HTTP Headers Analysis for https://shrm.org

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31557600

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Present

SAMEORIGIN, SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Accept-Encoding

accept-ranges: bytes
connection: close
transfer-encoding: chunked
vary: Accept-Encoding

Caching Headers

Age

Caching

0

Cache-Control

Caching

max-age=3600

Pragma

Caching

no-cache

age: 0
cache-control: max-age=3600
pragma: no-cache

Content Headers

Content-Type

Content

text/html;charset=utf-8

content-type: text/html;charset=utf-8

Server Headers

No server headers found

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: shopUserRegion=US; Path=/; Max-Age=86400
OneTrustIdentity=40a2debf-3818-e114-7b11-13b8b8b73c1d; Path=/; Domain=.shrm.org; Expires=Mon, 12-Apr-2027 16:19:24 GMT; Max-Age=31536000; Secure
OneTrustJWT=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI0MGEyZGViZi0zODE4LWUxMTQtN2IxMS0xM2I4YjhiNzNjMWQiLCJpc3MiOiJhdXRoMCIsImV4cCI6MTgwNzU0Njc2NH0.AqH35_AzHxlnxWEhqu6Tw7Nw8_dcbIVSdyIVxKOmiyk; Path=/; Domain=.shrm.org; Expires=Mon, 12-Apr-2027 16:19:24 GMT; Max-Age=31536000; Secure
request_path_cookie=/front-door; Path=/; Secure
affinity="e3218159311c9088"; Path=/; HttpOnly; secure

Other Headers

Date

Other

Sun, 12 Apr 2026 16:19:24 GMT

X-Cache

Other

MISS

X-Served-By

Other

cache-ewr-kewr1740073-EWR

X-Sky-Isauth

Other

0

X-Timer

Other

S1776010764.128879,VS0,VS0,VE481

X-Vhost

Other

shrmPublish

date: Sun, 12 Apr 2026 16:19:24 GMT
x-cache: MISS
x-served-by: cache-ewr-kewr1740073-EWR
x-sky-isauth: 0
x-timer: S1776010764.128879,VS0,VS0,VE481
x-vhost: shrmPublish

Recommendations

Enable compression (gzip/brotli) to improve performance