HTTP Headers Analysis for https://distribution.cantook.com

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains

Content-Security-Policy

Missing

Not configured

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Add Content-Security-Policy header to prevent XSS attacks
• Consider adding Permissions-Policy to control browser features

Performance Headers

2 headers

Connection

Performance

close

Vary

Performance

Accept-Encoding

Caching Headers

2 headers

Cache-Control

Caching

max-age=0, private, must-revalidate

Etag

Caching

W/"07cfca998d835ec2037dee3e0df3a62a"

Content Headers

2 headers

Content-Length

Content

5159

Content-Type

Content

text/html; charset=utf-8

Server Headers

1 headers

X-Runtime

Server

0.005020

CORS Headers

0 headers

No CORS headers found

Cookies Headers

1 headers

Set-Cookie

Cookies

cant-prod-na=0a0707685534f3a4bbd7775a0a3325ee|cd9d9f6fc62b5856edbf58b9ca83f4ea; Expires=Sun, 25-Jan-26 21:28:55 GMT; Max-Age=172800; Path=/admin; Secure; HttpOnly; SameSite=Strict

Other Headers

5 headers

Content-Security-Policy-Report-Only

Other

default-src 'none'; frame-src 'self'; img-src 'self' https://storage.googleapis.com/ https://assets.cantook.net/ https://assets.entrepotnumerique.com/ https://assets.edenlivres.fr/ https://assets-libr.cantook.net/ https://assets-edgt.cantook.net/; script-src 'self' https://cdn.jsdelivr.net/npm/[email protected]/build/js/utils.js; style-src 'self' 'unsafe-inline'; connect-src 'self' https://storage.googleapis.com/ https://o37564.ingest.sentry.io; report-uri https://o37564.ingest.sentry.io/api/84541/security/?sentry_key=0b6a319c2af64d94839478210ee88f6c&sentry_environment=prod-northamerica

Date

Other

Fri, 23 Jan 2026 21:28:55 GMT

X-Download-Options

Other

noopen

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

caab6f403e274e5d4f99548c446328eb