HTTP Headers Analysis for https://pay.standard.com.py

Detected Technologies from Headers

See all in URL Inspect 2

Nginx

PHP

HTTP Security Headers

Status

Strict-Transport-Security

Excellent

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

Weak

frame-ancestors Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Significantly strengthen CSP directives
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

connection: close
transfer-encoding: chunked

Caching Headers

Cache-Control

Caching

no-cache, private

cache-control: no-cache, private

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

Server

nginx/1.29.4

X-Powered-By

Server

PHP/8.2.30

server: nginx/1.29.4
x-powered-by: PHP/8.2.30

CORS Headers

Access-Control-Allow-Origin

Cors

*

access-control-allow-origin: *

Cookies Headers

Set-Cookie

Cookies

set-cookie: XSRF-TOKEN=eyJpdiI6IlFFS0gzMTY1VWtWWnI3Tm9hYWU2T2c9PSIsInZhbHVlIjoiQmRVam5lYXprREpIMTZob1FWVHVJTEFmMVRWb3dNL2ttL1FxakZqbWZzZkZWcjc1VExLZS81S21vUW13dkxYNHRsdnQ2U2g1YWRBMVoweTNPQ1U4N0pWZHU4cGZET2x3MVUxUWQ0Q0QxK1QwNjY4WDAyekxJYXRxaTNIV3l3b3UiLCJtYWMiOiI1MjVjMzlkZTMzMmMxMTE1MDkyM2ZjYTExYTQyNmJkY2IwMjU5NDdhMmI3OWUxYmE2NjA5NjhiYjFlOWI1YmJiIiwidGFnIjoiIn0%3D; expires=Mon, 06 Apr 2026 20:17:08 GMT; Max-Age=7200; path=/; secure; samesite=none
panel-de-pagos-session=eyJpdiI6IkQ1OE4zMHIzV1ZIMkg5azF6dWd2N1E9PSIsInZhbHVlIjoiRjkzZnFxb2tuYng3c1VNUVhkWWJBTVVNS2REMHlYTERDTmo5U1dVdW53LytucVpoN08zalR5R05zNHI0UDBHWm5qbVBGRWtneEhvMVQ1OHVwNGE5Z0ZKOHhYQ0liNXRQWmVyaW5RbXJEeFlVQmpqKzJvZ1RoK24rS0ZTeEV2aFciLCJtYWMiOiI3ODdhYTgwYmRkMWY5Yzc0NzVkNzZjODVkNzI1MDFlOTVkZjRkZTM1MGFlZWE0NzFjNjY0YmExNWMxMWUzNGUyIiwidGFnIjoiIn0%3D; expires=Mon, 06 Apr 2026 20:17:08 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none

Other Headers

Date

Other

Mon, 06 Apr 2026 18:17:08 GMT

date: Mon, 06 Apr 2026 18:17:08 GMT

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology