HTTP Headers Analysis for https://docs.document360.com

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

Missing

Not configured

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Present

accelerometer=(), ambient-light-sensor=(), autoplay=(*), camera=(*), clipboard-write=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(*), midi=(), payment=(), usb=(), fullscreen=(*)

Recommendations

• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Content-Type-Options: nosniff

Performance Headers

3 headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding

Caching Headers

2 headers

Cache-Control

Caching

public, max-age=0, stale-while-revalidate=300, stale-if-error=60

Etag

Caching

W/"7fc02-ZTYCRl9RtLSSP6HAXaFbu2eN0jI"

Content Headers

1 headers

Content-Type

Content

text/html; charset=utf-8

Server Headers

1 headers

Server

cloudflare

CORS Headers

0 headers

No CORS headers found

Cookies Headers

1 headers

Set-Cookie

Cookies

__cf_bm=a4rzQxl7RH8PANh7Jh23ePENIe4fb0MqlddoRsxUCik-1768520096.1744936-1.0.1.1-YuY_VayyDKycDIFq0cHeTNmeQPxzLrj3xdgxGzTEbuH4Fv6UX_STGWLh7FczFhH0WEG1ulAKHU0P7AqN1UoEqsE9WdTdRev.qe.6D7HAlNgeLtxIaDm30ty2uNQEtrWK; HttpOnly; Secure; Path=/; Domain=document360.io; Expires=Fri, 16 Jan 2026 00:04:56 GMT