HTTP Headers Analysis for https://virtualcard.hsbc.co.om

Detected Technologies from Headers

See all in URL Inspect 7

Adobe Dynamic Tag Management

BootstrapCDN

Dynatrace

Google Fonts

Mixpanel

OneTrust

Qualtrics Active incidents

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=16070400; includeSubDomains; preload

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Basic

default-src Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

no-referrer-when-downgrade

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Consider adding Permissions-Policy to control browser features

Performance Headers

Accept-Ranges

Performance

bytes

Connection

Performance

close

Vary

Performance

Accept-Encoding

accept-ranges: bytes
connection: close
vary: Accept-Encoding

Caching Headers

Cache-Control

Caching

max-age=14400, private, no-transform

Etag

Caching

"6adb77f7-2197c"

Expires

Caching

Mon, 26 Oct 2026 04:59:50 GMT

Last-Modified

Caching

Fri, 23 Oct 2026 15:06:31 GMT

cache-control: max-age=14400, private, no-transform
etag: "6adb77f7-2197c"
expires: Mon, 26 Oct 2026 04:59:50 GMT
last-modified: Fri, 23 Oct 2026 15:06:31 GMT

Content Headers

Content-Length

Content

137596

Content-Type

Content

text/html; charset=utf-8

content-length: 137596
content-type: text/html; charset=utf-8

Server Headers

No server headers found

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: x-mc-web-ss=ksc;  Path=/; HttpOnly; Secure
LB1=!/BZ8+xQ8s/EctGaZUWjbjVQleNIde4MnO85neOvk5t8qPuyd5bUln1RCe9nojxXQIcWUb7LrnCSTDek=; expires=Mon, 26-Oct-2026 01:29:50 GMT; path=/; Httponly; Secure
TS0154801c=016e19385ff5cd8b46d0a631dd6d2c0dcb3ab2ec78cfa64bed5645c2a396deaa5767adcc9018a0eb71c5dff1bcb0b34b98ae47fb4b3fe113b8067029d9161acf2f95acf6146bae4fb846e41c9c8b0d5ae47dc35761; Path=/; HttpOnly; Secure
ILB=!UJ4qUQlHQuxQ0dDNM47aagVbqMYB5Jr/v2rTIrSnrvoqM7zrKPrQJFMMKYSoVP7cJgzt1niYzF0UNco=; expires=Mon, 26-Oct-2026 01:29:50 GMT; path=/; Httponly; Secure

Other Headers

Date

Other

Mon, 26 Oct 2026 00:59:50 GMT

Traceresponse

Other

00-af4bc81ab3c8c811655790bcdac38eac-486b496e25a99799-01

X-Dt-Tracestate

Other

5c24aa51-2c374e65@dt

X-Mc-Correlation-Id

Other

0655420b27484481f6ca5ef1a17404ac

X-Vcap-Request-Id

Other

3ae148e3-6101-4c3a-7cc8-822817667e3b

date: Mon, 26 Oct 2026 00:59:50 GMT
traceresponse: 00-af4bc81ab3c8c811655790bcdac38eac-486b496e25a99799-01
x-dt-tracestate: 5c24aa51-2c374e65@dt
x-mc-correlation-id: 0655420b27484481f6ca5ef1a17404ac
x-vcap-request-id: 3ae148e3-6101-4c3a-7cc8-822817667e3b

Recommendations

Enable compression (gzip/brotli) to improve performance