HTTP Headers Analysis for https://app.welcomesoftware.com

Detected Technologies from Headers

See all in URL Inspect 8

Adobe Fonts (Typekit)

AWS CloudFront

Google API JS Client

Google Search

Google Static File Front End

Optimizely

Zendesk

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=15552000; includeSubDomains

Content-Security-Policy

Basic

style-src; script-src; img-src; +3 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Vary

Performance

Accept-Encoding

connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

no-cache,no-store,must-revalidate,private

Etag

Caching

W/"16df-yCHAIVTY04phPKP2y6mLIIXwnVk"

Pragma

Caching

no-cache

cache-control: no-cache,no-store,must-revalidate,private
etag: W/"16df-yCHAIVTY04phPKP2y6mLIIXwnVk"
pragma: no-cache

Content Headers

Content-Length

Content

5855

Content-Type

Content

text/html; charset=utf-8

content-length: 5855
content-type: text/html; charset=utf-8

Server Headers

No server headers found

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _csrf=P17NEAdpbsjF2NoS5YOEN34-; Domain=accounts.cmp.optimizely.com; Path=/; HttpOnly; Secure; SameSite=Strict
cmp.accounts.sid=s%3A2334a0zZm08Co1KcPHq2b0ujuClvjElk.Kt1BV%2FFloY4OTkj2N1ob65q6DVduruZPnOsg8Kp8EgI; Domain=accounts.cmp.optimizely.com; Path=/; Expires=Tue, 22 Sep 2026 22:41:37 GMT; HttpOnly; Secure; SameSite=None

Other Headers

Date

Other

Sun, 23 Aug 2026 22:41:37 GMT

Via

Other

1.1 29e51fc5bac0897053e2f02edda4aecc.cloudfront.net (CloudFront)

X-Amz-Cf-Id

Other

fNRezRU9fJOLzYzqBkNVHgBRbsBhQd5SVyP5r-qR9Kj2WFLwUrjg3g==

X-Amz-Cf-Pop

Other

IAD55-P5

X-Cache

Other

Miss from cloudfront

X-Content-Security-Policy

Other

style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Webkit-Csp

Other

style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

date: Sun, 23 Aug 2026 22:41:37 GMT
via: 1.1 29e51fc5bac0897053e2f02edda4aecc.cloudfront.net (CloudFront)
x-amz-cf-id: fNRezRU9fJOLzYzqBkNVHgBRbsBhQd5SVyP5r-qR9Kj2WFLwUrjg3g==
x-amz-cf-pop: IAD55-P5
x-cache: Miss from cloudfront
x-content-security-policy: style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:
x-dns-prefetch-control: off
x-download-options: noopen
x-webkit-csp: style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

Recommendations

Enable compression (gzip/brotli) to improve performance