Open
Cached
·
just now
24
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=631138519
Content-Security-Policy
Basic
default-src; base-uri; connect-src; +7 more
default-src 'self' *.quill.org quill.org 'unsafe-inline'; base-uri 'self'; connect-src 'self' *.quill.org quill.org *.amplitude.com *.segment.com *.segment.io *.nr-data.net *.google-analytics.com *.google.com *.inspectlet.com *.doubleclick.net *.pusherapp.com *.pusher.com wss://*.pusher.com wss://*.pusherapp.com wss://*.inspectlet.com *.intercom.io wss://*.intercom.io *.sentry.io wss://*.quill.org *.satismeter.com localhost:8080/ localhost:3200 localhost:3100 localhost:5000 localhost:3036 wss://localhost:3200 ws://localhost:3200 wss://localhost:3036 ws://localhost:3036 checkout.stripe.com capture-api.ap3prod.com pagead2.googlesyndication.com/ us.i.posthog.com; font-src 'self' intercomcdn.com *.intercomcdn.com quill.org *.quill.org *.typekit.net *.fontawesome.com *.gstatic.com rsms.me *.rsms.me; frame-src 'self' intercom-sheets.com stripe.com *.stripe.com youtube.com *.youtube.com *.amazonaws.com *.loom.com *.salesmate.io td.doubleclick.net/ calendly.com *.vimeo.com www.googletagmanager.com *.spotify.com www.today.com; img-src * data: blob:; media-src * data: blob:; object-src 'none'; script-src 'self' *.quill.org quill.org 'unsafe-inline' 'unsafe-eval' *.clever.com *.fontawesome.com *.typekit.net *.segment.com *.segment.io *.newrelic.com *.nr-data.net *.googleapis.com *.gstatic.com *.posthog.com *.pusher.com *.google-analytics.com *.inspectlet.com *.satismeter.com stripe.com *.stripe.com *.amplitude.com *.doubleclick.net *.intercom.io *.intercomcdn.com *.sentry.io *.heapanalytics.com cdn.jsdelivr.net/npm/[email protected]/dist/lazyload.min.js *.salesmate.io *.googletagmanager.com code.jquery.com *.calendly.com *.vimeo.com *.spotify.com; style-src 'self' *.quill.org quill.org 'unsafe-inline' *.fontawesome.com *.googleapis.com *.gstatic.com rsms.me
X-Frame-Options
Missing
Not configured
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Missing
Not configured
Permissions-Policy
Missing
Not configured
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Improve CSP by adding more specific directives and removing 'unsafe-inline'
- • Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
- • Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
- • Consider adding Permissions-Policy to control browser features
Performance Headers
3 headers
Connection
Performance
keep-alive
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding
Caching Headers
3 headers
Cache-Control
Caching
no-store
Expires
Caching
Fri, 01 Jan 1990 00:00:00 GMT
Pragma
Caching
no-cache
Content Headers
1 headers
Content-Type
Content
text/html; charset=utf-8
Server Headers
2 headers
Server
Server
cloudflare
X-Runtime
Server
0.021203
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
_quill_session=c21rV3J2Q0p1dVozVEJUcXFMWHp4OHN2M3J1QkNIdGR4RTVWeDB0SzVFajhhdDhJYjdLT0lneFZwVWdRNWZERS9HV0F1UklIZ0dhL0Nsc0d2Ty9TVVkzM3hqNGVGQzNoQjh5VjlzQ3cyTjdRTnpDMHY5Y2VKeFpFelA1WjNSTjdKRklSRDJqTDUvU1A1c1pNcEk3bFRtMXZPRHlKdTAwRDN4b2ZTbFhSYnI3ODR6K3p3amtzbmkwdnJxUllxeW5pMU9xbjhlYUM3WWw2VTcralpyUXFRRDZQd2ZNYVB0djBuMWtUQ3FKVmJ6N3B0enM4TzJkOXFSN1VuOW5nK0V6Zlk3Y05Sd0hvR21KZzBvMUJ4anBFMVREcmYyY2xST09VcVQ2d0xwUWxxdkE9LS14bFVBRnM1cktONFBTN1BZR2dzdDd3PT0%3D--6cdf7be55f72a58c8b54cf7557bd3442593b0ac1; HttpOnly; SameSite=Lax; Secure; Path=/; Domain=.quill.org; Expires=Sun, 17 May 2026 04:00:00 GMT
Other Headers
10 headers
Cf-Cache-Status
Other
DYNAMIC
Cf-Ray
Other
9a048ef0481ac9ad-IAD
Date
Other
Tue, 18 Nov 2025 04:00:00 GMT
Nel
Other
{"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To
Other
{"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=iTLOfHgxqcatlvo%2FyzqGwlm5zhKT3A%2BPplJPuQoFIhc%3D\u0026sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add\u0026ts=1763438400"}],"max_age":3600}
Reporting-Endpoints
Other
heroku-nel="https://nel.heroku.com/reports?s=iTLOfHgxqcatlvo%2FyzqGwlm5zhKT3A%2BPplJPuQoFIhc%3D&sid=c46efe9b-d3d2-4a0c-8c76-bfafa16c5add&ts=1763438400"
Via
Other
2.0 heroku-router
X-Download-Options
Other
noopen
X-Permitted-Cross-Domain-Policies
Other
none
X-Request-Id
Other
296e8645-d054-2eab-6461-ab4c591dd4fc
Recommendations
Enable compression (gzip/brotli) to improve performance
Analysis completed in 287ms