Submitted URL: https://pepper.com.au/solana
Effective URL: https://appflow.pepper.com.au/suite/?signin=native
Submission: On August 11 via manual from US — Scanned from SE

Summary

This website contacted 2 IPs in 3 countries across 2 domains to perform 10 HTTP transactions. The main IP is 18.159.84.187, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is appflow.pepper.com.au.
TLS certificate: Issued by Thawte RSA CA 2018 on April 21st 2022. Valid for: a year.
This is the only time appflow.pepper.com.au was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 217.114.85.70 30811 (EPISERVER_AS)
1 1 104.17.187.16 13335 (CLOUDFLAR...)
1 3 18.159.84.187 16509 (AMAZON-02)
8 35.157.105.197 16509 (AMAZON-02)
10 2
Apex Domain
Subdomains
Transfer
8 appiancloud.com
web-assets.appiancloud.com — Cisco Umbrella Rank: 111033
109 KB
5 pepper.com.au
pepper.com.au — Cisco Umbrella Rank: 558846
www.pepper.com.au
appflow.pepper.com.au
14 KB
10 2
Domain Requested by
8 web-assets.appiancloud.com appflow.pepper.com.au
web-assets.appiancloud.com
3 appflow.pepper.com.au 1 redirects appflow.pepper.com.au
1 www.pepper.com.au 1 redirects
1 pepper.com.au 1 redirects
10 4

This site contains no links.

Subject Issuer Validity Valid
appflow.pepper.com.au
Thawte RSA CA 2018
2022-04-21 -
2023-04-21
a year crt.sh
*.appiancloud.com
Go Daddy Secure Certificate Authority - G2
2021-12-07 -
2023-01-05
a year crt.sh

This page contains 1 frames:

Primary Page: https://appflow.pepper.com.au/suite/?signin=native
Frame ID: 61765FDAEC63A626C44F77E4805EC81A
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Appian for Pepper Group Limited (PROD)

Page URL History Show full URLs

  1. https://pepper.com.au/solana HTTP 301
    https://www.pepper.com.au/solana HTTP 301
    https://appflow.pepper.com.au/suite?signin=native HTTP 301
    https://appflow.pepper.com.au/suite/?signin=native Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

2
IPs

3
Countries

122 kB
Transfer

249 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pepper.com.au/solana HTTP 301
    https://www.pepper.com.au/solana HTTP 301
    https://appflow.pepper.com.au/suite?signin=native HTTP 301
    https://appflow.pepper.com.au/suite/?signin=native Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
appflow.pepper.com.au/suite/
Redirect Chain
  • https://pepper.com.au/solana
  • https://www.pepper.com.au/solana
  • https://appflow.pepper.com.au/suite?signin=native
  • https://appflow.pepper.com.au/suite/?signin=native
11 KB
4 KB
Document
General
Full URL
https://appflow.pepper.com.au/suite/?signin=native
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.84.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-84-187.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
8cf6893da5d34ea51587f0487179dacfa7be76b36d4747d196fc2d04529b1b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
se-SE,se;q=0.9

Response headers

__appiancsrftoken
a5d9d188-0122-4468-aa0b-a4d7cbc80836
content-encoding
gzip
content-language
en-GB
content-length
3544
content-type
text/html;charset=UTF-8
date
Thu, 11 Aug 2022 00:07:10 GMT
referrer-policy
strict-origin-when-cross-origin
server
Apache
strict-transport-security
max-age=31536000; includeSubdomains; preload
vary
X-Remote-Client-IP,Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-remembermeenabled
false
x-robots-tag
none
x-xss-protection
1; mode=block

Redirect headers

content-length
258
content-type
text/html; charset=iso-8859-1
date
Thu, 11 Aug 2022 00:07:10 GMT
location
https://appflow.pepper.com.au/suite/?signin=native
server
Apache
strict-transport-security
max-age=31536000; includeSubdomains; preload
x-robots-tag
none
x-xss-protection
1; mode=block
banner.css
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/
545 B
702 B
Stylesheet
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/banner.css?appian_environment=tempo
Requested by
Host: appflow.pepper.com.au
URL: https://appflow.pepper.com.au/suite/?signin=native
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
7d1fd9cc94068d2da310404d2fd6a9664457ebb7701b752850cad0563f139a91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
https://appflow.pepper.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
content-encoding
gzip
vary
Accept-Encoding
content-length
327
x-xss-protection
1; mode=block
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"221-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
expires
Thu, 11 Aug 2022 01:07:11 GMT
standard_styles_static.css
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/
138 KB
27 KB
Stylesheet
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/standard_styles_static.css?appian_environment=tempo
Requested by
Host: appflow.pepper.com.au
URL: https://appflow.pepper.com.au/suite/?signin=native
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
f5c772f2b0d2ad41c4b45c5cddcf4b1c0854d9c42f7ad12f04fe28a843ffe251
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
https://appflow.pepper.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
content-encoding
gzip
vary
Accept-Encoding
content-length
27519
x-xss-protection
1; mode=block
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"22806-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
expires
Thu, 11 Aug 2022 01:07:11 GMT
login.css
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/
13 KB
4 KB
Stylesheet
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/login.css?appian_environment=tempo
Requested by
Host: appflow.pepper.com.au
URL: https://appflow.pepper.com.au/suite/?signin=native
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
8cce06f8eb708bad9f528f03899d11146225280c052a2f8c5707ee20653a5218
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
https://appflow.pepper.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
content-encoding
gzip
vary
Accept-Encoding
content-length
3370
x-xss-protection
1; mode=block
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"35cb-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
expires
Thu, 11 Aug 2022 01:07:11 GMT
1550450697000
appflow.pepper.com.au/suite/rest/a/content/latest/branding/logo/
8 KB
9 KB
Image
General
Full URL
https://appflow.pepper.com.au/suite/rest/a/content/latest/branding/logo/1550450697000
Requested by
Host: appflow.pepper.com.au
URL: https://appflow.pepper.com.au/suite/?signin=native
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.84.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-84-187.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
11035d4dee6c470d1ab544a9487a4555157615f8a4b222bc52b9533f3aa3f00d
Security Headers
Name Value
Content-Security-Policy report-uri /suite/rest/a/logging/latest/csp/report;
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
https://appflow.pepper.com.au/suite/?signin=native
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:12 GMT
x-content-type-options
nosniff
content-security-policy-report-only
default-src 'self'; report-uri /suite/rest/a/logging/latest/csp/report;
content-disposition
attachment; filename="peppermoneyvtrgb.png"
vary
X-Remote-Client-IP,Accept
content-length
8339
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
pragma
requested-while-authenticated
false
last-modified
Mon, 18 Feb 2019 00:44:26 GMT
server
Apache
x-frame-options
SAMEORIGIN
etag
"SYSTEM_CUSTOM_BRANDING_LOGO_IMAGE-2"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
image/png
cache-control
, no-transform, max-age=2147483647
content-security-policy
report-uri /suite/rest/a/logging/latest/csp/report;
x-robots-tag
none
expires
open-sans.css
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/
1 KB
642 B
Stylesheet
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Requested by
Host: appflow.pepper.com.au
URL: https://appflow.pepper.com.au/suite/?signin=native
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
a5f0329893cbff1912cf5ecdd514e442f464958caa8b19b8aa7f308ca570157b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

