HTTP Headers Analysis for https://my.moveworks.com

Detected Technologies from Headers

See all in URL Inspect 18

Adobe Marketo

AWS

Cloudinary

Datadog

Fullstory

Google Analytics

Google Cloud Storage

Google Fonts

Google Static File Front End

Google Tag Manager

Loom

Okta

Pendo

ServiceNow

Slack

Zendesk

Zscaler

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=86400; includeSubDomains

Content-Security-Policy

Basic

default-src; font-src; img-src; +7 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Vary

Performance

Accept-Encoding

accept-ranges: bytes
connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

public, max-age=0

Etag

Caching

W/"298-19d1b8807e8"

Last-Modified

Caching

Mon, 23 Mar 2026 16:29:53 GMT

cache-control: public, max-age=0
etag: W/"298-19d1b8807e8"
last-modified: Mon, 23 Mar 2026 16:29:53 GMT

Content Headers

Content-Length

Content

664

Content-Type

Content

text/html; charset=UTF-8

content-length: 664
content-type: text/html; charset=UTF-8

Server Headers

No server headers found

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: AWSALB=ibhcTRyAd3ECFg4jLXeI1LBnNwidEpydqXZWnn6JLSTGRD2UO0i9NxBdfBlTHKQvL3amThrlKIp4eFX3YcjmCwsur19K0jDuRVOsyIfmk/V8y/OJPaFAAahIOv8B; Expires=Tue, 31 Mar 2026 14:20:18 GMT; Path=/
AWSALBCORS=ibhcTRyAd3ECFg4jLXeI1LBnNwidEpydqXZWnn6JLSTGRD2UO0i9NxBdfBlTHKQvL3amThrlKIp4eFX3YcjmCwsur19K0jDuRVOsyIfmk/V8y/OJPaFAAahIOv8B; Expires=Tue, 31 Mar 2026 14:20:18 GMT; Path=/; SameSite=None; Secure

Other Headers

Date

Other

Tue, 24 Mar 2026 14:20:18 GMT

X-Content-Security-Policy

Other

default-src 'self'; font-src 'self' data: fonts.gstatic.com; img-src 'self' data: blob: https://*.cloudinary.com https://www.google-analytics.com https://www.googletagmanager.com https://*.service-now.com https://*.moveworks.io https://*.moveworks.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.bizible.com https://cdn.bizibly.com https://*.slack-edge.com https://*.amazonaws.com; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.zdassets.com https://www.google-analytics.com https://www.googletagmanager.com https://www.gstatic.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://browser-intake-datadoghq.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com https://www.gstatic.com https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.moveworks.com; connect-src 'self' wss: https://*.moveworks.com https://*.moveworks.io https://*.moveworks.ai https://*.okta.com https://*.zdassets.com https://*.zendesk.com https://www.google-analytics.com https://www.googletagmanager.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://*.mktoresp.com https://browser-intake-datadoghq.com ws:; frame-src https://*.okta.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://drive.google.com https://s3.walkmeusercontent.com https://www.loom.com https://*.zscaler.net https://*.zscalerone.net https://*.zscalertwo.net https://*.zscalerthree.net https://*.zscloud.net; frame-ancestors 'self' https://*.microsoft.com https://*.microsoft.us https://teams.microsoft.com.rproxy.goskope.com https://*.cloud.microsoft chrome-extension://*; worker-src 'self' blob: https://browser-intake-datadoghq.com

