Open
Cached
·
just now
26
Headers
HTTP Security Headers
Status
Strict-Transport-Security
Present
max-age=31536000
Content-Security-Policy
Missing
Not configured
X-Frame-Options
Excellent
DENY
X-Content-Type-Options
Good
nosniff
Referrer-Policy
Missing
Not configured
Permissions-Policy
Missing
Not configured
Recommendations
- • Increase HSTS max-age to at least 1 year and add includeSubDomains
- • Add Content-Security-Policy header to prevent XSS attacks
- • Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
- • Consider adding Permissions-Policy to control browser features
Performance Headers
2 headers
Connection
Performance
close
Vary
Performance
Accept-Encoding
Caching Headers
4 headers
Cache-Control
Caching
private,no-cache,no-store,pre-check=0,post-check=0,must-revalidate
Etag
Caching
W/"33d23-TyVJ14IYAyRLKcHqh0BwYizgkaQ"
Expires
Caching
-1
Pragma
Caching
no-cache
Content Headers
2 headers
Content-Length
Content
212259
Content-Type
Content
text/html; charset=utf-8
Server Headers
2 headers
Server
Server
istio-envoy
X-Powered-By
Server
Express
CORS Headers
0 headers
No CORS headers found
Cookies Headers
1 headers
Set-Cookie
Cookies
hosted-shell=%7B%22clientId%22%3A%227cc47b40-6675-46ba-aad8-6fa2820fbba7%22%7D; Path=/; Expires=Wed, 16 Jan 2036 00:21:11 GMT; HttpOnly; Secure
Other Headers
11 headers
Content-Security-Policy-Report-Only
Other
base-uri 'self' https://www.reddit.com/ https://*.intuitcdn.net/; block-all-mixed-content; connect-src https://ipv4.icanhazip.com/ 'self' https://*.smartystreets.com/ https://tl.ytlogs.ru/ https://translate.googleapis.com/ https://*.algolianet.com/ https://*.rsc.cdn77.org/ https://cdn.segment.com/ https://cdn.shopimgs.com/ https://consent.intuit.tsheets.com/ https://plugin-localhost.intuitcdn.net:* https://fonts.gstatic.com/ https://w88p9x.com/ https://*.google.com/ https://github.com/ wss://developer-stage.intuit.com:9001/ https://fcgt742.com/ https://www.google.co.nz/ https://*.algolia.net/ https://consent.www.firmofthefuture.com/ https://api.ipify.org/ https://local.adblock360.com/ https://edge.microsoft.com/ https://consent.intuit.apps.com/ https://stats.g.doubleclick.net/ https://vimeo.com/ https://www.sandbox.paypal.com/ https://*.execute-api.us-east-1.amazonaws.com/ wss://plugin.intuitcdn.net/ https://www.google-analytics.com/ https://raw.githubusercontent.com/ https://siteintercept.qualtrics.com/ https://hm.baidu.com/ https://my.productfruits.com/ https://meetlookup.com/ https://www.google.com.br/ https://consent.couriermedia.com/ wss://plugin-localhost.intuitcdn.net:* https://*.cardinalcommerce.com/ https://*.intuitcdn.net/ https://consent.mailchimp.com/ https://api.segment.io/ https://cdnmd.global-cache.online/ wss://eventinggateway.api.intuit.com/ https://clientstream.launchdarkly.com/ https://get663.com/ https://www.google.com.lb/ https://*.intuit.com/ data: https://www.google.co.in/ https://c61c36fe-1105-4900-b8a9-df08930951d0.mock.pstmn.io/ https://consent.intuit.quickbooksconnect.com/; font-src https://cdnjs.cloudflare.com/ https://fonts.gstatic.com/ https://use.typekit.net/ https://cdn.jsdelivr.net/ 'self' https://fonts.cdnfonts.com/ https://*.intuitcdn.net/ https://cdn.scite.ai/ https://qncdn.aoscdn.com/ https://stylesheets.pixiebrix.com/ https://static.designmanager.com/ https://static.hsappstatic.net/ https://static2.sharepointonline.com/ https://migaku-public-data.migaku.com/ https://ncspublicasset.s3.eu-west-3.amazonaws.com/ https://r2cdn.perplexity.ai/ https://s3.amazonaws.com/ https://static.preply.com/ https://unpkg.com/ https://use.fontawesome.com/ https://cdn.megabonus.com/ https://static.zohocdn.com/ https://www.slant.co/ data:; frame-ancestors 'self' https://*.intuit.com/; frame-src 'self' https://*.cardinalcommerce.com/ https://*.kaptcha.com/ https://*.google.com/ https://*.intuitcdn.net/ https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/ https://1.b406929acabac9b095f124c81bdfcf57f.com/ https://clcktrck.com/ https://player.vimeo.com/ https://*.paymentech.com/ https://*.paypal.com/ https://h.online-metrix.net/ https://*.youtube.com/ https://authenticate.ibotta.com/ https://*.intuit.com/ https://1.c81358859121583b7adf2ace89cb39f44.com/; img-src https://i.ytimg.com/ 'self' https://joko-mobile-app-media.s3.eu-west-1.amazonaws.com/ https://i.vimeocdn.com/ https://*.baidu.com/ https://favicon.yandex.net/ https://*.paymentech.com/ https://d201kpdrh73vuz.cloudfront.net/ https://*.qualtrics.com/ https://run.pstmn.io/ https://translate.googleapis.com/ https://*.gstatic.com/ https://ssl.google-analytics.com/ https://ssl.kaptcha.com/ https://www.google.com.pk/ https://www.googletagmanager.com/ https://*.online-metrix.net/ https://my.productfruits.com/ https://plugin-localhost.intuitcdn.net:* https://*.intuitcdn.net/ https://mc.yandex.ru/ blob: https://privacy-policy.truste.com/ https://img.youtube.com/ https://yt3.ggpht.com/ https://*.paypal.com/ https://www.google.co.nz/ https://www.google.com/ https://*.intuit.com/ https://uploads-ssl.webflow.com/ data: https://www.google.co.in/; media-src https://app.guidemaker.com/ https://ssl.gstatic.com/ https://audiocdn.lingualeo.com/ https://d4qgj78fzsl5j.cloudfront.net/ data:; object-src 'self'; report-uri https://csp.intuit.com/v2/r/e8db2e7e57de16dccde6c9df3fd05a8f64f5b0e6; script-src https://lottingem.com/ https://cdnjs.cloudflare.com/ 'unsafe-inline' https://cdn.jsdelivr.net/ 'self' https://*.qualtrics.com/ https://run.pstmn.io/ https://*.algolianet.com/ https://www.gstatic.com/ https://pagead2.googlesyndication.com/ https://www.googletagmanager.com/ https://cdn.segment.com/ https://www.youtube.com/ https://www.dropbox.com/ https://connect.facebook.net/ https://plugin-localhost.intuitcdn.net:* https://*.google-analytics.com/ https://*.cardinalcommerce.com/ https://apis.google.com/ https://*.intuitcdn.net/ https://secured-pixel.com/ https://bcdn-god.we-stats.com/ https://*.googleapis.com/ https://*.paypal.com/ https://unpkg.com/ https://h64.online-metrix.net/ https://*.algolia.net/ https://*.intuit.com/ 'unsafe-eval'; style-src https://static.hsappstatic.net/ https://www.gstatic.com/ 'unsafe-inline' https://cdn.jsdelivr.net/ 'self' https://use.fontawesome.com/ https://fonts.googleapis.com/ https://*.intuitcdn.net/ https://uxfabric.dev-intuitcdn.a.intuit.com/ data: https://p.typekit.net/; worker-src 'self' blob:;
Date
Other
Sun, 18 Jan 2026 00:21:11 GMT
Intuit_tid
Other
1-696c2777-1aa94cc353b5d4aa6ae22458
Server-Timing
Other
pluginConfigs;dur=0.99,appMw;dur=0.08,ixpAssignments;dur=0.02,appPostAuthMw;dur=0.07,shellServiceMw;dur=3.74,totalMwExecTime;dur=61.94
X-Amzn-Trace-Id
Other
Root=1-696c2777-1aa94cc353b5d4aa6ae22458
X-Dns-Prefetch-Control
Other
off
X-Download-Options
Other
noopen
X-Envoy-Upstream-Service-Time
Other
102
X-Intuit-Upstream-Locality-Region
Other
us-west-2
X-Request-Id
Other
1-696c2777-1aa94cc353b5d4aa6ae22458
X-Spanid
Other
434de56f-c413-c58f-97db-fc3a4a7f0ee6
Recommendations
Enable compression (gzip/brotli) to improve performance
Consider removing X-Powered-By header to hide server technology