HTTP Headers Analysis for https://maxspreadsheet.com

Detected Technologies from Headers

See all in URL Inspect 26

AWS CloudFront

PayPal

Amazon S3

Braintree

Cloudflare CDNJS

Cloudflare Web Analytics

Dropbox

Facebook

Google Analytics

Google Conversion Tracking

Google DoubleClick

Google Fonts

Google Optimize

Google Search

Google Static File Front End

Google Tag Manager

Iframely

JW Player

Mailchimp

OpenResty

Stripe

TikTok Analytics

Twitter

unpkg

YouTube

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Basic

default-src; child-src; connect-src; +8 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Vary

Performance

X-Inertia, Origin

connection: close
vary: X-Inertia, Origin

Caching Headers

Cache-Control

Caching

max-age=0, private, must-revalidate

Etag

Caching

W/"9ddb1f9aebf3fbcab881038ce4676940"

cache-control: max-age=0, private, must-revalidate
etag: W/"9ddb1f9aebf3fbcab881038ce4676940"

Content Headers

Content-Length

Content

27319

Content-Type

Content

text/html; charset=utf-8

content-length: 27319
content-type: text/html; charset=utf-8

Server Headers

Server

openresty/1.19.9.1

X-Runtime

Server

0.347674

server: openresty/1.19.9.1
x-runtime: 0.347674

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _gumroad_guid=3bb7d51d-9d80-4a11-9047-b9a874603c91; domain=maxspreadsheet.com; path=/; expires=Fri, 08 Aug 2036 23:12:07 GMT; httponly; samesite=lax
XSRF-TOKEN=ZycgB1iGtlxYgowFmuNOF_M2kdkYO8ElqyDggUPDIp3qfG-4qpJ4KMiUb-MrbRdIrlom3HAVlx3cxDiALD6w8A; path=/; samesite=lax; HttpOnly

Other Headers

Date

Other

Sat, 08 Aug 2026 23:12:07 GMT

Link

Other

URL https://assets.gumroad.com/vite/assets/entrypoints/design-BN4nfcil.css

rel=preload as=style crossorigin=anonymous nopush

URL https://assets.gumroad.com/vite/assets/entrypoints/base.ts-CjQr4B2H.js

rel=modulepreload as=script crossorigin nopush

X-Download-Options

Other

noopen

X-Gr

Other

PROD

X-Original-Headers-Class

Other

Rack::Headers

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

42a51966-9d19-4bb5-ab80-9dd55cf5751f

X-Revision

Other

65d97e07a69b

date: Sat, 08 Aug 2026 23:12:07 GMT
link: <https://assets.gumroad.com/vite/assets/entrypoints/design-BN4nfcil.css>; rel=preload; as=style; crossorigin=anonymous; nopush,<https://assets.gumroad.com/vite/assets/entrypoints/base.ts-CjQr4B2H.js>; rel=modulepreload; as=script; crossorigin=; nopush
x-download-options: noopen
x-gr: PROD
x-original-headers-class: Rack::Headers
x-permitted-cross-domain-policies: none
x-request-id: 42a51966-9d19-4bb5-ab80-9dd55cf5751f
x-revision: 65d97e07a69b

Recommendations

Enable compression (gzip/brotli) to improve performance