Open
Cached
·
just now
22
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=31536000 ; includeSubDomains
Content-Security-Policy
Good
default-src; manifest-src; style-src; +3 more
default-src *.amazonaws.com 'self' localhost:11001 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; script-src 'self' 'unsafe-inline' maps.googleapis.com code.jquery.com geoip-js.com www.google.com maps.googleapis.com pro.ip-api.com www.gstatic.com; style-src-elem 'self' 'unsafe-inline' www.gstatic.com;
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Present
geolocation=(),midi=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Strengthen CSP by removing 'unsafe-eval'
Performance Headers
2 headers
Connection
Performance
close
Vary
Performance
Sec-Fetch-Dest,Sec-Fetch-Mode,Sec-Fetch-Site,Sec-Fetch-User
Caching Headers
3 headers
Cache-Control
Caching
max-age=0, no-cache, no-store
Expires
Caching
Thu, 15 Jan 2026 09:09:20 GMT
Pragma
Caching
no-cache
Content Headers
3 headers
Content-Language
Content
en
Content-Length
Content
16286
Content-Type
Content
text/html;charset=UTF-8
Server Headers
0 headers
No server headers found
CORS Headers
1 headers
Access-Control-Allow-Origin
Cors
*
Cookies Headers
1 headers
Set-Cookie
Cookies
JSESSIONID=0f64633a78864e42a5096b990f1843e6; Path=/; Secure; HttpOnly; SameSite=none
Other Headers
4 headers
Content-Security-Policy-Report-Only
Other
object-src 'none'; script-src 'nonce-pZCYGT6xc3Hakov62dsLhrTp' 'strict-dynamic' http: https:; base-uri 'none';
Cross-Origin-Embedder-Policy-Report-Only
Other
require-corp
Date
Other
Thu, 15 Jan 2026 09:09:20 GMT
X-Permitted-Cross-Domain-Policies
Other
master-only
Recommendations
Enable compression (gzip/brotli) to improve performance