HTTP Headers Analysis for https://upfeel.com

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=31536000; preload

Content-Security-Policy

Missing

Not configured

X-Frame-Options

Missing

Not configured

X-Content-Type-Options

Missing

Not configured

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking
• Add X-Content-Type-Options: nosniff
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

1 headers

Connection

Performance

close

Caching Headers

4 headers

Age

Caching

128

Cache-Control

Caching

max-age=300,public

Etag

Caching

"6e2a984dd909ef0d5d477f42293dd384"

Last-Modified

Caching

Mon, 02 Jun 2025 09:02:30 GMT

Content Headers

3 headers

Content-Language

Content

en

Content-Length

Content

860707

Content-Type

Content

text/html

Server Headers

1 headers

Server

AmazonS3

CORS Headers

0 headers

No CORS headers found

Cookies Headers

0 headers

No cookies headers found

Other Headers

10 headers

Content-Security-Policy-Report-Only

Other

default-src 'self' static.upfeel.com ; script-src 'unsafe-inline' 'unsafe-eval' static.upfeel.com apis.google.com player.vimeo.com www.youtube.com www.google-analytics.com www.googletagmanager.com static.hsappstatic.net snap.licdn.com *.hotjar.com googleads.g.doubleclick.net ; script-src-elem 'unsafe-inline' static.upfeel.com *.axept.io player.vimeo.com www.youtube.com www.gstatic.com static.hsappstatic.net js.hs-scripts.com js.usemessages.com js.hsadspixel.net js.hs-analytics.net js.hscollectedforms.net js.hs-banner.com apis.google.com www.google-analytics.com www.googletagmanager.com googleads.g.doubleclick.net snap.licdn.com *.hotjar.com ; script-src-attr 'unsafe-inline' ; style-src 'unsafe-inline' ; style-src-elem 'unsafe-inline' ; style-src-attr 'unsafe-inline' ; img-src 'self' data: https: ; font-src static.upfeel.com data: ; connect-src *.upfeel.com *.staging.upfeel.io *.axept.io cdn.plyr.io noembed.com *.ingest.sentry.io *.google-analytics.com *.googleapis.com *.google.com *.google.fr *.googlesyndication.com cdn.linkedin.oribi.io *.hotjar.io *.hotjar.com wss://*.hotjar.com stats.g.doubleclick.net *.hubspot.com *.hubapi.com *.hscollectedforms.net *.hsforms.com ; object-src 'none' ; frame-src auth.upfeel.com form.typeform.com player.vimeo.com www.youtube.com meetings.hubspot.com vars.hotjar.com app.hubspot.com td.doubleclick.net ; frame-ancestors https://backoffice.staging.upfeel.io https://backoffice.prod.upfeel.io ; form-action 'none' ; block-all-mixed-content ; report-uri https://o940045.ingest.us.sentry.io/api/5960454/csp-report/?sentry_key=8f9c3dc751964853bc3de698fb82014e ;

Date

Other

Wed, 03 Dec 2025 04:33:21 GMT

Nel

Other

{"report_to":"default","max_age":31536000,"include_subdomains":true}

Report-To

Other

{"endpoints":[{"url":"https://upfeel.report-uri.com/a/d/g"}],"group":"default","include_subdomains":true,"max_age":31536000},{"endpoints":[{"url":"https://upfeel.report-uri.com/r/d/csp/wizard"}],"group":"wizard","include_subdomains":true,"max_age":31536000},{"endpoints":[{"url":"https://upfeel.report-uri.com/enforce"}],"group":"enforce","include_subdomains":true,"max_age":31536000}

Via

Other

1.1 1325650ff974ed270b3a46432e8e2fee.cloudfront.net (CloudFront)

X-Amz-Cf-Id

Other

7yOfxDbl56Ol56A4TO3CWVzqMec0Ck-IQTz4eyWMjB2ttygRtvJXGw==

X-Amz-Cf-Pop

Other

IAD89-P4

X-Amz-Meta-Route-Name

Other

index___en