Open
Cached
·
just now
18
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Good
max-age=63072000; includeSubDomains
Content-Security-Policy
Weak
frame-ancestors
X-Frame-Options
Excellent
DENY
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Missing
Not configured
Permissions-Policy
Missing
Not configured
Recommendations
- • Consider adding 'preload' to HSTS for maximum security
- • Significantly strengthen CSP directives
- • Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
- • Consider adding Permissions-Policy to control browser features
Performance Headers
3 headers
Connection
Performance
keep-alive
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding
Caching Headers
2 headers
Cache-Control
Caching
no-cache,must-revalidate,max-age=0,no-store,private
Expires
Caching
Thu, 01 Jan 1970 00:00:00 GMT
Content Headers
1 headers
Content-Type
Content
text/html; charset=UTF-8
Server Headers
1 headers
Server
Server
sfdcedge
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
BrowserId=owK-RL0EEfCGjwEhxaMnHg; domain=.salesforce.com; path=/; expires=Mon, 09-Nov-2026 00:40:06 GMT; Max-Age=31536000; secure; SameSite=None
Other Headers
6 headers
Content-Security-Policy-Report-Only
Other
default-src 'self'; script-src 'self' *.salesforce.com 'report-sample'; style-src 'unsafe-inline' 'self' *.file.force.com *.salesforce.com *.visualforce.com:*; img-src *.force.com slack-mil-dev.com slack-imgs-mil-dev.com 'self' *.slack.com *.amazonaws.com blob: *.my-salesforce-cms.com *.slack-imgs.com slack-imgs-gov.com *.slack-edge.mil *.salesforce-experience.com slack-imgs.com slack-gov-dev.com *.sfdcstatic.com *.slack-edge-gov.com *.salesforce.com *.twimg.com *.my-salesforce.com slack-imgs-gov-dev.com *.slack-edge.com slack-imgs.mil *.cloudinary.com data:; media-src 'self' *.salesforce.com; frame-src *.force.com *.quip.com *.arkoselabs.com 'self' *.youtube-nocookie.com *.youtube.co.uk *.cybersource.com *.youtube.com.br *.youtube.es *.salesforce-experience.com *.salesforceliveagent.com *.adis.ws *.sfdcfc.net *.youtube.ca *.youtube.ie *.cloudinary.com *.vidyard.com *.vimeo.com *.youtube.jp bcove.video *.youtube.fr *.forceusercontent.com *.youtube.com *.brightcove.net *.wistia.net *.salesforce.com *.youtube.nl *.youtube.pl; font-src *.force.com 'self' *.salesforce.com blob: data:; connect-src 'self' *.amazonaws.com *.salesforce.com api.salesforce.com *.api.salesforce.com wss://*.slack.com; report-to sfdc-csp-ep; report-uri https://csp-report.force.com/_/ContentDomainCSPNoAuth?type=mydomain
Date
Other
Sun, 09 Nov 2025 00:40:06 GMT
X-Request-Id
Other
7be555a1e60f269b138fdcd37a6a9c12
X-Robots-Tag
Other
none
X-Sfdc-Edge-Cache
Other
MISS
X-Sfdc-Request-Id
Other
7be555a1e60f269b138fdcd37a6a9c12
Recommendations
Enable compression (gzip/brotli) to improve performance
Analysis completed in 199ms