand.s3.amazonaws.com okkami-brand.s3-accelerate.amazonaws.com okkami-brand.s3.ap-southeast-1.amazonaws.com okkami-brand.s3-ap-southeast-1.amazonaws.com okkami-web-fonts.s3.amazonaws.com okkami-web-fonts.s3-accelerate.amazonaws.com okkami-web-fonts.s3.ap-southeast-1.amazonaws.com okkami-web-fonts.s3-ap-southeast-1.amazonaws.com *.facebook.net *.facebook.com *.google.com *.line-scdn.net *.fbsbx.com *.gravatar.com *.anantara.com *.fbcdn.net evermoreresort.com *.evermoreresort.com *.pantheonsite.io *.stripe.com *.googletagmanager.com *.google-analytics.com
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Present
origin-when-cross-origin, strict-origin-when-cross-origin
Permissions-Policy
Missing
Not configured
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Consider adding Permissions-Policy to control browser features
Performance Headers
3 headers
Connection
Performance
close
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding
Caching Headers
1 headers
Cache-Control
Caching
no-cache
Content Headers
1 headers
Content-Type
Content
text/html; charset=utf-8
Server Headers
2 headers
Server
Server
cloudflare
X-Runtime
Server
0.099624
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
_fingi_session=8G0XQwOELLdW%2BPNkLvn9hhR2D%2FDvuZ463%2FF2GNcoiSNWWulgqw0e8UzZUxRRcjO%2FhXlMgdtZoGx822oWcsTKDM8B0XAj28gNqxaG0PkAF6MH4R0kHkK0qNdlEIpR7ur328Ou9GjwxHUb2FYMvaJ%2F6xxMRsQV%2BxC8KDBRVi4kwFPBVl483YuJpPyNagr3ryolwS%2FXbReNnVU6Ng0%2Bi8VnssaAufLcup4xskoc9Hj%2Bun8CwakOsoOn3dAdn51kotZ2b7VakzECjZMm%2FK5iPmpsNpu6Tm1m8qmsBJxfc9iiXck%2BkuRAPfc%3D--bwV05eub7l%2FQhacG--zHTfnkH6kW7y%2BF1enROVIA%3D%3D; path=/; httponly; samesite=lax; secure
Other Headers
11 headers
Alt-Svc
Other
h3=":443"; ma=86400
Cf-Cache-Status
Other
DYNAMIC
Cf-Ray
Other
9c61b6337b1e0846-IAD
Date
Other
Fri, 30 Jan 2026 14:38:14 GMT
Link
Other
<https://fingi.s3-accelerate.amazonaws.com/assets/devise-bf15bf74039cb8a23aab6caacd889067ca766c5f900f5680363d0fa8a82607af.css>; rel=preload; as=style; nopush,<https://fingi.s3-accelerate.amazonaws.com/assets/application-2bf0c5e0d9a49040cd690f32e7283e98a9f190d4679676e84ed336986a85b293.js>; rel=preload; as=script; nopush,<https://fingi.s3-accelerate.amazonaws.com/assets/facebook-82a6b570aa6da28af25492dc56d87b03b549c0262685385dfe6ee2484ef31985.js>; rel=preload; as=script; nopush
Nel
Other
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
Report-To
Other
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iYlK3c5rEf%2Fk9b1jAZzdd1oC2l4szkFXQUbiyon5z7ZcZc31CmWgvqS40IzzAd9CIYx9csT7e6zjmYsXosOn8tgGLPg23abgygMgFE1Y7g%3D%3D"}]}
Server-Timing
Other
cfEdge;dur=246,cfOrigin;dur=1141
X-Download-Options
Other
noopen
X-Permitted-Cross-Domain-Policies
Other
none
X-Request-Id
Other
b263d61d-924c-471c-af9f-594882c0c92c
Recommendations
Enable compression (gzip/brotli) to improve performance