Open
Cached
·
just now
33
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Excellent
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
Good
default-src; script-src; style-src; +11 more
default-src 'self'; script-src 'self' 'nonce-U8KEFD+DdTIh0nw9wMto+x6sw3dBlrytTQV9CMcMzaI=' 'strict-dynamic' http: https: *.sparkhire.com *.google.com *.omappapi.com *.wistia.com *.hs-scripts.com *.zopim.com; style-src 'self' 'unsafe-inline' blob: wss: http: https: fonts.googleapis.com *.sparkhire.com *.google.com *.omappapi.com *.wistia.com *.hs-scripts.com *.hs-forms.com *.zopim.com *.doubleclick.net; img-src 'self' blob: wss: data: http: https: https://secure.gravatar.com https://www.google-analytics.com *.sparkhire.com *.wistia.com *.hs-scripts.com *.hs-forms.com *.zopim.com *.doubleclick.net; font-src 'self' blob: wss: data: http: https: fonts.googleapis.com fonts.gstatic.com https://s0.wp.com *.sparkhire.com *.wistia.com *.hs-scripts.com *.zopim.com *.doubleclick.net; connect-src 'self' http: https: wss: https://stats.g.doubleclick.net https://www.google-analytics.com *.hs-forms.com *.hscollectedforms.net *.doubleclick.net *.zopim.com;media-src 'self' wss: blob: http: https: *.sparkhire.com *.google.com *.omappapi.com *.wistia.com *.hs-scripts.com *.doubleclick.net; object-src 'none'; base-uri 'self'; frame-src 'self' *.sparkhire.com *.wpenginepowered.com *.doubleclick.net *.wistia.net forms.hsforms.com www.facebook.com *.chilipiper.com *.youtube.com *.comeet.co comeet.co *.comeet.com comeet.com *.userway.org www.googletagmanager.com sparkhire.outgrow.us streamyard.com *.streamyard.com; form-action 'self' www.facebook.com forms.hsforms.com; frame-ancestors 'self' *.comeet.co; worker-src 'self' blob:; manifest-src 'self'
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Present
autoplay=(*), fullscreen=(*), notifications=(*), speaker=(*), unoptimized-images=(*), unsized-media=(*)
Recommendations
- • Strengthen CSP by removing 'unsafe-eval'
Performance Headers
3 headers
Connection
Performance
close
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding,Cookie
Caching Headers
2 headers
Cache-Control
Caching
no-cache, no-store, must-revalidate
Last-Modified
Caching
Fri, 18 Apr 2025 10:08:07 GMT
Content Headers
1 headers
Content-Type
Content
text/html; charset=UTF-8
Server Headers
2 headers
Server
Server
cloudflare
X-Powered-By
Server
WP Engine
CORS Headers
4 headers
Access-Control-Allow-Headers
Cors
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Access-Control-Allow-Methods
Cors
GET, POST
Access-Control-Allow-Origin
Cors
https://www.sparkhire.com
Access-Control-Expose-Headers
Cors
Content-Length,Content-Range
Cookies Headers
1 headers
Set-Cookie
Cookies
__cf_bm=k.fh8vkm6qV.vvcL2qKYu7fpLuBVSAFR8h.8djeltwU-1768091281-1.0.1.1-k7kMiFwSfn93McN2YHK0hb9FqZ2mafT0dtLKJ07sz5Yr.Mk19wDYxjfE2w6Yi6kHWJ.rjQfzLBGFIYEklALGSrG..99osxX8FDCiYtQBLho; path=/; expires=Sun, 11-Jan-26 00:58:01 GMT; domain=.www.sparkhire.com; HttpOnly; Secure; SameSite=None
Other Headers
10 headers
Alt-Svc
Other
h3=":443"; ma=86400
Cf-Cache-Status
Other
DYNAMIC
Cf-Ray
Other
9bc04aaa1a0823cc-IAD
Cross-Domain-Policies
Other
master-only
Date
Other
Sun, 11 Jan 2026 00:28:01 GMT
Link
Other
<https://www.sparkhire.com/wp-json/wp/v2/resources/43>; rel="alternate"; title="JSON"; type="application/json"
X-Cache
Other
HIT: 27
X-Cache-Group
Other
normal
X-Cacheable
Other
SHORT
X-Permitted-Cross-Domain-Policies
Other
master-only
Recommendations
Enable compression (gzip/brotli) to improve performance
Consider removing X-Powered-By header to hide server technology