HTTP Headers Analysis for https://web2access.org

Detected Technologies from Headers

See all in URL Inspect 3

Apache

OpenSSL

Phusion Passenger

HTTP Security Headers

Status

Strict-Transport-Security

Missing

Not configured

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Good

strict-origin-when-cross-origin

Permissions-Policy

Missing

Not configured

Recommendations

• Add Strict-Transport-Security header with max-age of at least 1 year
• Add Content-Security-Policy header to prevent XSS attacks
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

Origin,Accept-Encoding

connection: close
transfer-encoding: chunked
vary: Origin,Accept-Encoding

Caching Headers

Cache-Control

Caching

max-age=0, private, must-revalidate

Etag

Caching

W/"78947c5d10e8b658bd7164bacf957988"

cache-control: max-age=0, private, must-revalidate
etag: W/"78947c5d10e8b658bd7164bacf957988"

Content Headers

Content-Type

Content

text/html; charset=utf-8

content-type: text/html; charset=utf-8

Server Headers

Server

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Phusion_Passenger/6.0.7 PHP/7.2.10

X-Powered-By

Server

Phusion Passenger 6.0.7

X-Runtime

Server

0.014038

server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Phusion_Passenger/6.0.7 PHP/7.2.10
x-powered-by: Phusion Passenger 6.0.7
x-runtime: 0.014038

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: _web2_access_session=LiTgBFQgGRCPVbantJDY48kZrrM%2BP0ml6XlFL2%2FSAV2BYvZvm9DSRwO3YVbhTZwKxX4SwaOUKsQQXEQDyRjJEF%2BuHSUYKiFjqAOQeZOLaYktDfhXVeEvGbVk2Fo3kdGrjmLt4pzty0wwN%2FjKt%2Bc2C%2BW66zDTDTW0ljkTbHpADw%2F1avP%2B%2BVJHx6oyED5bZTW8WvXF3NQonKLEvdO6bwqKQXswrZQxdWNivdXKJ3sQo2ZQCTDNbrG9DBCV6DVbd82GFMQqxk9eRu649jUGgA0o5%2BE%2B7JL8PJ8g2kb%2FKw%3D%3D--mb8Dm903Rr1hO5se--MPKTyNHYvedlIuLnYmxcOQ%3D%3D; path=/; HttpOnly

Other Headers

Date

Other

Tue, 12 May 2026 23:12:20 GMT

Status

Other

200 OK

X-Download-Options

Other

noopen

X-Permitted-Cross-Domain-Policies

Other

none

X-Request-Id

Other

ad7e13a1-470a-463f-87f8-67715536e99f

date: Tue, 12 May 2026 23:12:20 GMT
status: 200 OK
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-request-id: ad7e13a1-470a-463f-87f8-67715536e99f

Recommendations

Enable compression (gzip/brotli) to improve performance

Consider removing X-Powered-By header to hide server technology