urlscan.io logo urlscan.io
SecurityTrails logo

fly.io Open in urlscan Pro
2a09:8280:1:a270:b8f5:b9f7:8891:f3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://fly.io/
Effective URL: https://fly.io/
Submission: On April 12 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 2a09:8280:1:a270:b8f5:b9f7:8891:f3, located in United States and belongs to FLY, US. The main domain is fly.io.
TLS certificate: Issued by R3 on February 14th 2021. Valid for: 3 months.
This is the only time fly.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13 2a09:8280:1:a... 40509 (FLY)
12 1
Apex Domain
Subdomains		 Transfer
13 fly.io
fly.io
121 KB
12 1
Domain Requested by
13 fly.io 1 redirects fly.io
12 1

This site contains links to these domains. Also see Links.

Domain
github.com
status.flyio.net
twitter.com
community.fly.io
Subject Issuer Validity Valid
fly.io
R3		 2021-02-14 -
2021-05-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://fly.io/
Frame ID: 2A029550035C1A02140127CBD0F71A2B
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://fly.io/ HTTP 301
    https://fly.io/ Page URL

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

121 kB
Transfer

186 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://fly.io/ HTTP 301
    https://fly.io/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
fly.io/
Redirect Chain
  • http://fly.io/
  • https://fly.io/
42 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
57d9f03a887800dfdd6f047fcbd83f42fc78f98f80b7e86c80163658ad2d442e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
fly.io
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
referrer-policy
strict-origin-when-cross-origin
fly-served-from
fra
content-type
text/html; charset=utf-8
etag
W/"57d9f03a887800dfdd6f047fcbd83f42"
cache-control
max-age=0, private, must-revalidate
set-cookie
_ui=RkBQ0OHH1GhF%2Bbdwebqlq9SXVgAwF9VzswsdWXoNiMGmv3anyDozET%2B%2FztyGQ9UeWK4HkOAaNkUqyN9%2FROU0EQFN6DoC%2FPqttcC%2BymKuNqTTHK1FL38lwMKRHaAEG%2BNI9qPQSSQuJJdeQyOxc4YFCrwW7fZLCw8YR0iazYIHf24vrOZ37EYtG%2F2mWTDA105m89KmV2IoJoaCy89p%2FQXJDpQLvXh3z6AgI%2B2jYT2UD53CusVGnukBBDe2Po%2BUvPAC%2F9bZuJ3PBZD19CQ%3D--%2BxOpuyWM4p6dm1M8--7zAylEBknjcKJl2pANVoAg%3D%3D; path=/; secure; HttpOnly
x-request-id
1a12646d-7c12-4521-a667-3e9f68fdee23
x-runtime
0.005731
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
server
Fly/1434612 (2021-04-11)
via
2 fly.io
fly-request-id
01F338VM61AJ0ZHG437VSN5Q38
date
Mon, 12 Apr 2021 14:48:06 GMT

