HTTP Headers Analysis for https://support.cloudnext.uk

SSL Verification Bypassed

The server's SSL certificate could not be verified. The analysis was completed using insecure mode. Data may be less reliable.

Reason:

Unknown Certificate Authority - the server's certificate is not trusted

Open Cached · just now

20 Headers

Detected Technologies from Headers

See all in URL Inspect 2

Apache

PHP

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Add Content-Security-Policy header to prevent XSS attacks
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Vary

Performance

Accept-Encoding, Accept-Encoding

vary: Accept-Encoding, Accept-Encoding

Caching Headers

Cache-Control

Caching

no-store, no-cache, must-revalidate, immutable, max-age=600, public, s-maxage=600, stale-if-error=86400, stale-while-revalidate=60

Expires

Caching

Thu, 19 Nov 1981 08:52:00 GMT

Last-Modified

Caching

Sun, 03 May 2026 03:44:14 GMT

Pragma

Caching

no-cache

cache-control: no-store, no-cache, must-revalidate, immutable, max-age=600, public, s-maxage=600, stale-if-error=86400, stale-while-revalidate=60
expires: Thu, 19 Nov 1981 08:52:00 GMT
last-modified: Sun, 03 May 2026 03:44:14 GMT
pragma: no-cache

Content Headers

Content-Disposition

Content

inline

Content-Type

Content

text/html;charset=UTF-8

content-disposition: inline
content-type: text/html;charset=UTF-8

Server Headers

Server

Apache

X-Powered-By

Server

PHP/8.3.30

server: Apache
x-powered-by: PHP/8.3.30

CORS Headers

Access-Control-Allow-Headers

Cors

Content-Type, Authorization

Access-Control-Allow-Methods

Cors

GET,PUT,POST,DELETE

Access-Control-Allow-Origin

Cors

access-control-allow-headers: Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-origin: *

Cookies Headers

Set-Cookie

set-cookie: PHPSESSID=ae30c5ff295c984354c5a75499725518; path=/; secure; HttpOnly; SameSite=Strict
pmf-csrf-token-4236a440a6=7d5b7976910a21ae9e1583db2717b6a0; expires=Sun, 03 May 2026 04:14:14 GMT; Max-Age=1800; path=/; domain=support.cloudnext.uk; secure; HttpOnly; SameSite=strict
pmf_sid=100594; expires=Sun, 03 May 2026 04:44:14 GMT; Max-Age=3600; path=/; domain=support.cloudnext.uk; secure; HttpOnly; SameSite=strict

Other Headers

Date

Other

Sun, 03 May 2026 03:44:14 GMT

X-Cdn-Cache-Status

Other

MISS

X-Origin-Cache-Status

Other

MISS

X-Provided-By

Other

StackCDN

X-Via

Other

IAD1

date: Sun, 03 May 2026 03:44:14 GMT
x-cdn-cache-status: MISS
x-origin-cache-status: MISS
x-provided-by: StackCDN
x-via: IAD1

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology