HTTP Headers Analysis for https://heartlessgroup.com

Open Cached · just now

28 Headers

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; preload; includeSubDomains

Content-Security-Policy

Basic

default-src; script-src; style-src; +10 more

X-Frame-Options

Excellent

DENY

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Present

accelerometer=(self), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(self), gyroscope=(self), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(self), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"

Recommendations

• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)

Performance Headers

2 headers

Connection

Performance

Vary

Performance

Accept-Encoding

Caching Headers

3 headers

Cache-Control

Caching

private, no-cache, no-store, must-revalidate

Expires

Caching

Sat, 01 Jan 2000 00:00:00 GMT

Pragma

Caching

no-cache

Content Headers

2 headers

Content-Length

Content

Content-Type

Content

text/html; charset="utf-8"

Server Headers

0 headers

No server headers found

CORS Headers

0 headers

No CORS headers found

Cookies Headers

0 headers

No cookies headers found

Other Headers

13 headers

Alt-Svc

Other

h3=":443"; ma=86400

Content-Security-Policy-Report-Only

Other

default-src *.facebook.com *.fbcdn.net *.instagram.com blob:;script-src *.instagram.com static.cdninstagram.com *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-U06sZuSp' blob: 'self' https://*.google-analytics.com https://translate.google.com https://apis.google.com https://accounts.google.com 'report-sample';style-src *.instagram.com static.cdninstagram.com data: blob: 'unsafe-inline' *.fbcdn.net *.facebook.com;connect-src *.instagram.com wss://edge-chat.instagram.com connect.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* ws://localhost:* blob: *.cdninstagram.com wss://*.instagram.com:* 'self' https://meta.privacy-gateway.cloudflare.com/relay;font-src *.instagram.com static.cdninstagram.com data: *.fbcdn.net *.intern.facebook.com *.facebook.com https://fonts.gstatic.com;img-src *.instagram.com *.facebook.com *.fbcdn.net data: *.cdninstagram.com *.whatsapp.net blob: *.fbsbx.com android-webview-video-poster: *.oculuscdn.com *.giphy.com *.tenor.co *.tenor.com www.googleadservices.com *.doubleclick.net *.google.com *.google.co.uk https://www.gstatic.com https://*.google-analytics.com;media-src *.facebook.com *.fbcdn.net *.instagram.com *.cdninstagram.com *.fbsbx.com data: blob: https://*.giphy.com *.tenor.co *.tenor.com;child-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;frame-src *.instagram.com *.facebook.com *.fbsbx.com fbsbx.com data: www.googleadservices.com *.doubleclick.net *.google.com *.google.co.uk;manifest-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;object-src *.facebook.com *.fbcdn.net *.instagram.com data: blob:;block-all-mixed-content;report-uri https://www.facebook.com/csp/reporting/?minimize=0;

Cross-Origin-Embedder-Policy-Report-Only

Other

require-corp;report-to="coep_report"

Date

Other

Wed, 11 Feb 2026 14:35:05 GMT

Document-Policy

Other

include-js-call-stacks-in-crash-reports

Origin-Agent-Cluster

Other

Origin-Trial

Other

ArDvqjFKr1fHThlSM8Kkp74sxlOCFTeqYJMXCGqCG/VJmcYlO/0UavmpqPDit2KppDf1THInNpwA36GmtgPOug8AAAB2eyJvcmlnaW4iOiJodHRwczovL3d3dy5pbnN0YWdyYW0uY29tOjQ0MyIsImZlYXR1cmUiOiJDcmFzaFJlcG9ydGluZ1N0b3JhZ2VBUEkiLCJleHBpcnkiOjE3NzY3Mjk2MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==

Proxy-Status

Other

http_request_error; e_fb_vipaddr="AcOwP2d0fCuhZuUcKCQ_r3o0-JHnWS1yMrE09fzdZdGuSJGJSne4TxdPfyysV0ZKPe-zIxIzgN9xBYiUkyiwUcLwZ_lBapoFSUB8_nNu"; e_clientaddr="AcMqkWxy1hkMwPnRR1dzOwtu1OlAhBztpdxt9e13aeuUoo3ZOJ_3k5t5FePnyDfXix8ws3K5Vjcy9YWKnlcaxgHg2j7S-TkNMvORRO4GOvMqdJtmKA"; e_upip="AcNwFxqsu_R5AIpqgGe_JRhlaP2xoPKHFIglbze-qdEeTx7mlNY05e1Apr5s85Yxx45POe0cPsVSsUviSyigB4eMh5xXmo9ZROnxBhD5Goc"; e_fb_zone="AcPZbdBDCaz-K-Gq5BGfYHZoiELgTRw760yUUKdpHhe0XdXirP5p3N8eaCgZiF5u"; e_fb_twtaskhandle="AcPSqo9WYvuXfWcxaYQ5SkgDO2KnB_vgssZL-KOCx7T_VYL1gS2YdJgIAYrfn_aDWWySDDh9vT3rYhF37O3leyshQ8cpgtviakk1YmEg"; e_proxy="AcPA6FpEgKtxC-vkhMpx7NFW91caVfY78Zcm0rrB2AlWBpimILXZ65Qn6l4tlbR8O9KMrJo_TRzCObNUEPZv", http_request_error; e_fb_vipaddr="AcN0TcZ4SNQbt5ai7mpXMCsnQ36GRH88FGcU6Kz1ZJRdj3f1lC_FidyLq1hM05f-BbOeAVJQ"; e_clientaddr="AcM6t8QuWSMHk5-NlXlPfRYZzgjqq-8LzLtiIVAaDHbzA-nV-Nx05FlyCLTcU4k5ZnyS190jw75xOP5ckQ"; e_upip="AcMnO6XvXRLYtBI4Nn4BYDpDl-bQwcZU059KcEAc9coJzTDajN429Tm9nkgUPDrDS2W-8GtzIwVBdtMgYKYus8bSqGG1E7l6OUAMZZkb"; e_fb_zone="AcPT-zydtEshzhYqtOsFWhvroDQFDkGWtOj5HeWWHPg5TSve1WkFYjwNJqngrg"; e_fb_twtaskhandle="AcPfNnrHofleVe34E04FOvE1PHB1Ky7ytqOdl-YlOpnxGaHy2sHGVB4f0bJEfCnzVsSBPmAiYDL047trt_u7Ymku7IMHCF35Uthk"; e_proxy="AcPg4yIybLDo-azSNMKCRcIYyy8JN-Zs0zRanN6jYp_p91HWH_9yzFBzlLFwTrLsHGJOoWYbwrUKdkA"

Report-To

Other

{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.instagram.com\/error\/ig_web_error_reports\/?device_level=unknown&brsid=7605616157660693532&cpp=C3&cv=1033279839&st=1770820505693"}]}

Reporting-Endpoints

Other

coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.instagram.com/error/ig_web_error_reports/?device_level=unknown&brsid=7605616157660693532&cpp=C3&cv=1033279839&st=1770820505693"

X-Fb-Connection-Quality

Other

UNKNOWN; q=-1, rtt=-1, rtx=0, c=13, mss=1368, tbw=3542, tp=-1, tpl=-1, uplat=50, ullat=0

X-Fb-Debug

Other

5RRXotLsTYpWBahS/K7EDE/nySIwBpDpbpXnRGv88iAOlrkAhhyXIEJ0HXJlbOV/MOre2M1iXjm0UfMqrQsddA==

X-Stack

Other

www

Recommendations

Enable compression (gzip/brotli) to improve performance