accept-language
se-SE,se;q=0.9
Referer
https://appflow.pepper.com.au/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
content-encoding
gzip
vary
Accept-Encoding
content-length
268
x-xss-protection
1; mode=block
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"5d9-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
expires
Thu, 11 Aug 2022 01:07:11 GMT
opensans-regular-appian.woff2
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/
18 KB
19 KB
Font
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/opensans-regular-appian.woff2
Requested by
Host: web-assets.appiancloud.com
URL: https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
557116ee5706daa3b6cb2f52e7490e22db9c30ebfc447a5c85458a5fa0f6f84b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

Referer
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Origin
https://appflow.pepper.com.au
accept-language
se-SE,se;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"49bc-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
content-length
18876
x-xss-protection
1; mode=block
expires
Thu, 11 Aug 2022 01:07:11 GMT
opensans-light-appian.woff2
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/
19 KB
19 KB
Font
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/opensans-light-appian.woff2
Requested by
Host: web-assets.appiancloud.com
URL: https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
a6c5ec600dfa7ca47ad224a89eb4b5ae06797927da4a03e54bd105cb1cc482ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

Referer
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Origin
https://appflow.pepper.com.au
accept-language
se-SE,se;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"4bbc-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
content-length
19388
x-xss-protection
1; mode=block
expires
Thu, 11 Aug 2022 01:07:11 GMT
opensans-bold-appian.woff2
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/
19 KB
19 KB
Font
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/opensans-bold-appian.woff2
Requested by
Host: web-assets.appiancloud.com
URL: https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
b41570405890d4f995da7b265ceb5cfb50246a940f9489525a8f526cfd160356
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

Referer
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Origin
https://appflow.pepper.com.au
accept-language
se-SE,se;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"4c30-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
content-length
19504
x-xss-protection
1; mode=block
expires
Thu, 11 Aug 2022 01:07:11 GMT
opensans-semibold-appian.woff2
web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/
19 KB
20 KB
Font
General
Full URL
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/opensans-semibold-appian.woff2
Requested by
Host: web-assets.appiancloud.com
URL: https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.157.105.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-157-105-197.eu-central-1.compute.amazonaws.com
Software
Apache /
Resource Hash
784a7423298c587ce89819cd81d6e225877b32605b4b40eb3ccafb3f3f3e5750
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Xss-Protection 1; mode=block

Request headers

Referer
https://web-assets.appiancloud.com/YWUtMjIuMi4zNTUuMA/portal/css/fonts/open-sans.css?appian_environment=tempo
Origin
https://appflow.pepper.com.au
accept-language
se-SE,se;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 11 Aug 2022 00:07:11 GMT
last-modified
Fri, 15 Jul 2022 07:34:07 GMT
server
Apache
etag
"4cbc-5e3d30b13b9c0"
strict-transport-security
max-age=31536000; includeSubdomains; preload
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
x-robots-tag
none
access-control-allow-headers
*
content-length
19644
x-xss-protection
1; mode=block
expires
Thu, 11 Aug 2022 01:07:11 GMT

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| isInIframe boolean| isEmbeddedLogin function| getCookieValue function| addClass function| removeClass function| acceptTermsOfService function| supportsSameSiteNone function| getSameSiteAppend boolean| hasSubmitted object| login_jsp string| key

4 Cookies

Domain/Path Name / Value
appflow.pepper.com.au/suite Name: JSESSIONID
Value: 995CCAF82D8CBBF63339CFD334E7E245.node12476
appflow.pepper.com.au/suite Name: __appianCsrfToken
Value: a5d9d188-0122-4468-aa0b-a4d7cbc80836
.www.pepper.com.au/ Name: ARRAffinity
Value: e409fa7916a3c9377d5213078e66ebfa8489192647365d03607879e3874856a2
.www.pepper.com.au/ Name: ARRAffinitySameSite
Value: e409fa7916a3c9377d5213078e66ebfa8489192647365d03607879e3874856a2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block