HTTP Headers Analysis for https://union.gettactic.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=63072000

Content-Security-Policy

Missing

Not configured

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Present

no-referrer, strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Consider adding Permissions-Policy to control browser features

Performance Headers

3 headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

accept-encoding

Caching Headers

2 headers

Age

Caching

158267

Cache-Control

Caching

public, max-age=0, must-revalidate

Content Headers

2 headers

Content-Disposition

Content

inline

Content-Type

Content

text/html; charset=utf-8

Server Headers

1 headers

Server

cloudflare

CORS Headers

1 headers

Access-Control-Allow-Origin

Cors

*

Cookies Headers

0 headers

No cookies headers found

Other Headers

8 headers

Alt-Svc

Other

h3=":443"; ma=86400

Cf-Cache-Status

Other

DYNAMIC

Cf-Ray

Other

9c5929b6f9728221-IAD

Content-Security-Policy-Report-Only

Other

default-src 'self'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' static.cloudflareinsights.com challenges.cloudflare.com https://www.googletagmanager.com/gtm.js vercel.live; style-src 'report-sample' 'self' 'unsafe-inline' https://p.typekit.net https://use.typekit.net; object-src 'none'; base-uri 'self'; connect-src 'self' https://cdn.gettactic.com https://cdn-tactic.amazonaws.com o532705.ingest.sentry.io union.gettactic.com stage-union.gettactic.com; font-src 'self' data: https://use.typekit.net; frame-src 'self' analytics.gettactic.com; img-src 'self' blob: data: https://cdn.gettactic.com https://res.cloudinary.com https://www.googletagmanager.com; manifest-src 'self'; media-src 'self'; worker-src blob:;

Date

Other

Thu, 29 Jan 2026 13:44:12 GMT

X-Matched-Path

Other

/en/dashboard

X-Vercel-Cache

Other

HIT

X-Vercel-Id

Other

iad1::b8qdp-1769694252704-b104a8f8a2c0