HTTP Headers Analysis for https://test-services.cvshealth.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31104000 ; includeSubDomains

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add X-Content-Type-Options: nosniff
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

connection: close

Caching Headers

Expires

Caching

Wed, 02 Sep 2026 20:42:39 GMT

expires: Wed, 02 Sep 2026 20:42:39 GMT

Content Headers

Content-Length

Content

373

Content-Type

Content

text/html

content-length: 373
content-type: text/html

Server Headers

No server headers found

CORS Headers

Access-Control-Allow-Credentials

Cors

true

Access-Control-Allow-Headers

Cors

env,grid

Access-Control-Allow-Methods

Cors

Get,Post,Put,Delete,Options

access-control-allow-credentials: true
access-control-allow-headers: env,grid
access-control-allow-methods: Get,Post,Put,Delete,Options

Cookies Headers

Set-Cookie

Cookies

set-cookie: _abck=F250071D163D562CE1B1F8C137FA98B6~-1~YAAQ3wwDFyBMQ0GgAQAASwncYxADZQLLCywK5ko+hTvOkEm9aZOTSamBlle84whg+nvbEGSHL0w0bC49k/c8Wlh48WVwz1rRl7Lq8/xM6qHkcGkQezN7EOZ7FT/JXdRV+FgWmJnai2gx6CxNCI0ESL4ulN/AR3uo2k7OxjHb0KShe8ntRuqBWu/MJsWx/K2HUs9xFa/ESJ4bb+s9e2UiJE9BIDnpoWGpOdzrlu6rsuIaqhzb7AA/wb53AlnQ4XlAL37bFr6Xc2bSY7jSSkNHNFp1hJLB7l/pHfYyFiWJIDVCH2+u6FGRqXWHsntSHA0OZRZE2Sfito2DA46Pf/91A8OKv77s90oxRHGgRfPuNTHV9wsMnHBOY0eNWsKLh1/2rfd7MZcJcoyW6DDOLZ5vD/ZrCUvhlDZ7oYPMgbBzRCM7N0TW2V9s19dohlRpU+4veLoDjHpJnBk=~-1~-1~-1~-1~-1; Domain=.cvshealth.com; Path=/; Expires=Thu, 02 Sep 2027 20:42:39 GMT; Max-Age=31536000; Secure
bm_sz=61919524C6A13CEEA87EF42DC7FA0ACE~YAAQ3wwDFyFMQ0GgAQAASwncYwE9+XGS0XIdZrDS0OW4alzWkpx0uSS82uK5lZGsK/Cm9Xhap6kbTLqgM7y6mNAoSj3cukEoOLZ3cA/UrK0t9+BnJY9VSTgVDjImaNHzOA2T25gPdU+WwKVsxd86unwiHoPHQQ9TKqwskp7Yx/UVHkIMePtSIduCAdGhEyOvjIx0LPlKGtU7vi02Z12YLCk/k7zGgl5nJB4zh7Gb4o4lp7JbCFfwPdSr2VUu0tO1MiR7dx9bq7VH4KJhX9YP99Ze1WetoHVL/BTcYb5LwUTtrZxvMwPQLemswkulXR+xJFiAC58+I95R8spXvtCIlEDuJ7wuVVpsbLR2sNbtjjAL~4535347~3688001; Domain=.cvshealth.com; Path=/; Expires=Thu, 03 Sep 2026 00:42:39 GMT; Max-Age=14400

Other Headers

Date

Other

Wed, 02 Sep 2026 20:42:39 GMT

Mime-Version

Other

1.0

X-Req

Other

ut,1788381759,23.3.12.223:63a9b976,www.cvs.com.distil.us

date: Wed, 02 Sep 2026 20:42:39 GMT
mime-version: 1.0
x-req: ut,1788381759,23.3.12.223:63a9b976,www.cvs.com.distil.us

Recommendations

Enable compression (gzip/brotli) to improve performance

Add Cache-Control header to optimize caching