HTTP Headers Analysis for https://mailosaur.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31536000; includeSubdomains; preload

Content-Security-Policy

Missing

Not configured

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

3 headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Vary

Performance

Accept-Encoding

Caching Headers

4 headers

Cache-Control

Caching

no-cache, no-store, must-revalidate

Etag

Caching

"696e2fc7-1d2a8"

Expires

Caching

-1

Last-Modified

Caching

Mon, 19 Jan 2026 13:21:11 GMT

Content Headers

2 headers

Content-Length

Content

119464

Content-Type

Content

text/html

Server Headers

1 headers

Server

nginx

CORS Headers

0 headers

No CORS headers found

Cookies Headers

0 headers

No cookies headers found

Other Headers

4 headers

Alt-Svc

Other

h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Content-Security-Policy-Report-Only

Other

default-src 'self' mailosaur.com *.mailosaur.com; block-all-mixed-content; base-uri 'self'; object-src 'none'; child-src blob: 'self' mailosaur.com *.mailosaur.com; frame-ancestors 'self'; form-action 'self' https://*.hsforms.com https://*.hsforms.net; worker-src 'self' blob:; media-src 'self' mailosaur.com *.mailosaur.com data:; manifest-src 'self'; script-src 'report-sample' 'unsafe-inline' 'self' https://*.googletagmanager.com https://www.googleadservices.com https://www.google.com https://pagead2.googlesyndication.com https://googleads.g.doubleclick.net www.google.com/recaptcha/ www.gstatic.com/recaptcha/ *.hubspot.com *.hubapi.com *.hsforms.com *.hsforms.net *.hs-scripts.com *.hubspotfeedback.com *.hs-banner.com *.hs-analytics.net *.hsadspixel.net *.usemessages.com *.clarity.ms c.bing.com snap.licdn.com px.ads.linkedin.com www.linkedin.com https://checkout.stripe.com https://*.js.stripe.com https://js.stripe.com https://maps.googleapis.com; style-src 'self' 'unsafe-inline' * fonts.googleapis.com; img-src 'self' blob: data: *; connect-src 'self' https: wss: data:; frame-src 'self' mailosaur.com *.mailosaur.com https://www.googletagmanager.com www.google.com/recaptcha/ recaptcha.google.com/recaptcha/ *.hubspot.com *.hsforms.com *.hsforms.net youtube.com www.youtube.com www.youtube-nocookie.com https://checkout.stripe.com https://*.js.stripe.com https://js.stripe.com https://hooks.stripe.com 77ny65ssgfhb.statuspage.io; font-src 'self' data: *; report-uri https://defaultd49da0b1914148b1b00d58ac067d4c.f4.environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/388700022bff49ee9ef17517b8124f9f/triggers/manual/paths/invoke?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=Jr3G8M8cT5gUWid56rJ1oyfptKuo3ycWCXeEr9-xGjA;

Date

Other

Fri, 23 Jan 2026 04:44:41 GMT

Via

Other

1.1 google

Recommendations

Enable compression (gzip/brotli) to improve performance