HTTP Headers Analysis for https://guide.actalis.com

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=63072000; includeSubDomains; preload;

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

sameorigin

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Good

no-referrer-when-downgrade

Permissions-Policy

Missing

Not configured

Recommendations

• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Content-Type-Options: nosniff
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

connection: close

Caching Headers

Cache-Control

Caching

no-cache, no-store, must-revalidate, max-age=0

Expires

Caching

Thu, 01 Jan 1970 00:00:00 GMT

Pragma

Caching

no-cache

cache-control: no-cache, no-store, must-revalidate, max-age=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache

Content Headers

Content-Length

Content

32931

Content-Type

Content

text/html;charset=UTF-8

content-length: 32931
content-type: text/html;charset=UTF-8

Server Headers

No server headers found

CORS Headers

Access-Control-Allow-Headers

Cors

Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId

Access-Control-Allow-Methods

Cors

GET, DELETE, OPTIONS, POST, PUT

Access-Control-Allow-Origin

Cors

*

Access-Control-Max-Age

Cors

3628800

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
access-control-allow-methods: GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin: *
access-control-max-age: 3628800

Cookies Headers

Set-Cookie

Cookies

set-cookie: JSESSIONID=D8566CA0244F2DF5830E7612EB77A457; Path=/; HttpOnly; Secure
csrf=hmpp7qnkjGwdGGyyvZI-iUEBMuBHEXXPRZcxycMzvzlBCWerux7TPXh-wpz9JkqHrUvtt1DWsemcU77bOA8AoQ:AAABnhny7EE:BVPKhnOFGHnA0N3PWoAF1Q; Secure
WEBSRV=trpi2xx-publ05; path=/; HttpOnly; Secure
cookiesession1=678B28D0E3EB01D41120EDE283D99C19;Expires=Wed, 12 May 2027 02:10:11 GMT;Path=/;HttpOnly

Other Headers

Date

Other

Tue, 12 May 2026 02:10:11 GMT

X-Magnolia-Registration

Other

Registered

date: Tue, 12 May 2026 02:10:11 GMT
x-magnolia-registration: Registered

Recommendations

Enable compression (gzip/brotli) to improve performance