HTTP Headers Analysis for https://preprod.venture.com

Detected Technologies from Headers

See all in URL Inspect 3

AWS CloudFront

Nginx

Phusion Passenger

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=63072000

Content-Security-Policy

Weak

frame-ancestors Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Significantly strengthen CSP directives
• Consider adding Permissions-Policy to control browser features

Performance Headers

Vary

Performance

Accept-Encoding

vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

max-age=0, private, must-revalidate

Etag

Caching

W/"4bc5721c734327750dc8d2cf846e23d8"

cache-control: max-age=0, private, must-revalidate
etag: W/"4bc5721c734327750dc8d2cf846e23d8"

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

Server

nginx + Phusion Passenger(R) 6.2.1

X-Powered-By

Server

Phusion Passenger(R) 6.2.1

X-Runtime

Server

0.030239

server: nginx + Phusion Passenger(R) 6.2.1
x-powered-by: Phusion Passenger(R) 6.2.1
x-runtime: 0.030239

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: user_uuid=eyJfcmFpbHMiOnsibWVzc2FnZSI6IklqZGxOemhsTURNeExXWmpOakV0TkdRNU5DMWlZVEF3TFRVMk56VXlNV0l3WlRjMk1TST0iLCJleHAiOm51bGwsInB1ciI6ImNvb2tpZS51c2VyX3V1aWQifX0%3D--0894decc4549c5fda76fe2148cda64680a4b4fb9; path=/; expires=Sun, 04 Nov 2046 14:59:00 GMT; SameSite=Lax; secure
_venture_session=y8xVECEcrzz2s%2BkxTNd8zlxoH8pMO2eFAqUH9A3gIgKf5AGBg2elBtkv1HdFQpUjIctGyJhsvbsPNgniNo035HhxCVyoeAgajbFH5zk%2BTvfErqSt4c9klIwrfGqGnxkEQ6PK0L3NLd63cyE5KncVTnOW%2FuoKEiE1l1DtNvf8Dtf6%2FpIWdjoABtJ3CdmoSVoAmHcA0EUa5a5SQDl%2F73eUHinSM%2FUjHfBL5MqiwJxC7G6uYvsm7Gfm71tsvEvpqLHSETfMkwkzndUiTyxictajMVGdYPZconTD--tXTiCSLl8uawB8jD--MH3hIc8IFc%2F5K7oS3O47fQ%3D%3D; path=/; secure; HttpOnly; SameSite=Lax

Other Headers

Date

Other

Wed, 04 Nov 2026 14:59:00 GMT

Link

Other

URL

https://d1lkraw6keepp8.cloudfront.net/8de585a95bc1/assets/application-ea2d91f7fcc5fa001f384ca915ff93fc078f6d7f041fe2d5f9c43e4c5815fc05.css

rel=preload as=style nopush

URL

https://d1lkraw6keepp8.cloudfront.net/8de585a95bc1/assets/application-a4fa6871f075bf62c177326e8545c3266f51720e1f7ad5c415d548e6cde5ef2f.js

rel=preload as=script nopush

Status

Other

200 OK

X-Download-Options

Other

noopen

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

8669c54e-6a2b-4a7d-b453-6a99324b4c46

date: Wed, 04 Nov 2026 14:59:00 GMT
link: <https://d1lkraw6keepp8.cloudfront.net/8de585a95bc1/assets/application-ea2d91f7fcc5fa001f384ca915ff93fc078f6d7f041fe2d5f9c43e4c5815fc05.css>; rel=preload; as=style; nopush,<https://d1lkraw6keepp8.cloudfront.net/8de585a95bc1/assets/application-a4fa6871f075bf62c177326e8545c3266f51720e1f7ad5c415d548e6cde5ef2f.js>; rel=preload; as=script; nopush
status: 200 OK
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-request-id: 8669c54e-6a2b-4a7d-b453-6a99324b4c46

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology