HTTPS Enabled
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
| Status | Header | Value | Recommendation |
|---|---|---|---|
content-security-policy | default-src https: data: wss://*.hotjar.com wss://*.crazyegg.com *.crazyegg.com wss://*.zohopublic.com; script-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; style-src https: data: 'unsafe-inline'; img-src data: https: 'unsafe-inline'; font-src data: https: 'unsafe-inline'; frame-ancestors 'self'; object-src 'self' blob; upgrade-insecure-requests; media-src 'self' blob: data: https:; | Controls resources the browser can load. Prevents XSS. | |
x-content-type-options | nosniff | Prevents MIME type sniffing. Should be 'nosniff'. | |
x-frame-options | SAMEORIGIN | Controls framing. Use CSP frame-ancestors instead. | |
strict-transport-security | max-age=31536000 | Forces HTTPS. Recommended: max-age=31536000; includeSubDomains | |
referrer-policy | no-referrer-when-downgrade | Controls referrer info. Recommended: strict-origin-when-cross-origin | |
permissions-policy | autoplay=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), usb=(), browsing-topics=() | Controls browser features. Recommended: camera=(), microphone=(), geolocation=() | |
x-xss-protection | 1; mode=block | Deprecated. Use Content-Security-Policy instead. | |
cross-origin-opener-policy | Not set | Controls cross-origin window access. Recommended: same-origin | |
cross-origin-resource-policy | Not set | Controls cross-origin resource access. Recommended: same-origin | |
cross-origin-embedder-policy | Not set | Controls cross-origin embedding. Recommended: require-corp |
server:nginxdate:Sat, 18 Apr 2026 07:45:39 GMTcontent-type:text/html; charset=UTF-8transfer-encoding:chunkedconnection:keep-alivevary:Accept-Encodinghost-header:a9130478a60e5f9135f765b23f26593bx-xss-protection:1; mode=blockx-frame-options:SAMEORIGINx-content-type-options:nosniffcontent-security-policy:default-src https: data: wss://*.hotjar.com wss://*.crazyegg.com *.crazyegg.com wss://*.zohopublic.com; script-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; style-src https: data: 'unsafe-inline'; img-src data: https: 'unsafe-inline'; font-src data: https: 'unsafe-inline'; frame-ancestors 'self'; object-src 'self' blob; upgrade-insecure-requests; media-src 'self' blob: data: https:;referrer-policy:no-referrer-when-downgradepermissions-policy:autoplay=(), camera=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), usb=(), browsing-topics=()x-rq:arn1 0 40 9980cache-control:public, max-age=3600x-cache:HITaccept-ranges:bytesstrict-transport-security:max-age=31536000