Open
Cached
·
2h ago
19
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=31536000
Content-Security-Policy
Good
default-src; script-src; style-src; +10 more
default-src 'self' ; script-src 'self' 'nonce-86MIJnaantKR1yRN0YNNeg==' 'strict-dynamic' 'report-sample' ; style-src 'report-sample' 'self' 'unsafe-inline' https://account.creoline.com https://assets.cstatic.io https://assets.cstatic.com https://metrics.creoline.com ; object-src 'none' ; base-uri 'self' ; connect-src 'self' https://api.creoline.com https://assets.cstatic.io https://assets.cstatic.com https://analytics.creoline.com https://insights.creoline.com https://metrics.creoline.com https://api-iam.eu.intercom.io wss://nexus-europe-websocket.intercom.io https://uploads.intercomcdn.eu/ ; font-src 'self' https://account.creoline.com data: https://assets.cstatic.io data: https://assets.cstatic.com data: https://fonts.intercomcdn.com ; frame-src 'self' ; img-src 'self' data: https://account.creoline.com https://assets.cstatic.io https://assets.cstatic.com https://avatars.cstatic.io https://avatars.cstatic.com https://downloads.intercomcdn.eu https://js.intercomcdn.com https://static.intercomassets.eu ; manifest-src 'self' ; media-src 'self' https://js.intercomcdn.com https://assets.cstatic.io https://assets.cstatic.com https://account.creoline.com ; report-to creoline ; worker-src blob: https://www.creoline.com ;
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
no-referrer-when-downgrade
Permissions-Policy
Present
geolocation=(),camera=(),microphone=(),payment=(),fullscreen=(self),usb=(),bluetooth=(),midi=(),magnetometer=(),gyroscope=(),accelerometer=(),clipboard-read=(self),clipboard-write=(self),gamepad=(),autoplay=(),web-share=(),screen-wake-lock=(),xr-spatial-tracking=()
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Strengthen CSP by removing 'unsafe-eval'
Performance Headers
3 headers
Connection
Performance
close
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding
Caching Headers
1 headers
Cache-Control
Caching
no-cache, private
Content Headers
1 headers
Content-Type
Content
text/html; charset=utf-8
Server Headers
1 headers
Server
Server
creoline
CORS Headers
0 headers
No CORS headers found
Cookies Headers
0 headers
No cookies headers found
Other Headers
7 headers
Alt-Svc
Other
h3=":443"; ma=86400
Date
Other
Sat, 27 Dec 2025 03:13:55 GMT
Reporting-Endpoints
Other
creoline="https://api.creoline.com/v1/report/d"
X-Creoline
Other
Edge
X-Creoline-Backend
Other
a.app.creoline.com
X-Creoline-Cache
Other
STALE
X-Creoline-Edge
Other
a.http.edge.creoline.net
Recommendations
Enable compression (gzip/brotli) to improve performance
Analysis completed in 291ms