Redirect headers

content-type
text/html
location
https://fly.io/
transfer-encoding
chunked
content-encoding
gzip
date
Mon, 12 Apr 2021 14:48:05 GMT
server
Fly/1434612 (2021-04-11)
via
1.1 fly.io
fly-request-id
01F338VN4PJYFJHAHRE0PEJY5G
application.5abc900ef840956e79629792eda4c2235f93a41a.css
fly.io/ui/stylesheets/ 		39 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/stylesheets/application.5abc900ef840956e79629792eda4c2235f93a41a.css
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
6582c830be81b3ce604bb05386b3231815b7ed6e612dd0cce7f6327c2213cf8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:26 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6MEN4QR34QA0W9A87J
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
text/css
via
2 fly.io
cache-control
public, max-age=31536000
content-length
6733
expires
Sat, 09 Apr 2022 06:21:34 +0000
turboload.aad9e00d3c77301b3e17f0fa97ea06a4c8f9251f.js
fly.io/ui/javascript/shims/ 		459 B
286 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/javascript/shims/turboload.aad9e00d3c77301b3e17f0fa97ea06a4c8f9251f.js
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
86014e5598dded385d11ff4f35c4d0d11107795df2de10af62e9dfd803e2c253
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Origin
https://fly.io
Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:28 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6MZVFJK6PJG80J1V3X
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
2 fly.io
cache-control
public, max-age=31536000
content-length
228
expires
Sat, 09 Apr 2022 06:21:34 +0000
closest.20756c1e8d8225e8e3af4b069daffebf8ad7d702.js
fly.io/ui/javascript/shims/ 		540 B
314 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/javascript/shims/closest.20756c1e8d8225e8e3af4b069daffebf8ad7d702.js
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
f531ce1bec805b291e9959a722c83c78926f7871d666d573801d096dd151663a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Origin
https://fly.io
Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:28 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6MSADBWY7SMKHG372V
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
2 fly.io
cache-control
public, max-age=31536000
content-length
256
expires
Sat, 09 Apr 2022 06:21:34 +0000
matches.5dc847e8f4ffaa25f947d6a8a0ed06d8282995ab.js
fly.io/ui/javascript/shims/ 		333 B
237 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/javascript/shims/matches.5dc847e8f4ffaa25f947d6a8a0ed06d8282995ab.js
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
552782dcd3b75f96f57a904a4670fbff2603dc19d553712057816c7ef49460c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Origin
https://fly.io
Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:28 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6MRTAV1NY5JJHS4AW3
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
2 fly.io
cache-control
public, max-age=31536000
content-length
155
expires
Sat, 09 Apr 2022 06:21:34 +0000
mobile_menu.4ce9cdd93dbcf4c9b694bdaa09783a4b91ce5a33.js
fly.io/ui/javascript/components/ 		3 KB
903 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/javascript/components/mobile_menu.4ce9cdd93dbcf4c9b694bdaa09783a4b91ce5a33.js
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
a0c8deb56e6ca79cabc770b3449d5cd6e828f0d56b485d6cbda0fb67ca6f947a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Origin
https://fly.io
Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:27 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6M3M6V3RJ10C661YF0
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
2 fly.io
cache-control
public, max-age=31536000
content-length
845
expires
Sat, 09 Apr 2022 06:21:34 +0000
option_select.50ecc5c8152a36b9aaa41e1a46d6d684b5ea37e6.js
fly.io/ui/javascript/components/ 		865 B
396 B 		Script
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/javascript/components/option_select.50ecc5c8152a36b9aaa41e1a46d6d684b5ea37e6.js
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
50a902ae17ff79a83848b27e82bea336925c1b9122cf4a9494c033686ae083e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Origin
https://fly.io
Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:27 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6MFY7HRB1K2GSXCM9B
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
2 fly.io
cache-control
public, max-age=31536000
content-length
337
expires
Sat, 09 Apr 2022 06:21:34 +0000
validation.7eeee48943b5a0e0160e404089f74298cebe93ed.js
fly.io/ui/javascript/components/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fly.io/ui/javascript/components/validation.7eeee48943b5a0e0160e404089f74298cebe93ed.js
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
940954eb83599910caa8318e04379866fffaabb1a2ca25b5cbf8a2e7b238bb4d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Origin
https://fly.io
Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
last-modified
Sun, 21 Mar 2021 15:40:27 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6NG2GV9JMJJ1CFH1GA
date
Mon, 12 Apr 2021 14:48:06 GMT
vary
Accept-Encoding
content-type
application/javascript
via
2 fly.io
cache-control
public, max-age=31536000
content-length
1554
expires
Sat, 09 Apr 2022 06:21:34 +0000
continuous-deployment.jpg
fly.io/ui/images/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fly.io/ui/images/continuous-deployment.jpg
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
31b7c76c8e14c11cd27cc15ee2855d7a7f757aa6e74d2f059cd83f3f96250f6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
2 fly.io
last-modified
Tue, 09 Mar 2021 18:25:11 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6QD2ND8NWVFG7K8G7Q
date
Mon, 12 Apr 2021 14:48:06 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
content-length
27528
expires
Sat, 09 Apr 2022 06:21:34 +0000
speedy.jpg
fly.io/ui/images/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fly.io/ui/images/speedy.jpg
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
a05fe06a3d08dac2ba9403674d849ba91482005f579dd826322a15bcae32b8cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
2 fly.io
last-modified
Tue, 09 Mar 2021 18:25:11 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6Q9D76N7GC6VSWGD1H
date
Mon, 12 Apr 2021 14:48:06 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
content-length
19885
expires
Sat, 09 Apr 2022 06:21:34 +0000
turbo.jpg
fly.io/ui/images/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fly.io/ui/images/turbo.jpg
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
18333efecb7f09c02ed194dfd4e4bfab999096a745ec88c2cd3bf46115cc480c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
2 fly.io
last-modified
Tue, 09 Mar 2021 18:25:11 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6QXWH62XRW8GR2QGKV
date
Mon, 12 Apr 2021 14:48:06 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
content-length
20577
expires
Sat, 09 Apr 2022 06:21:34 +0000
image-service.jpg
fly.io/ui/images/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fly.io/ui/images/image-service.jpg
Requested by
Host: fly.io
URL: https://fly.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a09:8280:1:a270:b8f5:b9f7:8891:f3 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Fly/1434612 (2021-04-11) /
Resource Hash
a8bc5d5c6a90dd5e162fccc4630b4ca8d887b78d48ea98becaef37b640540650
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://fly.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
via
2 fly.io
last-modified
Tue, 09 Mar 2021 18:25:11 GMT
server
Fly/1434612 (2021-04-11)
fly-request-id
01F338VM6SJ69A1W41H0XQVVJJ
date
Mon, 12 Apr 2021 14:48:06 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
content-length
28558
expires
Sat, 09 Apr 2022 06:21:34 +0000

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated boolean| localStorageAvailable function| loadFont

1 Cookies

Domain/Path Name / Value
fly.io/ Name: _ui
Value: RkBQ0OHH1GhF%2Bbdwebqlq9SXVgAwF9VzswsdWXoNiMGmv3anyDozET%2B%2FztyGQ9UeWK4HkOAaNkUqyN9%2FROU0EQFN6DoC%2FPqttcC%2BymKuNqTTHK1FL38lwMKRHaAEG%2BNI9qPQSSQuJJdeQyOxc4YFCrwW7fZLCw8YR0iazYIHf24vrOZ37EYtG%2F2mWTDA105m89KmV2IoJoaCy89p%2FQXJDpQLvXh3z6AgI%2B2jYT2UD53CusVGnukBBDe2Po%2BUvPAC%2F9bZuJ3PBZD19CQ%3D--%2BxOpuyWM4p6dm1M8--7zAylEBknjcKJl2pANVoAg%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block