HTTP Headers Analysis for https://icet-stp.cvs.com

Detected Technologies from Headers

See all in URL Inspect 7

Akamai

Bing

BootstrapCDN

Cloudflare

Cloudflare CDN

jQuery

YouTube

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31104000 ; includeSubDomains

Content-Security-Policy

Basic

default-src; script-src; frame-src Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

connection: close

Caching Headers

Cache-Control

Caching

max-age=0, no-cache, no-store

Expires

Caching

Fri, 11 Sep 2026 11:08:00 GMT

Last-Modified

Caching

Fri, 31 Mar 2023 16:28:58 GMT

Pragma

Caching

no-cache

cache-control: max-age=0, no-cache, no-store
expires: Fri, 11 Sep 2026 11:08:00 GMT
last-modified: Fri, 31 Mar 2023 16:28:58 GMT
pragma: no-cache

Content Headers

Content-Length

Content

5873

Content-Type

Content

text/html

content-length: 5873
content-type: text/html

Server Headers

No server headers found

CORS Headers

Access-Control-Allow-Headers

Cors

env,grid, env,grid

Access-Control-Allow-Origin

Cors

icet-stp.cvs.com

access-control-allow-headers: env,grid, env,grid
access-control-allow-origin: icet-stp.cvs.com

Cookies Headers

Set-Cookie

Cookies

set-cookie: adh_ps_refill=off; path=/
cmk_auth_ten=off-p0; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
db-show-medicare=off; path=/
disable-sac=off; path=/
dfl=off; path=/
db-show-allrx=on; path=/
disable-app-dynamics=on; path=/
icev2=off-p2; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
ice-phr-offer=off; path=/
v3redirecton=false; path=/
memberlite=off; path=/
pbmplaceorder=off; path=/
pbmrxhistory=on; path=/
ps=on; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
recent_orders_filter_new=on; path=/
refill_chkbox_remove=off-p0; expires=Fri, 25-Sep-2026 11:08:00 GMT; path=/
rxd_bnr=on; path=/
rxd_dot_bnr=on; path=/
rxlite=on; path=/
rxlitelob=off; path=/
rxhp=on; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
rxm=on; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
rxm_phone_dob=off-p0; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
sftg=off-p2; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
show_exception_status=on; expires=Tue, 10-Nov-2026 11:08:00 GMT; path=/
_abck=884F9EE93C92B28EB6F00F82E61F915E~-1~YAAQ3AwDF31mlHygAQAAfScnkBD9M434DKFAF3HF0wCGveilqqA18UQgLIqC+xO6jQkZ+XaPZX6Fh/4zzBzbbtrtVQ2NWlfCMdZVMILiwY59BvK0IETfw2fydb4qrVBQSU5zwB//A/gKk7D/i3qVb2t6L/3wWTIAAw12BhtSCo0CmVYM+H2Yg5+Ko6tQy6UY0O2epYkTK8/X9QJPHt9sb0p/Cxs4ukq0szysS9BoXHR8PP9nwYJm2Pun8EcPruQ/oI+eI+eBTEZZoujqrBSqSfIIjMDGeAJAa6AD0AlfP5x/02kxajMBk6c4FXzWCvRV5oa6clSyb3ZZT+9ePXXDTh+BZXFAOw2STxkgOp1ismlb08e12fu7jJedvY811UWioeek1u0EZ36LRAnXQ3OFVJKrlQZPt4t5fD5uBZTrIprbbzjK0Pc/D6ZNdpJAm3TvvTM=~-1~-1~-1~-1~-1; Domain=.cvs.com; Path=/; Expires=Sat, 11 Sep 2027 11:08:00 GMT; Max-Age=31536000; Secure
bm_sz=134EA9D4EE3E4AB282CB79F8E42F57AB~YAAQ3AwDF35mlHygAQAAfScnkAGEZDOk6HdW/pYwW+CLEWPSKDUqlA52zS62oP9JPPny8qkIkVa3Cs3l07udDydx1kJ7DZtnSGa5J2mfs51wh162rmoSeU53qQKpywKtA2qq/DIpY4vEOpfv5SyF8TJHo7As8NsWXtDQZEu2D4/D4hSg41AMrV+MQiSinIBTIpr8ml2v3vZloyOFrTRv6v4IRuRPCyDAuAT+T06eEOpWMuCvnIBlXxlU16wX+uojljH6RrrBSD4Mgtq1xg7ZUm1CSIGA3veOiarCoBq8VfjATPnSPYxUuadNEffyzn3QCJ8kkKjfEJyxjnmGLDUUTh11OiAYN+qZTel6~3552305~3355457; Domain=.cvs.com; Path=/; Expires=Fri, 11 Sep 2026 15:08:00 GMT; Max-Age=14400

Other Headers

Date

Other

Fri, 11 Sep 2026 11:08:00 GMT

X-Akamai-Transformed

Other

0 - 0 -

X-Content-Security-Policy

Other

script-src 'self'; object-src 'self'

X-Req

Other

ut,1789124880,23.3.12.220:2d162fba,

date: Fri, 11 Sep 2026 11:08:00 GMT
x-akamai-transformed: 0 - 0 -
x-content-security-policy: script-src 'self'; object-src 'self'
x-req: ut,1789124880,23.3.12.220:2d162fba,

Recommendations

Enable compression (gzip/brotli) to improve performance