HTTP Headers Analysis for https://hsbc.co.id

Detected Technologies from Headers

See all in URL Inspect 17

Adobe Target

Adobe Helix RUM

Akamai Active incidents

Apache

AWS CloudFront

Brightcove

Google API JS Client

Google Conversion Tracking

Google DoubleClick

Google Search

Google Static File Front End

Google Tag Manager

Optimizely

Tealium

Twitter

Yahoo

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31536000; includeSubdomains

Content-Security-Policy

Basic

default-src; script-src; img-src; +12 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Vary

Performance

Accept-Encoding

accept-ranges: bytes
connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

max-age=60, s-maxage=60, stale-if-error=3600

Last-Modified

Caching

Fri, 09 Oct 2026 07:18:28 GMT

cache-control: max-age=60, s-maxage=60, stale-if-error=3600
last-modified: Fri, 09 Oct 2026 07:18:28 GMT

Content Headers

Content-Length

Content

124887

Content-Type

Content

text/html;charset=utf-8

content-length: 124887
content-type: text/html;charset=utf-8

Server Headers

Server

Apache

server: Apache

CORS Headers

No CORS headers found

Cookies Headers

No cookies headers found

Other Headers

Alt-Svc

Other

h3=":443"; ma=86400

Date

Other

Fri, 09 Oct 2026 20:08:01 GMT

S

Other

dispatcher3apeast1-b80

Server-Timing

Other

cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=70,cdn-upstream-fbl;dur=142,cdn-cache-miss,cdn-pop;desc="IAD55-P10",cdn-rid;desc="H0cfVltRsQqKIdH_F3X7QTjZ1ND2TXeh3ToR_p8S9P-vEFYnQ0g-ag==",cdn-downstream-fbl;dur=399

Via

Other

1.1 d6b0796641ad9e40cce4a9874d43cd3a.cloudfront.net (CloudFront)

X-Amz-Cf-Id

Other

H0cfVltRsQqKIdH_F3X7QTjZ1ND2TXeh3ToR_p8S9P-vEFYnQ0g-ag==

X-Amz-Cf-Pop

Other

IAD55-P10

X-Cache

Other

Miss from cloudfront

alt-svc: h3=":443"; ma=86400
date: Fri, 09 Oct 2026 20:08:01 GMT
s: dispatcher3apeast1-b80
server-timing: cdn-upstream-layer;desc="Origin Shield",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=70,cdn-upstream-fbl;dur=142,cdn-cache-miss,cdn-pop;desc="IAD55-P10",cdn-rid;desc="H0cfVltRsQqKIdH_F3X7QTjZ1ND2TXeh3ToR_p8S9P-vEFYnQ0g-ag==",cdn-downstream-fbl;dur=399
via: 1.1 d6b0796641ad9e40cce4a9874d43cd3a.cloudfront.net (CloudFront)
x-amz-cf-id: H0cfVltRsQqKIdH_F3X7QTjZ1ND2TXeh3ToR_p8S9P-vEFYnQ0g-ag==
x-amz-cf-pop: IAD55-P10
x-cache: Miss from cloudfront

Recommendations

Enable compression (gzip/brotli) to improve performance