HTTP Headers Analysis for https://narsyou.com

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add X-Content-Type-Options: nosniff
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding

connection: close
transfer-encoding: chunked
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

no-cache

Expires

Caching

Thu, 01 Jan 1970 00:00:01 GMT

Pragma

Caching

no-cache

cache-control: no-cache
expires: Thu, 01 Jan 1970 00:00:01 GMT
pragma: no-cache

Content Headers

Content-Type

Content

text/html; charset=UTF-8

content-type: text/html; charset=UTF-8

Server Headers

Server

Youcan.Private.DC/2.0

X-Powered-By

Server

Youcan.Private.DC/2.0

server: Youcan.Private.DC/2.0
x-powered-by: Youcan.Private.DC/2.0

CORS Headers

Access-Control-Allow-Headers

Cors

DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Accept,Authorization,X-Preferred-Locale,X-CSRF-TOKEN

Access-Control-Allow-Methods

Cors

GET, POST, PUT, DELETE, OPTIONS

Access-Control-Allow-Origin

Cors

*

Access-Control-Expose-Headers

Cors

Content-Length,Content-Range

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Accept,Authorization,X-Preferred-Locale,X-CSRF-TOKEN
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range

Cookies Headers

Set-Cookie

Cookies

set-cookie: XSRF-TOKEN=eyJpdiI6IkxLeFJJUGtFdmp3RGJCYjJLZ3crcEE9PSIsInZhbHVlIjoiRGF3elhFR3lcL2RaQlNjWjNGQWMrYUxXcFowbHVoekhkS2ZVMnNaMTBHcFwvclRiRGlpREtMUnhGQjRHZjRSWnZ4ZlJ1cUVQWE5NeVV1eUdMQ2xVYjh2WlVacVpIbUZuQVVQY0w4TnkyMTIzY0lzMDF1M3poXC9zZVFzSWtcL25ENUowIiwibWFjIjoiNjVlYTIxNjRjZTc5Y2U0MDlkYjkyZDMzMGJjZTRiMDEzY2M1ZGVmYjU5NzVkZTlkNGI1ODA0MjIwNDI5ZTc2ZiJ9; expires=Fri, 27-Feb-2026 12:24:51 GMT; Max-Age=604800; path=/
yvid=eyJpdiI6IjJPNUVNc3NTTXJcLzFVUStrd3F1dlB3PT0iLCJ2YWx1ZSI6Im5sdE1vOVB0elVEOW1qcjJWYTd1R0JaNG5NXC9vYk5sSE91cGpGTnhVMzdlS3BENUJkVnNjSkNCT05SUTFITU12a1pCeTNseDVJSWpsWFN3SGZoK0JuZmNjeUJWeGFNRExzakRuSXNZcEI2az0iLCJtYWMiOiI2N2VhYTQwMDg0MDkyYjNjZmVkNmZlNzE2NTViNmUxMmYwYWM5NGZkZjAyZmVmYWQ3Yzk5OTdjZTUyOGEzZmQxIn0%3D; expires=Wed, 19-Feb-2031 12:24:51 GMT; Max-Age=157680000; path=/; httponly
fvurl=eyJpdiI6IkhSdzJEY2x3YzJIYjdXWHVGVnJKTVE9PSIsInZhbHVlIjoibmhhS3RsZ1JHXC83SlZZVzdHNGpVR2I2MWJ1Umt2cWVpT0R1XC9ZZU5jakw0cDVBdTVwSzl6TDZ6Nk9GM0dYcnQ0IiwibWFjIjoiZGNhM2YyNzJkZTFkYTZhMzIyODc2YjVmNzFlYmIyODdiYWJkZTUwYjYwNWMyYmYyNTNjOTYxYTMyY2Q0NjZlYSJ9; expires=Sat, 21-Feb-2026 12:24:51 GMT; Max-Age=86400; path=/; httponly
original-referrer=eyJpdiI6ImM2ZjJlNmdKdjY4d0w1M2hGQVdDYUE9PSIsInZhbHVlIjoiZ0pkUlY0ZEJ6WmJ0clwvbloxem1qbzQ2VHF2aWFEXC90Z0w5MFUxTENFUGVLMWVLVDJGcUw2eGtNV2w0b3R2RkZOIiwibWFjIjoiZWJiMzYxNzdlM2RmN2E5OTkwM2FmMTBlNjUwNWU1MzcwNGRlM2YyNTNiM2RkNzYyZWJlMTE1ZjA1YzRjYmYyZCJ9; expires=Fri, 20-Feb-2026 13:24:51 GMT; Max-Age=3600; path=/; httponly
youcan_session=eyJpdiI6InZUWm1YSkk4OTRMditkKzNlcDdSK1E9PSIsInZhbHVlIjoidFdEOFFlbFBXcWNQM2pzcHE1RGdkNkpcL3pCZ0FGUzd5dTJqcjh5XC93VWR0T0I4QUZCcVBvK29YMEhpSUxwUjhTdFFjdmVuUWljOWNlNGllR08wXC9IMmVNaWFZQ09FKzFEVGFURlo3cTZWQ1pZQzE2MTY3dVN4bDB1RFRqc01DbVciLCJtYWMiOiI2Zjg0ZmNmYzBhMDE3ODU3MGIxZmE3ZWQ3NzJkNmY2MTVkNTY4ODEzZDA2ODk2NTU0MDZkNGMzZTk0ZGRjMGMyIn0%3D; expires=Fri, 27-Feb-2026 12:24:51 GMT; Max-Age=604800; path=/; httponly

Other Headers

Date

Other

Fri, 20 Feb 2026 12:24:51 GMT

X-Cacheatlasdebug

Other

Nothingassigned

X-Cacheatlasenabled

Other

1

X-Cacheatlasfor

Other

fullversion

X-Cacheatlasstatus

Other

BYPASS

X-Youcan-Request-Id

Other

F48U0Ru0v2jXsya7FygMFNPDkRZ

date: Fri, 20 Feb 2026 12:24:51 GMT
x-cacheatlasdebug: Nothingassigned
x-cacheatlasenabled: 1
x-cacheatlasfor: fullversion
x-cacheatlasstatus: BYPASS
x-youcan-request-id: F48U0Ru0v2jXsya7FygMFNPDkRZ

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology