Open
Cached
·
just now
16
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Excellent
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
Good
default-src; style-src; child-src; +14 more
default-src 'self' https://www.google.com;style-src 'self' 'unsafe-inline' https://*.googleapis.com https://*.google.com https://mrd-food-marketplace-images-prod.s3.eu-west-1.amazonaws.com;child-src 'self' 'nonce-54a0eda3-6a55-48d3-adf5-aef5acf2326d' https://order.pp.mrd.com;frame-src 'self' https://*.google.com https://*.snapchat.com https://*.doubleclick.net 'nonce-54a0eda3-6a55-48d3-adf5-aef5acf2326d' https://order.pp.mrd.com;connect-src 'self' https://*.googleapis.com https://*.google.com https://*.gstatic.com https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://*.snapchat.com https://*.clarity.ms https://*.bing.com https://*.facebook.com https://sentry.io 'nonce-54a0eda3-6a55-48d3-adf5-aef5acf2326d' https://api.pp.mrd.com https://takealot1461247963.zendesk.com;script-src-attr 'unsafe-inline';font-src 'self' https://fonts.gstatic.com data: https://mrd-food-marketplace-images-prod.s3.eu-west-1.amazonaws.com;form-action 'self' https://tr.snapchat.com;img-src 'self' https://*.googleapis.com https://*.gstatic.com https://*.google.com https://*.googleusercontent.com https://*.google-analytics.com https://*.googletagmanager.com https://t.co https://*.twitter.com https://*.bing.com https://*.facebook.com https://*.qccerttest.com https://*.quantserve.com https://*.google.co.za https://*.clarity.ms data: https://img.pp.mrd.com;script-src 'self' 'unsafe-inline' https://*.google.com https://*.googletagmanager.com https://*.google-analytics.com 'nonce-54a0eda3-6a55-48d3-adf5-aef5acf2326d' https://order.pp.mrd.com;base-uri 'self' about:;report-uri /api/csp-violation;report-to /api/csp-violation;frame-ancestors https://order.pp.mrd.com;block-all-mixed-content;object-src 'none';upgrade-insecure-requests
X-Frame-Options
Missing
Not configured
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Good
strict-origin-when-cross-origin
Permissions-Policy
Present
geolocation=(self "https://order.pp.mrd.com")
Recommendations
- • Strengthen CSP by removing 'unsafe-eval'
- • Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
Performance Headers
2 headers
Connection
Performance
close
Vary
Performance
Accept-Encoding
Caching Headers
1 headers
Etag
Caching
W/"3ab2f-ZxAF94g7mVJHg9+LlWnhMUmxd44"
Content Headers
2 headers
Content-Length
Content
240431
Content-Type
Content
text/html; charset=utf-8
Server Headers
1 headers
Server
Server
nginx/1.20.0
CORS Headers
0 headers
No CORS headers found
Cookies Headers
0 headers
No cookies headers found
Other Headers
3 headers
Date
Other
Mon, 29 Dec 2025 16:33:28 GMT
X-Dns-Prefetch-Control
Other
on
X-Download-Options
Other
noopen
Recommendations
Enable compression (gzip/brotli) to improve performance
Add Cache-Control header to optimize caching
Analysis completed in 1265ms