Open
Cached
·
just now
20
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=63072000; includeSubDomains
Content-Security-Policy
Good
default-src; connect-src; font-src; +12 more
default-src 'self'; connect-src 'self' https://www.recaptcha.net https://www.google.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; object-src 'none'; script-src 'self' https://www.gstatic.com https://www.google.com 'nonce-'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://www.recaptcha.net; base-uri 'self'; child-src 'self'; frame-ancestors 'none'; manifest-src 'self'; media-src 'none'; worker-src 'self'; form-action 'self'
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Missing
Not configured
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Strengthen CSP by removing 'unsafe-eval'
- • Consider adding Permissions-Policy to control browser features
Performance Headers
1 headers
Connection
Performance
close
Caching Headers
4 headers
Cache-Control
Caching
private, no-store
Etag
Caching
W/"801be87076ee4927c623cba44100ec07"
Expires
Caching
0
Pragma
Caching
no-cache
Content Headers
2 headers
Content-Length
Content
4438
Content-Type
Content
text/html; charset=utf-8
Server Headers
1 headers
X-Runtime
Server
0.017525
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
_balance_session=LpQ0X3j2zkcy45qK4OHF3VojYxB2AIL7dZlZwW0IbNrJ9Cj%2FynZQEWKebPTbtAvk0nySd3Go75sZ8GWHaO2PA5xv54cRbyFd%2FYu7xsGX1CndAlabTMv%2BVM7C6moF0Oi%2BHYU5wxwlSH0xgnFsqnR6RwreKROixY5IVyNh3qNHqY0uk2wOp%2BY8B7cauAxypYoHnj79vZS9QrJIbcRAwgOXcIwxyFR06AyzrAId8dLYUmhEmdRKmd1vx9Is9f3y3T0YTC4%2FM6cHSGqCM6kxFu%2BQDqEU6g0%2FOi81--hbx8QQgbmDY%2FJ7My--EC2lkSEhVFkuXkdaVJ%2Fzkw%3D%3D; path=/; secure; httponly; samesite=lax
Other Headers
5 headers
Date
Other
Mon, 01 Dec 2025 22:21:16 GMT
Link
Other
</packs/js/application-b83a285067c0f83801a0.js>; rel=preload; as=script; nopush,</assets/application-4b40e08c0de20e0d2ad19f13d8264826f1621c8acfec36156a4f19e4925b009a.css>; rel=preload; as=style; nopush,</assets/application-d2be68aa0412af86c00b12b4d932d76ccfe2f41e9d70b0d65692caeea457ee67.js>; rel=preload; as=script; nopush
X-Download-Options
Other
noopen
X-Permitted-Cross-Domain-Policies
Other
none
X-Request-Id
Other
575e68d6-c5b3-4c74-af73-23cbb7741839
Recommendations
Enable compression (gzip/brotli) to improve performance
Analysis completed in 295ms