HTTP Headers Analysis for https://mileseducation.com

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

Basic

default-src; script-src; script-src-elem; +11 more

default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://static.hotjar.com https://script.hotjar.com https://cdn.jsdelivr.net https://unpkg.com https://va.vercel-scripts.com https://wati-integration-prod-service.clare.ai https://snap.licdn.com https://www.clarity.ms https://scripts.clarity.ms https://googleads.g.doubleclick.net https://www.googleadservices.com https://static.cloudflareinsights.com; script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://www.google-analytics.com https://tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://static.hotjar.com https://script.hotjar.com https://cdn.jsdelivr.net https://unpkg.com https://va.vercel-scripts.com https://wati-integration-prod-service.clare.ai https://snap.licdn.com https://www.clarity.ms https://scripts.clarity.ms https://googleads.g.doubleclick.net https://www.googleadservices.com https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net https://unpkg.com; img-src 'self' data: blob: https: http://localhost:1337; font-src 'self' data: https://fonts.gstatic.com https://cdn.jsdelivr.net; connect-src 'self' https://blcwdqfhupddorxpdcjl.supabase.co https://callback.miles-api.com https://webhook.miles-api.com https://api.mileseducation.com https://strapi.miles-api.com https://miles-events-cms-prod-154625965269.asia-south1.run.app https://mfx-prod-154625965269.asia-south1.run.app https://www.google-analytics.com https://analytics.google.com https://stats.g.doubleclick.net https://www.facebook.com https://api.whatsapp.com https://vitals.vercel-insights.com https://api.ipify.org https://www.google.com https://px.ads.linkedin.com https://*.clarity.ms https://www.google.co.in https://www.googleadservices.com https://milesblog-django-live-154625965269.asia-south1.run.app https://website-cms-backend-prod-154625965269.asia-south1.run.app https://hooks.zapier.com/hooks/catch/7954435/u9t45ya/ https://one.mileseducation.us/functions/v1/create-lead; frame-src 'self' https://www.youtube.com https://www.google.com https://www.facebook.com https://td.doubleclick.net https://www.googletagmanager.com; object-src 'none'; base-uri 'self'; form-action 'self' https://callback.miles-api.com https://webhook.miles-api.com https://www.facebook.com; frame-ancestors 'self'; upgrade-insecure-requests; media-src 'self' https://ik.imagekit.io blob: data:

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Present

origin-when-cross-origin

Permissions-Policy

Present

camera=(), microphone=(), geolocation=()

Recommendations

• Improve CSP by adding more specific directives and removing 'unsafe-inline'

Performance Headers

3 headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

accept-encoding

Caching Headers

2 headers

Age

Caching

0

Cache-Control

Caching

private, no-cache, no-store, max-age=0, must-revalidate

Content Headers

1 headers

Content-Type

Content

text/html; charset=utf-8

Server Headers

1 headers

Server

cloudflare

CORS Headers

0 headers

No CORS headers found

Cookies Headers

0 headers

No cookies headers found

Other Headers

13 headers

Alt-Svc

Other

h3=":443"; ma=86400

Cf-Cache-Status

Other

DYNAMIC

Cf-Ray

Other

9bc59e1e9ef27fae-IAD

Date

Other

Sun, 11 Jan 2026 15:58:48 GMT

Link

Other

</_next/static/media/0484562807a97172-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/8888a3826f4a3af4-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/904be59b21bd51cb-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/b957ea75a84b6ea7-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/c9e6921c7fc300d8-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2"

Nel

Other

{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}

Report-To

Other

{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sk5RlASEHJ273ga9tPAigN0opsCSEJa7QfCraHjaATviKTR%2FwM2F6OvjuB8WEPCiCnmq5054Ko7Rwq7AH4cW70OBrBq4JCfv9ACr7ipzDVQWICtvcg%3D%3D"}]}

Server-Timing

Other

cfEdge;dur=36,cfOrigin;dur=229

Speculation-Rules

Other

"/cdn-cgi/speculation"

X-Dns-Prefetch-Control

Other

on

X-Matched-Path

Other

/