HTTP Headers Analysis for https://math.imaginelearning.com

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains

Content-Security-Policy

Basic

default-src; script-src; style-src; +6 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Present

ALLOW-FROM http://app.pendo.io/in-app/guides, SAMEORIGIN

X-Content-Type-Options

Present

nosniff, nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding

connection: close
transfer-encoding: chunked
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

max-age=0, private, must-revalidate

Etag

Caching

W/"8703b41017e0ebce1c8883918e46d6aa"

cache-control: max-age=0, private, must-revalidate
etag: W/"8703b41017e0ebce1c8883918e46d6aa"

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

X-Runtime

Server

0.019281

x-runtime: 0.019281

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: XSRF-TOKEN=KVb1w7l7zZn-G-X6BTcq35_PRWSdobgDWgsh0H_S5zqIrz09MoB6CMUlowe7XaUa57D8YDieqK6xR8uw2Cvfsg; path=/; SameSite=Lax
_apangea_session=uwYiVEd%2FHHU%2BMWmFB1rc6QQYeQwVoy%2F6828S8hMXPzo8FcPKxGKswdxJw4w3X7M26ehTYAP4V7tUCBM8loKznZA%2B8Xf5iKUMZtrrOxcYHhhtAHU82rwlqArk9WdVsxSLE8A%2F83oYnQvfDfEpL%2FxDGMTF7Swi45kvtbgX3aLY20E02q3UT2MJ6vaVJR9ofLEjed%2BJmtSEnraIU4ytWMzZy5bQ4GNeKTq%2BdyhkIRBMhqlbEyA11lat42f3jpnw0lSUAnqEQuojDBfVQbeCYg12YZmfEmwNcYG%2BvAQtmPcpRUDUyzh6auvykY4U9lpq3znu--WXdDnscpuPPIJBHN--4ECoa7TEjriFfHnmKmkjDw%3D%3D; path=/; secure; HttpOnly; SameSite=Lax

Other Headers

Date

Other

Mon, 04 May 2026 13:29:07 GMT

Link

Other

URL /packs/js/newrelic-0cfa02b00bf7e372f1e2.js

rel=preload as=script nopush

URL /assets/login_common-c8e9a000a377d033b4efd369b21f1e9082301c2c00df14ffa4e56a2adcdeab60.js

rel=preload as=script nopush

URL /assets/compression_check-09da6cf25574a7b696c9f87adb3f3259e167dcc5382a0711101406111d33e404.js

rel=preload as=script nopush

URL /assets/bootstrap-5.3.3.bundle.min-99c747a23e03171045f40e6f3625e6155895d34ebad5fd0c45ba14e72814a7a7.js

rel=preload as=script nopush

URL /packs/js/newrelic-0cfa02b00bf7e372f1e2.js

rel=preload as=script nopush

URL /assets/login_common-c8e9a000a377d033b4efd369b21f1e9082301c2c00df14ffa4e56a2adcdeab60.js

rel=preload as=script nopush

URL /assets/compression_check-09da6cf25574a7b696c9f87adb3f3259e167dcc5382a0711101406111d33e404.js

rel=preload as=script nopush

URL /assets/bootstrap-5.3.3.bundle.min-99c747a23e03171045f40e6f3625e6155895d34ebad5fd0c45ba14e72814a7a7.js

rel=preload as=script nopush

URL /assets/login-1fe9564ce728be53492f5118b58acd39f18a72e982b847328d68f06242f68018.js

rel=preload as=script nopush

URL /assets/login-dc2944f02e3449beaf01db5be4dd1f1957283595bd4ef8a8e0efa082ad7df7de.css

rel=preload as=style nopush

URL /assets/shared/browser_warning-450e32a4076d39fdbff647ae5dbf799b3794f9489e8d861f027ceb1c82eb2b06.css

rel=preload as=style nopush

URL /assets/shared/browser_warning-7d0c81851a744f946288a6f8a6abdb9ba95aaa2cf60f6f42fab47165d94bb2c5.js

rel=preload as=script nopush

X-Request-Id

Other

44d6494d-ce0f-495a-908a-005d5aa1b4a5

date: Mon, 04 May 2026 13:29:07 GMT
link: </packs/js/newrelic-0cfa02b00bf7e372f1e2.js>; rel=preload; as=script; nopush,</assets/login_common-c8e9a000a377d033b4efd369b21f1e9082301c2c00df14ffa4e56a2adcdeab60.js>; rel=preload; as=script; nopush,</assets/compression_check-09da6cf25574a7b696c9f87adb3f3259e167dcc5382a0711101406111d33e404.js>; rel=preload; as=script; nopush,</assets/bootstrap-5.3.3.bundle.min-99c747a23e03171045f40e6f3625e6155895d34ebad5fd0c45ba14e72814a7a7.js>; rel=preload; as=script; nopush,</assets/login-1fe9564ce728be53492f5118b58acd39f18a72e982b847328d68f06242f68018.js>; rel=preload; as=script; nopush,</assets/login-dc2944f02e3449beaf01db5be4dd1f1957283595bd4ef8a8e0efa082ad7df7de.css>; rel=preload; as=style; nopush,</assets/shared/browser_warning-450e32a4076d39fdbff647ae5dbf799b3794f9489e8d861f027ceb1c82eb2b06.css>; rel=preload; as=style; nopush,</assets/shared/browser_warning-7d0c81851a744f946288a6f8a6abdb9ba95aaa2cf60f6f42fab47165d94bb2c5.js>; rel=preload; as=script; nopush
x-request-id: 44d6494d-ce0f-495a-908a-005d5aa1b4a5

Recommendations

Enable compression (gzip/brotli) to improve performance