HTTP Headers Analysis for https://services.cvs.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31104000 ; includeSubDomains

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

connection: close

Caching Headers

No caching headers found

Content Headers

Content-Length

Content

0

content-length: 0

Server Headers

Server

server:

CORS Headers

Access-Control-Allow-Credentials

Cors

true

Access-Control-Allow-Headers

Cors

env,grid

Access-Control-Allow-Methods

Cors

Get,Post,Put,Delete,Options

Access-Control-Allow-Origin

Cors

services.cvs.com

access-control-allow-credentials: true
access-control-allow-headers: env,grid
access-control-allow-methods: Get,Post,Put,Delete,Options
access-control-allow-origin: services.cvs.com

Cookies Headers

Set-Cookie

Cookies

set-cookie: csc4=on; expires=Sat, 17-Oct-2026 06:11:50 GMT; path=/
sc6=on; expires=Sat, 17-Oct-2026 06:11:50 GMT; path=/
_abck=565C793F17045D2CE631BA985D801908~-1~YAAQKmQwFz/NkgKgAQAAkWN/ExBiGh79UegtoBMx7LT/+yl09BVvQfSBqUWUOJKmfE6K6hmN7VyzVUPM9pw3nhmWWRfPdw2bi3S55GH367Frjc9SmENYIuuEiarY1a7c4c7wC700BeoUenyxyLE2cB/YPF6sbYsQSbJ2BUjEprp33dIrd0WMOtdy2I4Sw6GkBD+b+ZSZBCrqsrJOu4Gowk5/I/TMP8xN9GIfVhP/4fHC9KnL+5aZm8wVjmGZ3nb7QCvCLoPV9kBKGseypTw2qeSNnnnElmZ9RkRtAlJ2NtTwb+kvlRclJrdkxsfu84iQD8bEXMp5z4QKmdgtAxSL+m69FzQnieFZvauiFz3O07XyykuJWjQp96rzMvvN79AjF7PJuL3KwmmNSljElvjhkAxXJObjmeQ/zQlW06N/SNei9mxVqy551kDdg6okYOl7Rjo=~-1~-1~-1~-1~-1; Domain=.cvs.com; Path=/; Expires=Wed, 18 Aug 2027 06:11:50 GMT; Max-Age=31536000; Secure
bm_sz=55476773301E65D785223876B740FF99~YAAQKmQwF0DNkgKgAQAAkWN/EwCkD46B+54h8BWje6axt6lkB/oUKoLUuRxbjNHuV70iW6O59rv/oH4Y6xhz+4uh5wsoqIgoy6oxkCofQyOr2MRwyFQnO57hu7D/Oh2I0dzxItEz4UR+a9td2mlPt6kFFOwtZ+0tMWcA18VEzJxXbXhBld+om/Ee9EYEdbYQjey3KpOn4+eTpDT4p505BINjPtz7xvIN3GMmF/SsTNMiz+RkI9CPGBVYcj3fpgjeS6H16oZsgkc/BFV/Z6S8kSV9y7wzX0hG9LI2rd1fZBTWqqa0PfGfY8Lq/emLCxzwfL8luNSoxXHFjZfhQE2ZeftRoQqJs8hKJcY=~3747893~3556933; Domain=.cvs.com; Path=/; Expires=Tue, 18 Aug 2026 10:11:50 GMT; Max-Age=14400

Other Headers

Date

Other

Tue, 18 Aug 2026 06:11:50 GMT

Server-Timing

Other

edge; dur=1, origin; dur=264, cdn-cache; desc=MISS, ak_p; desc="1787033510355_389047338_1444748469_26406_9117_75_172_-";dur=1

X-Correlationid

Other

Id-a6f7836a2de3f69efe92a19a 0

X-Req

Other

a=allow;c=;d=desktop;g=0.2a643017.1787033510.561d1cb5;h=services.cvs.com;i=23.48.100.42;l=unk;t=ut;u=brw

date: Tue, 18 Aug 2026 06:11:50 GMT
server-timing: edge; dur=1, origin; dur=264, cdn-cache; desc=MISS, ak_p; desc="1787033510355_389047338_1444748469_26406_9117_75_172_-";dur=1
x-correlationid: Id-a6f7836a2de3f69efe92a19a 0
x-req: a=allow;c=;d=desktop;g=0.2a643017.1787033510.561d1cb5;h=services.cvs.com;i=23.48.100.42;l=unk;t=ut;u=brw

Recommendations

Enable compression (gzip/brotli) to improve performance

Add Cache-Control header to optimize caching