HTTP Headers Analysis for https://onexperience.com

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains

Content-Security-Policy

Basic

frame-ancestors; default-src; font-src; +7 more

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Consider adding Permissions-Policy to control browser features

Performance Headers

3 headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding

Caching Headers

1 headers

Cache-Control

Caching

no-cache

Content Headers

1 headers

Content-Type

Content

text/html; charset=iso-8859-1

Server Headers

0 headers

No server headers found

CORS Headers

0 headers

No CORS headers found

Cookies Headers

1 headers

Set-Cookie

Cookies

incap_ses_1404_2071060=3OO5BuNG1EeCUczo0AJ8ExEWbmkAAAAAZNoUVEHT8azkBft31FI2hg==; path=/; Domain=.onexperience.com

Other Headers

7 headers

Content-Security-Policy-Report-Only

Other

frame-ancestors 'self'; default-src 'self'; font-src 'self' data: fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.walkme.com https://*.kampyle.com https://www.gstatic.com/recaptcha/; worker-src 'self' blob:; script-src 'self' https://*.kampyle.com https://*.walkme.com https://*.360-value.com https://maps.googleapis.com https://cdn.jsdelivr.net/npm/[email protected]/ https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'sha256-MGWyyW6nCqx9gLlb9Vhaa6pQpYMbgzhR3Av44RYSBk8=' 'unsafe-eval'; img-src 'self' blob: data: https:; media-src 'self' blob: https: https://*.xactimate.com https://*.xactcontents.com https://xactcontents.com https://xactware-onexperience-us-prod.s3.us-west-2.amazonaws.com https://*.onexperience.com https://onexperience.com; connect-src 'self' blob: https://www.google.com/recaptcha/ https://*.kampyle.com https://*.verisk.com https://*.xactware.com/ https://*.xactcontents.com/ https://xactcontents.com/ https://*.xactimate.com/ https://servicenotify.statuspage.io https://*.walkme.com https://*.launchdarkly.com https://maps.googleapis.com https://places.googleapis.com https://*.tokbox.com https://*.opentok.com wss://*.tokbox.com https://*.medallia.com https://xactware-onexperience-us-prod.s3.us-west-2.amazonaws.com https://*.onexperience.com https://onexperience.com; frame-src 'self' blob: https://*.360-value.com https://nebula-cdn.kampyle.com https://www.google.com/recaptcha/ https://*.verisk.com https://servicenotify.statuspage.io https://www.youtube.com;

Date

Other

Mon, 19 Jan 2026 11:31:30 GMT

Server-Timing

Other

dtSInfo;desc="0", dtRpid;desc="360614142"

X-Cdn

Other

Imperva

X-Iinfo

Other

1009-24681390-24681417 NNNN CT(73 150 0) RT(1768822290081 215) q(0 0 2 0) r(3 3) U24