HTTP Headers Analysis for https://usdc.circle.com

Detected Technologies from Headers

See all in URL Inspect 13

Cloudflare CDN

Google Analytics

Google Conversion Tracking

Google DoubleClick

Google Maps

Google Search

Google Static File Front End

Google Tag Manager

HubSpot

HubSpot Analytics

HubSpot Forms

Mixpanel

Google Cloud

HTTP Security Headers

Status

Strict-Transport-Security

Good

max-age=31536000; includeSubDomains

Content-Security-Policy

Basic

script-src; connect-src Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Consider adding 'preload' to HSTS for maximum security
• Improve CSP by adding more specific directives and removing 'unsafe-inline'
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Origin, Accept-Encoding

connection: close
transfer-encoding: chunked
vary: Origin, Accept-Encoding

Caching Headers

No caching headers found

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

Server

cloudflare

server: cloudflare

CORS Headers

Access-Control-Expose-Headers

Cors

X-ECP-Session-Id

access-control-expose-headers: X-ECP-Session-Id

Cookies Headers

Set-Cookie

Cookies

set-cookie: __cf_bm=oeVQ3989cg6l5AfCA_IEmrwTI64usR4y3FZNq6cpW0A-1778287335.5837274-1.0.1.1-6IlCgUONCpnebvY5zL8X_t1v8yndrq00ojhCYSn6WiEOIjTQdKxeZNP_Ewuvrhy9twnIQ_gYiHgeV5GxWNbAygCQu8Z4YYyZMvGxEjJOLywdse60SBtr5KQerQD_nK5L; HttpOnly; Secure; Path=/; Domain=circle.com; Expires=Sat, 09 May 2026 01:12:15 GMT
_cfuvid=GP2afMZ0YawKyFV8Umh.gSySUP8r56s7etdYg7WZENw-1778287335.5837274-1.0.1.1-i0LKaw.okTOvHVqSh218wgBLrrGLG9rpXSx73q7mQCc; HttpOnly; SameSite=None; Secure; Path=/; Domain=circle.com

Other Headers

Cf-Cache-Status

Other

DYNAMIC

Cf-Ray

Other

9f8ca9c76d831fdf-IAD

Date

Other

Sat, 09 May 2026 00:42:15 GMT

X-Content-Security-Policy

Other

script-src 'self' 'unsafe-inline' cdn.mxpnl.com js.hs-scripts.com js.hs-analytics.net js.hs-banner.com js.hscollectedforms.net https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com assets.circle.com maps.googleapis.com netverify.com https://www.gstatic.com; connect-src *

X-Dns-Prefetch-Control

Other

off

X-Download-Options

Other

noopen

X-Webkit-Csp

Other

script-src 'self' 'unsafe-inline' cdn.mxpnl.com js.hs-scripts.com js.hs-analytics.net js.hs-banner.com js.hscollectedforms.net https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com assets.circle.com maps.googleapis.com netverify.com https://www.gstatic.com; connect-src *

cf-cache-status: DYNAMIC
cf-ray: 9f8ca9c76d831fdf-IAD
date: Sat, 09 May 2026 00:42:15 GMT
x-content-security-policy: script-src 'self' 'unsafe-inline' cdn.mxpnl.com js.hs-scripts.com js.hs-analytics.net js.hs-banner.com js.hscollectedforms.net https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com assets.circle.com maps.googleapis.com netverify.com https://www.gstatic.com; connect-src *
x-dns-prefetch-control: off
x-download-options: noopen
x-webkit-csp: script-src 'self' 'unsafe-inline' cdn.mxpnl.com js.hs-scripts.com js.hs-analytics.net js.hs-banner.com js.hscollectedforms.net https://www.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com assets.circle.com maps.googleapis.com netverify.com https://www.gstatic.com; connect-src *

Recommendations

Enable compression (gzip/brotli) to improve performance

Add Cache-Control header to optimize caching