Open
Cached
·
just now
21
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Excellent
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
Good
default-src; script-src; style-src; +9 more
default-src 'self'; script-src 'self' 'unsafe-inline' https://*.contra.com https://contra.com https://*.ads.linkedin.com https://snap.licdn.com https://connect.facebook.net https://www.facebook.com https://beehiiv-adnetwork-production.s3.amazonaws.com https://www.tiktok.com/embed.js https://www.instagram.com/embed.js https://www.youtube.com https://*.tiktokcdn-us.com https://gist.github.com https://platform.twitter.com https://challenges.cloudflare.com https://accounts.google.com https://apis.google.com https://googletagmanager.com https://www.googletagmanager.com https://*.doubleclick.net https://*.posthog.com https://app.intercom.io https://js.intercomcdn.com https://widget.intercom.io https://*.stripe.com https://*.airwallex.com https://static.hsappstatic.net/MeetingsEmbed/ex/MeetingsEmbedCode.js https://js.hscta.net https://*.hubspot.com https://*.hsleadflows.net https://*.hsforms.net https://*.hsforms.com; style-src 'self' 'unsafe-inline' https://builds.contra.com https://github.githubassets.com; img-src 'self' data: blob: https://*.contra.com https://*.ads.linkedin.com https://*.linkedin.com https://www.facebook.com https://storage.googleapis.com https://cdn.loom.com https://*.googleusercontent.com https://www.googletagmanager.com https://www.google.com https://*.intercom-attachments-1.com https://*.intercom-attachments-2.com https://*.intercom-attachments-3.com https://*.intercom-attachments-4.com https://*.intercom-attachments-5.com https://*.intercom-attachments-6.com https://*.intercom-attachments-7.com https://*.intercom-attachments-8.com https://*.intercom-attachments-9.com https://*.intercom-attachments.eu https://*.intercom.io https://*.intercomassets.com https://*.intercomassets.eu https://*.intercomcdn.com https://*.intercomcdn.eu https://*.intercomusercontent.com https://*.stripe.com https://*.stream-io-cdn.com https://no-cache.hubspot.com https://*.hubspot.com https://*.hsforms.net https://*.hsforms.com https://api.producthunt.com; font-src 'self' data: https://builds.contra.com https://fonts.gstatic.com https://*.intercomcdn.com; connect-src 'self' https://*.contra.com https://contra.api-fast.cloudinary.com https://*.ads.linkedin.com https://connect.facebook.net https://www.facebook.com https://ingestion.apiary.beehiiv.net blob: https://www.loom.com https://prod.spline.design https://storage.googleapis.com https://*.ingest.sentry.io https://*.google-analytics.com https://www.google.com https://*.posthog.com https://*.intercom.io https://*.intercomcdn.com https://*.intercomcdn.eu https://*.intercomusercontent.com wss://*.intercom.io https://*.stripe.com https://chat.stream-io-api.com wss://chat.stream-io-api.com https://*.airwallex.com https://*.hubspot.com https://*.hubapi.com; frame-src 'self' https://embed-v2.testimonial.to/ https://www.facebook.com/ https://instagram.com https://m.youtube.com https://platform.twitter.com https://player.vimeo.com https://rive.app https://www.instagram.com https://www.tiktok.com https://www.youtube.com https://www.loom.com https://www.behance.net https://www.canva.com https://codepen.io https://codesandbox.io https://share.descript.com https://www.figma.com https://embed.figma.com https://gist.github.com https://www.linkedin.com https://assets.pinterest.com https://replit.com https://w.soundcloud.com https://my.spline.design https://prod.spline.design https://open.spotify.com https://stackblitz.com https://docs.google.com https://inquiry.withpersona.com https://storage.googleapis.com https://challenges.cloudflare.com https://content.googleapis.com https://accounts.google.com https://content-people.googleapis.com https://www.googletagmanager.com https://*.doubleclick.net https://intercom-sheets.com https://*.stripe.com https://*.airwallex.com https://*.hubspot.com https://*.hs-sites.com https://*.hsforms.net https://*.hsforms.com https://*.figma.site https://*.bolt.host https://*.dreamflow.app https://*.netlify.app https://*.lovable.app https://*.figma.site https://*.replit.app https://*.vercel.app; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; media-src 'self' data: blob: https://media.contra.com https://builds.contra.com https://*.intercomcdn.com https://*.intercomcdn.eu https://*.stream-io-cdn.com; report-uri https://o382696.ingest.us.sentry.io/api/5302437/security/?sentry_key=3545da037ee749aa92a658508243b17d;
X-Frame-Options
Missing
Not configured
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Present
camera=(self "https://*.withpersona.com/"), display-capture=("https://us.i.posthog.com/"), fullscreen=(self "https://*.figma.com"), geolocation=(), microphone=(), publickey-credentials-get=(), screen-wake-lock=(), web-share=()
Recommendations
- • Strengthen CSP by removing 'unsafe-eval'
- • Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
Performance Headers
3 headers
Connection
Performance
close
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding
Caching Headers
1 headers
Cache-Control
Caching
public, max-age=60, stale-while-revalidate=86400
Content Headers
1 headers
Content-Type
Content
text/html;charset=utf-8
Server Headers
1 headers
Server
Server
cloudflare
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
GCLB=CMrIr4W8-JzvAxAD; path=/; HttpOnly; expires=Wed, 24-Dec-2025 23:34:16 GMT
Other Headers
9 headers
Accept-Ch
Other
DPR, Viewport-Width, Width
Alt-Svc
Other
h3=":443"; ma=86400
Cf-Cache-Status
Other
DYNAMIC
Cf-Ray
Other
9b33e71a3c95c9b7-IAD
Date
Other
Wed, 24 Dec 2025 23:33:16 GMT
Link
Other
<https://builds.contra.com/a4f12492/assets/static/src_generated_styled-system_styles-7a65ba32.CFMN1EJW.css>; rel=preload; as=style, <https://builds.contra.com/a4f12492/assets/static/style-04249a7d.DDURex0u.css>; rel=preload; as=style, <https://builds.contra.com/a4f12492/assets/entries/entry-client-routing.BqvkDa8Z.js>; rel="preload"; as="script"; crossorigin="anonymous", <https://builds.contra.com/a4f12492/assets/entries/entry-client-routing.BqvkDa8Z.js>; rel=modulepreload; as=script, <https://builds.contra.com/a4f12492/assets/entries/src_pages_index.07wde_NB.js>; rel="preload"; as="script"; crossorigin="anonymous", <https://builds.contra.com/a4f12492/assets/entries/src_pages_index.07wde_NB.js>; rel=modulepreload; as=script, <https://builds.contra.com/a4f12492/assets/chunks/chunk-kpF72Eph.js>; rel="preload"; as="script"; crossorigin="anonymous", <https://builds.contra.com/a4f12492/assets/chunks/chunk-kpF72Eph.js>; rel=modulepreload; as=script, <https://builds.contra.com/a4f12492/assets/chunks/chunk-DCqQsH2p.js>; rel="preload"; as="script"; crossorigin="anonymous", <https://builds.contra.com/a4f12492/assets/chunks/chunk-DCqQsH2p.js>; rel=modulepreload; as=script
Speculation-Rules
Other
"/cdn-cgi/speculation"
Via
Other
1.1 google
X-Contra-Release-Version
Other
a4f12492
Recommendations
Enable compression (gzip/brotli) to improve performance
Analysis completed in 450ms