HTTP Headers Analysis for https://bigcommerce.bynder.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=63072000; includeSubdomains

Content-Security-Policy

Missing

Not configured

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Present

camera=(), geolocation=(), microphone=()

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks

Performance Headers

1 headers

Connection

Performance

close

Caching Headers

1 headers

Cache-Control

Caching

no-cache, no-store, must-revalidate

Content Headers

2 headers

Content-Length

Content

46926

Content-Type

Content

text/html;charset=UTF-8

Server Headers

1 headers

Server

nginx

CORS Headers

0 headers

No CORS headers found

Cookies Headers

1 headers

Set-Cookie

Cookies

DEFAULTLOCALE=en_US;Path=/

Other Headers

7 headers

Content-Security-Policy-Report-Only

Other

default-src 'self'; child-src blob: https://*; connect-src 'self' blob: https://d8ejoa1fys2rk.cloudfront.net https://static.bynder.cloud https://dam.bynder.com https://sentry10.bynder.cloud https://api2.amplitude.com https://*.google-analytics.com https://stats.g.doubleclick.net https://*.amazonaws.com https://fast.appcues.com https://api.appcues.com https://api.appcues.net wss://api.appcues.net https://*.courier.com wss://*.courier.com https://apiv2.webdamdb.com/oauth2/token https://cmp.osano.com https://consent.api.osano.com https://tattle.api.osano.com https://disclosure.api.osano.com https://api.eu1.honeycomb.io https://heapanalytics.com https://*.heapanalytics.com https://*.heap-api.com; font-src https://* data: ; img-src https://* data: blob:; media-src https://*; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://d8ejoa1fys2rk.cloudfront.net https://static.bynder.cloud https://www.googletagmanager.com https://www.google-analytics.com https://js.hs-analytics.net https://fast.appcues.com https://browser.sentry-cdn.com https://bynder-static.s3.amazonaws.com https://cmp.osano.com https://consent.api.osano.com https://tattle.api.osano.com https://disclosure.api.osano.com https://heapanalytics.com https://*.heapanalytics.com https://*.heap-api.com; style-src 'self' 'unsafe-inline' https://d8ejoa1fys2rk.cloudfront.net https://static.bynder.cloud https://fonts.googleapis.com https://bynder-static.s3.amazonaws.com https://fast.appcues.com https://cmp.osano.com https://consent.api.osano.com https://tattle.api.osano.com https://disclosure.api.osano.com https://heapanalytics.com https://*.heapanalytics.com https://*.heap-api.com; worker-src 'self' blob:; report-uri https://sentry10.bynder.cloud/api/1817/security/?sentry_key=638cfd1ab10c78c179140416b9893c0e

Date

Other

Wed, 24 Dec 2025 04:27:48 GMT

Via

Other

1.1 4ee1745ee3cece0fab563f5a32ba165a.cloudfront.net (CloudFront)

X-Amz-Cf-Id

Other

8S9IkOewCHq9klwS3jm3-kZGtJ1TCw0WF0X20xlQhSgpmVrDa6cgng==

X-Amz-Cf-Pop

Other

IAD89-P1