HTTP Headers Analysis for https://preview.decisions.dynamed.com

Detected Technologies from Headers

See all in URL Inspect 8

Adobe Fonts (Typekit)

Amplitude

Cloudflare

Cloudflare CDN

Envoy

Google Fonts

Osano

unpkg

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=15552000; includeSubDomains

Content-Security-Policy

Basic

default-src; worker-src; script-src; +11 more Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding

connection: close
transfer-encoding: chunked
vary: Accept-Encoding

Caching Headers

Etag

Caching

W/"144e8-ugpuWNvSlR+ag0vkNERYgwh5JOw"

etag: W/"144e8-ugpuWNvSlR+ag0vkNERYgwh5JOw"

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

Server

envoy

server: envoy

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: __cld_token__=exp=1771623838~acl=%2f*%2fauthenticated%2ft_thumb_*%2fEBSCOHealth%2fCCMS%2f*~hmac=c79618fbf98fc3ae3e81a8ae4288c244320aca9fc90babef6a0466aeb345ee06; Domain=dynamed.com; Path=/; Secure; HttpOnly; SameSite=None
GATEWAY_AUTH_SESSION=MDBjMzE0YWMtZDUwNi00NGRlLThkMjEtNmNjMTM5NWVhNjUx; Max-Age=2147483647; Expires=Wed, 10 Mar 2094 00:58:05 GMT; Path=/; Secure; HttpOnly; SameSite=None
__cld_token__=exp=1771623838~acl=%2f*%2fauthenticated%2ft_thumb_*%2fEBSCOHealth%2fCCMS%2f*~hmac=c79618fbf98fc3ae3e81a8ae4288c244320aca9fc90babef6a0466aeb345ee06; Domain=dynamed.com; Path=/; Secure; HttpOnly; SameSite=None
GATEWAY_AUTH_SESSION=MDBjMzE0YWMtZDUwNi00NGRlLThkMjEtNmNjMTM5NWVhNjUx; Max-Age=2147483647; Expires=Wed, 10 Mar 2094 00:58:05 GMT; Path=/; Secure; HttpOnly; SameSite=None
locale=en; Max-Age=1803073; Path=/; Expires=Thu, 12 Mar 2026 18:35:11 GMT; HttpOnly; Secure; SameSite=None

Other Headers

Date

Other

Thu, 19 Feb 2026 21:43:58 GMT

X-Content-Security-Policy

Other

default-src 'none'; worker-src blob:; script-src 'nonce-413f9c195890840d60a53a8d239a05e7' 'unsafe-inline' 'unsafe-eval' 'self' https://*.cloudflare.com https://*.osano.com https://resources.ebsco.zone; style-src 'self' https://fonts.googleapis.com https://*.typekit.net 'unsafe-inline'; img-src 'self' data: https blob: resources.ebsco.zone ab-configuration-cdn.ebsco.com connect.ebsco.com resources.ebsco.zone cmp.osano.com p.typekit.net; connect-src 'self' https://*.dmp.eis-deliveryintegration.cloud https://*.dmp.eis-deliverydevqa.cloud https://*.dynamed.com https://ab-configuration-cdn.ebsco.com https://staging-telemetry.ebsco.com https://telemetry.ebsco.com https://unpkg.com https://www.cloudflare.com https://*.osano.com https://resources.ebsco.zone/ebsco-policies/terms-of-use.md https://resources.ebsco.zone https://*.amplitude.com telemetry.ebsco.com login.ebsco.zone myaccount.ebsco.healthcare use.typekit.net; font-src 'self' https://fonts.gstatic.com https://*.typekit.net https://resources.ebsco.zone; object-src 'self'; media-src 'self'; manifest-src 'self'; frame-src *; base-uri 'self'; frame-ancestors 'self' https://*.cerner.com https://*.epic.com https://*.healthdecision.com; form-action 'self'