X-Webkit-Csp

Other

default-src 'self'; font-src 'self' data: fonts.gstatic.com; img-src 'self' data: blob: https://*.cloudinary.com https://www.google-analytics.com https://www.googletagmanager.com https://*.service-now.com https://*.moveworks.io https://*.moveworks.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.bizible.com https://cdn.bizibly.com https://*.slack-edge.com https://*.amazonaws.com; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.zdassets.com https://www.google-analytics.com https://www.googletagmanager.com https://www.gstatic.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://browser-intake-datadoghq.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com https://www.gstatic.com https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.moveworks.com; connect-src 'self' wss: https://*.moveworks.com https://*.moveworks.io https://*.moveworks.ai https://*.okta.com https://*.zdassets.com https://*.zendesk.com https://www.google-analytics.com https://www.googletagmanager.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://*.mktoresp.com https://browser-intake-datadoghq.com ws:; frame-src https://*.okta.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://drive.google.com https://s3.walkmeusercontent.com https://www.loom.com https://*.zscaler.net https://*.zscalerone.net https://*.zscalertwo.net https://*.zscalerthree.net https://*.zscloud.net; frame-ancestors 'self' https://*.microsoft.com https://*.microsoft.us https://teams.microsoft.com.rproxy.goskope.com https://*.cloud.microsoft chrome-extension://*; worker-src 'self' blob: https://browser-intake-datadoghq.com

date: Tue, 24 Mar 2026 14:20:18 GMT
x-content-security-policy: default-src 'self'; font-src 'self' data: fonts.gstatic.com; img-src 'self' data: blob: https://*.cloudinary.com https://www.google-analytics.com https://www.googletagmanager.com https://*.service-now.com https://*.moveworks.io https://*.moveworks.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.bizible.com https://cdn.bizibly.com https://*.slack-edge.com https://*.amazonaws.com; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.zdassets.com https://www.google-analytics.com https://www.googletagmanager.com https://www.gstatic.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://browser-intake-datadoghq.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com https://www.gstatic.com https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.moveworks.com; connect-src 'self' wss: https://*.moveworks.com https://*.moveworks.io https://*.moveworks.ai https://*.okta.com https://*.zdassets.com https://*.zendesk.com https://www.google-analytics.com https://www.googletagmanager.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://*.mktoresp.com https://browser-intake-datadoghq.com ws:; frame-src https://*.okta.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://drive.google.com https://s3.walkmeusercontent.com https://www.loom.com https://*.zscaler.net https://*.zscalerone.net https://*.zscalertwo.net https://*.zscalerthree.net https://*.zscloud.net; frame-ancestors 'self' https://*.microsoft.com https://*.microsoft.us https://teams.microsoft.com.rproxy.goskope.com https://*.cloud.microsoft chrome-extension://*; worker-src 'self' blob: https://browser-intake-datadoghq.com
x-webkit-csp: default-src 'self'; font-src 'self' data: fonts.gstatic.com; img-src 'self' data: blob: https://*.cloudinary.com https://www.google-analytics.com https://www.googletagmanager.com https://*.service-now.com https://*.moveworks.io https://*.moveworks.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.bizible.com https://cdn.bizibly.com https://*.slack-edge.com https://*.amazonaws.com; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.zdassets.com https://www.google-analytics.com https://www.googletagmanager.com https://www.gstatic.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://browser-intake-datadoghq.com; style-src 'self' 'unsafe-inline' fonts.googleapis.com https://www.gstatic.com https://*.walkme.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.moveworks.com; connect-src 'self' wss: https://*.moveworks.com https://*.moveworks.io https://*.moveworks.ai https://*.okta.com https://*.zdassets.com https://*.zendesk.com https://www.google-analytics.com https://www.googletagmanager.com https://*.walkme.com https://s3.walkmeusercontent.com https://*.pendo.io https://pendo-io-static.storage.googleapis.com https://pendo-static-5947957712322560.storage.googleapis.com https://*.fullstory.com https://*.bizible.com https://*.marketo.net https://*.mktoresp.com https://browser-intake-datadoghq.com ws:; frame-src https://*.okta.com https://*.moveworks.com https://*.moveworks.ai https://*.moveworks.io https://*.walkme.com https://*.pendo.io https://drive.google.com https://s3.walkmeusercontent.com https://www.loom.com https://*.zscaler.net https://*.zscalerone.net https://*.zscalertwo.net https://*.zscalerthree.net https://*.zscloud.net; frame-ancestors 'self' https://*.microsoft.com https://*.microsoft.us https://teams.microsoft.com.rproxy.goskope.com https://*.cloud.microsoft chrome-extension://*; worker-src 'self' blob: https://browser-intake-datadoghq.com

Recommendations

Enable compression (gzip/brotli) to improve performance