Open
Cached
·
just now
17
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=31536000
Content-Security-Policy
Good
default-src; frame-src; connect-src; +8 more
X-Frame-Options
Good
SAMEORIGIN
X-Content-Type-Options
Missing
Not configured
Referrer-Policy
Missing
Not configured
Permissions-Policy
Missing
Not configured
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Strengthen CSP by removing 'unsafe-eval'
- • Add X-Content-Type-Options: nosniff
- • Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
- • Consider adding Permissions-Policy to control browser features
Performance Headers
3 headers
Connection
Performance
keep-alive
Transfer-Encoding
Performance
chunked
Vary
Performance
Accept-Encoding
Caching Headers
3 headers
Cache-Control
Caching
no-store, no-cache, must-revalidate, max-age=0
Expires
Caching
Tue, 03 Jul 2001 06:00:00 GMT
Pragma
Caching
no-cache
Content Headers
1 headers
Content-Type
Content
text/html;charset=utf-8
Server Headers
1 headers
Server
Server
null
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
dcs=8kXsJB9dTCf4Tpn1rykl74WZN1oxRVmpXgR7ZbR55GU; path=/; HttpOnly; SameSite=None; Secure
Other Headers
4 headers
Date
Other
Sat, 15 Nov 2025 02:24:43 GMT
Service-Worker-Allowed
Other
/
X-Permitted-Cross-Domain-Policies
Other
master-only
X-Webkit-Csp
Other
default-src 'none'; frame-src https://static-corp.sendsafely.com https://content.googleapis.com https://docs.google.com/ 'self' blob: https://bid.g.doubleclick.net https://www.google.com sendsafely: https://analytics-frame.sendsafely.com https://www.recaptcha.net https://static-secure.ezypay.com https://app.sendsafely-au.com https://js.stripe.com;connect-src 'self' ; script-src 'self' https://static-secure.ezypay.com https://www.google.com https://www.gstatic.com https://accounts.google.com https://apis.google.com https://content.googleapis.com https://ssl.gstatic.com https://www.recaptcha.net https://ssl.google-analytics.com https://api.stripe.com https://js.stripe.com https://www.googleadservices.com https://www.googletagmanager.com https://googleads.g.doubleclick.net https://js.hs-analytics.net https://js.hsforms.net https://forms.hubspot.com https://api.hubapi.com https://internal.hubapi.com ; style-src 'self' 'unsafe-inline'; font-src 'self'; manifest-src 'self'; object-src 'self' https://static-secure.ezypay.com; child-src 'self'; media-src 'self' blob:; img-src 'self' https://cdn.zapier.com https://zapier.com https://app-static.sendsafely.com blob: data: https://www.google.com https://www.gstatic.com https://accounts.google.com https://apis.google.com https://content.googleapis.com https://ssl.gstatic.com https://ssl.google-analytics.com https://www.gravatar.com i0.wp.com i1.wp.com i2.wp.com i3.wp.com https://stats.g.doubleclick.net https://www.googleadservices.com https://googleads.g.doubleclick.net https://track.hubspot.com chrome-extension:;
Recommendations
Enable compression (gzip/brotli) to improve performance
Analysis completed in 1357ms