HTTP Headers Analysis for https://cmp.optimizely.com

Detected Technologies from Headers

See all in URL Inspect 8

Adobe Fonts (Typekit)

AWS CloudFront

Google API JS Client

Google Search

Google Static File Front End

Optimizely

Zendesk

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=15552000; includeSubDomains

Content-Security-Policy

Basic

style-src; script-src; img-src; +3 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Vary

Performance

Accept-Encoding

connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

no-cache,no-store,must-revalidate,private

Etag

Caching

W/"16df-00CZVczdtrkHAluxlKptXBcUI2g"

Pragma

Caching

no-cache

cache-control: no-cache,no-store,must-revalidate,private
etag: W/"16df-00CZVczdtrkHAluxlKptXBcUI2g"
pragma: no-cache

Content Headers

Content-Length

Content

5855

Content-Type

Content

text/html; charset=utf-8

content-length: 5855
content-type: text/html; charset=utf-8

Server Headers

No server headers found

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _csrf=ojfmug0MPdlTk90HHorLJDep; Domain=accounts.cmp.optimizely.com; Path=/; HttpOnly; Secure; SameSite=Strict
cmp.accounts.sid=s%3AHa-SQXmq_ZxP7EekJ6ryptNJ9e6bahBw.%2BF9UE3VF0c1cytfHT%2FqWloSUqVLgn7CTaNdZU0T5RyU; Domain=accounts.cmp.optimizely.com; Path=/; Expires=Fri, 25 Sep 2026 11:35:55 GMT; HttpOnly; Secure; SameSite=None

Other Headers

Date

Other

Wed, 26 Aug 2026 11:35:55 GMT

Via

Other

1.1 776fbf9a4fc4b393f157f9f75dd29a06.cloudfront.net (CloudFront)

X-Amz-Cf-Id

Other

VijoPQlUO25o9j_j1u3Z8WWxkKAKgwVJdtXQvqbiF5E3Kn2RVvy_fQ==

X-Amz-Cf-Pop

Other

IAD55-P5

X-Cache

Other

Miss from cloudfront

X-Content-Security-Policy

Other

style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Webkit-Csp

Other

style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

date: Wed, 26 Aug 2026 11:35:55 GMT
via: 1.1 776fbf9a4fc4b393f157f9f75dd29a06.cloudfront.net (CloudFront)
x-amz-cf-id: VijoPQlUO25o9j_j1u3Z8WWxkKAKgwVJdtXQvqbiF5E3Kn2RVvy_fQ==
x-amz-cf-pop: IAD55-P5
x-cache: Miss from cloudfront
x-content-security-policy: style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:
x-dns-prefetch-control: off
x-download-options: noopen
x-webkit-csp: style-src 'self' 'unsafe-inline' *.googleapis.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.typekit.net *.google.com *.gstatic.com *.zdassets.com track.gaconnector.com https://analytics.newscred.com https://fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; img-src 'self' data: *.typekit.net *.google.com *.googleapis.com *.newscred.com *.welcomesoftware.com *.cmp.optimizely.com *.cmp-dev.optimizely.com *.cmp-prep.optimizely.com; frame-src https://www.google.com; connect-src *.zdassets.com *.zendesk.com track.gaconnector.com fs.welcomesoftware.com https://login.optimizely.com https://prep.login.optimizely.com; font-src 'self' https: data:

Recommendations

Enable compression (gzip/brotli) to improve performance