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Envoy-Upstream-Service-Time

Other

159

X-Webkit-Csp

Other

default-src 'none'; worker-src blob:; script-src 'nonce-413f9c195890840d60a53a8d239a05e7' 'unsafe-inline' 'unsafe-eval' 'self' https://*.cloudflare.com https://*.osano.com https://resources.ebsco.zone; style-src 'self' https://fonts.googleapis.com https://*.typekit.net 'unsafe-inline'; img-src 'self' data: https blob: resources.ebsco.zone ab-configuration-cdn.ebsco.com connect.ebsco.com resources.ebsco.zone cmp.osano.com p.typekit.net; connect-src 'self' https://*.dmp.eis-deliveryintegration.cloud https://*.dmp.eis-deliverydevqa.cloud https://*.dynamed.com https://ab-configuration-cdn.ebsco.com https://staging-telemetry.ebsco.com https://telemetry.ebsco.com https://unpkg.com https://www.cloudflare.com https://*.osano.com https://resources.ebsco.zone/ebsco-policies/terms-of-use.md https://resources.ebsco.zone https://*.amplitude.com telemetry.ebsco.com login.ebsco.zone myaccount.ebsco.healthcare use.typekit.net; font-src 'self' https://fonts.gstatic.com https://*.typekit.net https://resources.ebsco.zone; object-src 'self'; media-src 'self'; manifest-src 'self'; frame-src *; base-uri 'self'; frame-ancestors 'self' https://*.cerner.com https://*.epic.com https://*.healthdecision.com; form-action 'self'

date: Thu, 19 Feb 2026 21:43:58 GMT
x-content-security-policy: default-src 'none'; worker-src blob:; script-src 'nonce-413f9c195890840d60a53a8d239a05e7' 'unsafe-inline' 'unsafe-eval' 'self' https://*.cloudflare.com https://*.osano.com https://resources.ebsco.zone; style-src 'self' https://fonts.googleapis.com https://*.typekit.net 'unsafe-inline'; img-src 'self' data: https blob: resources.ebsco.zone ab-configuration-cdn.ebsco.com connect.ebsco.com resources.ebsco.zone cmp.osano.com p.typekit.net; connect-src 'self' https://*.dmp.eis-deliveryintegration.cloud https://*.dmp.eis-deliverydevqa.cloud https://*.dynamed.com https://ab-configuration-cdn.ebsco.com https://staging-telemetry.ebsco.com https://telemetry.ebsco.com https://unpkg.com https://www.cloudflare.com https://*.osano.com https://resources.ebsco.zone/ebsco-policies/terms-of-use.md https://resources.ebsco.zone https://*.amplitude.com telemetry.ebsco.com login.ebsco.zone myaccount.ebsco.healthcare use.typekit.net; font-src 'self' https://fonts.gstatic.com https://*.typekit.net https://resources.ebsco.zone; object-src 'self'; media-src 'self'; manifest-src 'self'; frame-src *; base-uri 'self'; frame-ancestors 'self' https://*.cerner.com https://*.epic.com https://*.healthdecision.com; form-action 'self'
x-dns-prefetch-control: off
x-download-options: noopen
x-envoy-upstream-service-time: 159
x-webkit-csp: default-src 'none'; worker-src blob:; script-src 'nonce-413f9c195890840d60a53a8d239a05e7' 'unsafe-inline' 'unsafe-eval' 'self' https://*.cloudflare.com https://*.osano.com https://resources.ebsco.zone; style-src 'self' https://fonts.googleapis.com https://*.typekit.net 'unsafe-inline'; img-src 'self' data: https blob: resources.ebsco.zone ab-configuration-cdn.ebsco.com connect.ebsco.com resources.ebsco.zone cmp.osano.com p.typekit.net; connect-src 'self' https://*.dmp.eis-deliveryintegration.cloud https://*.dmp.eis-deliverydevqa.cloud https://*.dynamed.com https://ab-configuration-cdn.ebsco.com https://staging-telemetry.ebsco.com https://telemetry.ebsco.com https://unpkg.com https://www.cloudflare.com https://*.osano.com https://resources.ebsco.zone/ebsco-policies/terms-of-use.md https://resources.ebsco.zone https://*.amplitude.com telemetry.ebsco.com login.ebsco.zone myaccount.ebsco.healthcare use.typekit.net; font-src 'self' https://fonts.gstatic.com https://*.typekit.net https://resources.ebsco.zone; object-src 'self'; media-src 'self'; manifest-src 'self'; frame-src *; base-uri 'self'; frame-ancestors 'self' https://*.cerner.com https://*.epic.com https://*.healthdecision.com; form-action 'self'

Recommendations

Enable compression (gzip/brotli) to improve performance

Add Cache-Control header to optimize caching