HTTP Headers Analysis for https://enterprise.canva.com

Detected Technologies from Headers

See all in URL Inspect 35

Cloudflare NEL Monitoring

Clerk

Google Tag Manager

Google reCAPTCHA

Fullstory

HubSpot Forms

Factors.AI

Google Analytics

noembed

Iubenda

Segment

Cloudflare CDN

Datadog

Google Static File Front End

Next.js

Google Fonts

Entri

unpkg

Google Search

Adobe Marketo

Plausible Analytics

Demandbase

Qualified

Amazon S3

StackAdapt

OneTrust

Usercentrics

AWS

Vercel

IP-API

Vector

YouTube

BigMarker

Sentry

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

Good

default-src; script-src; worker-src; +10 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

no-referrer-when-downgrade

Permissions-Policy

Present

camera=*, microphone=*, geolocation=(); +1 more

Recommendations

• Strengthen CSP by removing 'unsafe-eval'
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, accept-encoding

connection: close
transfer-encoding: chunked
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, accept-encoding

Caching Headers

Age

Caching

0

Cache-Control

Caching

private, no-cache, no-store, max-age=0, must-revalidate

age: 0
cache-control: private, no-cache, no-store, max-age=0, must-revalidate

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

Server

cloudflare

X-Powered-By

Server

Next.js

server: cloudflare
x-powered-by: Next.js

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: __cf_bm=nGECt2A2RYDVVgqWYZ9Z4xYBtq5NQLkoc4cq1H3V_3U-1777035106-1.0.1.1-lynbwaCyGu4argdt_Jrpl_GRaFWdBN7_GQ3p4BvuO6VpLrJW1JXmwdGZYiAMhdNUxDxt4e6P0TeV2m4yaSmmRBjBY11ztSPbygtb4f6le74; path=/; expires=Fri, 24-Apr-26 13:21:46 GMT; domain=.canva.com; HttpOnly; Secure; SameSite=None
_cfuvid=E8kj.OVC0KZj2nskXgpTcRZy.MPIOIoeBrvs7VGB0GY-1777035106600-0.0.1.1-604800000; path=/; domain=.canva.com; HttpOnly; Secure; SameSite=None

Other Headers

Cf-Cache-Status

Other

DYNAMIC

Cf-Ray

Other

9f153dc74e6edfc2-IAD

Date

Other

Fri, 24 Apr 2026 12:51:46 GMT

Link

Other

URL /

rel=preconnect crossorigin

Nel

Other

Report-To Group cf-nel max-age: 1w

success: 1.0%

Report-To

Other

Group cf-nel max-age: 1w

Endpoint 1 https://a.nel.cloudflare.com/report/v4?s=g9SJmREDP68wtkK3LtZ2BN%2B%2BlSFnyw0ieqv9v4vXwys1au9bZuIP8iaaUxLtXA2C%2BQQHRVfk%2BYt9r5CtZNfvSH8S5g3YRv2LIepL2ol2itbmapCQC%2Bu0z3jqpuoy2TCJvTgZ2Fd6

X-Clerk-Auth-Reason

Other

session-token-and-uat-missing

X-Clerk-Auth-Status

Other

signed-out

X-Matched-Path

Other

/

X-Vercel-Cache

Other

MISS

X-Vercel-Id

Other

iad1::iad1::dzf7f-1777035106509-2564d424f220

cf-cache-status: DYNAMIC
cf-ray: 9f153dc74e6edfc2-IAD
date: Fri, 24 Apr 2026 12:51:46 GMT
link: </>; rel=preconnect; crossorigin=""
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g9SJmREDP68wtkK3LtZ2BN%2B%2BlSFnyw0ieqv9v4vXwys1au9bZuIP8iaaUxLtXA2C%2BQQHRVfk%2BYt9r5CtZNfvSH8S5g3YRv2LIepL2ol2itbmapCQC%2Bu0z3jqpuoy2TCJvTgZ2Fd6"}],"group":"cf-nel","max_age":604800}
x-clerk-auth-reason: session-token-and-uat-missing
x-clerk-auth-status: signed-out
x-matched-path: /
x-vercel-cache: MISS
x-vercel-id: iad1::iad1::dzf7f-1777035106509-2564d424f220

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology