HTTP Headers Analysis for https://card.apply.hsbc.com.vn

Detected Technologies from Headers

See all in URL Inspect 2

Nginx

Express

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains;

Content-Security-Policy

Weak

* Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Present

strict-origin;

Permissions-Policy

Present

accelerometer=(), ambient-light-sensor=(), autoplay=(self); +21 more

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Significantly strengthen CSP directives

Performance Headers

Connection

Performance

close

Vary

Performance

Accept-Encoding

connection: close
vary: Accept-Encoding

Caching Headers

Etag

Caching

W/"4cf68-WPv911ozMg/1IArxqDaIJELNg10"

etag: W/"4cf68-WPv911ozMg/1IArxqDaIJELNg10"

Content Headers

Content-Length

Content

315240

Content-Type

Content

text/html; charset=utf-8

content-length: 315240
content-type: text/html; charset=utf-8

Server Headers

Server

nginx, AwesomeServer 2.2

X-Powered-By

Server

Express

server: nginx, AwesomeServer 2.2
x-powered-by: Express

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _csrf=FN4eqneChcH80epARDNkqIAr; Path=/
e2e_session_x=s%3A84Iq4YosMgOY5CuE99hjVGDj_GfmIiBZ.ylL2Kbn%2BCDEoV9jo7ufkyyhRlFNiwUHf3%2BWREhfskSw; Path=/; Expires=Thu, 19 Oct 2045 17:01:07 GMT

Other Headers

Date

Other

Thu, 15 Oct 2026 06:21:07 GMT

date: Thu, 15 Oct 2026 06:21:07 GMT

Recommendations

Enable compression (gzip/brotli) to improve performance

Add Cache-Control header to optimize caching

Consider removing X-Powered-By header to hide server technology