Submitted URL: http://my.freedomlogic.com/
Effective URL: https://my.freedomlogic.com/
Submission: On January 18 via api from US — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 3.213.173.109, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is my.freedomlogic.com.
TLS certificate: Issued by Amazon RSA 2048 M03 on November 25th 2023. Valid for: a year.
This is the only time my.freedomlogic.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 3.213.173.109 14618 (AMAZON-AES)
4 2600:9000:264... 16509 (AMAZON-02)
1 16.182.64.160 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
8 5
Apex Domain
Subdomains
Transfer
4 cloudfront.net
d9oc8kitmydd.cloudfront.net
3 MB
2 googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 362
63 KB
2 freedomlogic.com
my.freedomlogic.com
5 KB
1 amazonaws.com
s3.amazonaws.com
50 KB
8 4
Domain Requested by
4 d9oc8kitmydd.cloudfront.net my.freedomlogic.com
d9oc8kitmydd.cloudfront.net
2 maps.googleapis.com my.freedomlogic.com
maps.googleapis.com
2 my.freedomlogic.com 1 redirects
1 s3.amazonaws.com my.freedomlogic.com
8 4

This site contains links to these domains. Also see Links.

Domain
freedomlogic.com
Subject Issuer Validity Valid
*.freedomlogic.com
Amazon RSA 2048 M03
2023-11-25 -
2024-12-22
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2023-10-10 -
2024-09-19
a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2023-10-10 -
2024-07-10
9 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-12-11 -
2024-03-04
3 months crt.sh

This page contains 1 frames:

Primary Page: https://my.freedomlogic.com/
Frame ID: CECA32D4A5612BA02533E4F7C46326F2
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Log In | FreedomLogic

Page URL History Show full URLs

  1. http://my.freedomlogic.com/ HTTP 301
    https://my.freedomlogic.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js

Overall confidence: 100%
Detected patterns
  • <div[^>]+data-pjax-container

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

3303 kB
Transfer

3429 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://my.freedomlogic.com/ HTTP 301
    https://my.freedomlogic.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
my.freedomlogic.com/
Redirect Chain
  • http://my.freedomlogic.com/
  • https://my.freedomlogic.com/
7 KB
4 KB
Document
General
Full URL
https://my.freedomlogic.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.173.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-173-109.compute-1.amazonaws.com
Software
nginx/1.17.6 + Phusion Passenger 6.0.4 / Phusion Passenger 6.0.4
Resource Hash
cfbaad0cd24c16710b1632c1680c5eb2751e849d6ed9172789f2914b738bfb4e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, private, must-revalidate
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 18 Jan 2024 02:28:54 GMT
etag
W/"cfbaad0cd24c16710b1632c1680c5eb2"
referrer-policy
strict-origin-when-cross-origin
server
nginx/1.17.6 + Phusion Passenger 6.0.4
status
200 OK
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-pjax-version
b97742e43ffc0d623174d9da19087a519e1fd001fdf5312b78978cfa2ea383baa054b5b9623103089213a182af5a74be5b53ae4e1a87d2311e2f1f12ec5df2570279ba34fb349fc399e48a8996bae8288a65b0e0870dfc0698eeb13aa015b169
x-powered-by
Phusion Passenger 6.0.4
x-request-id
4f3a9c6b-114f-4258-a4ce-32242d6a70f0
x-runtime
0.010851
x-xss-protection
1; mode=block

Redirect headers

Connection
keep-alive
Content-Length
0
Content-Type
text/html
Date
Thu, 18 Jan 2024 02:28:53 GMT
Location
https://my.freedomlogic.com/
Server
nginx/1.17.6 + Phusion Passenger 6.0.4
Status
301 Moved Permanently
X-Powered-By
Phusion Passenger 6.0.4
login-1af746de18630ad9779271adc712683414efb00019a5d84f0cb26accb277b4e4.css
d9oc8kitmydd.cloudfront.net/assets/applications/freedomlogic/
14 KB
5 KB
Stylesheet
General
Full URL
https://d9oc8kitmydd.cloudfront.net/assets/applications/freedomlogic/login-1af746de18630ad9779271adc712683414efb00019a5d84f0cb26accb277b4e4.css
Requested by
Host: my.freedomlogic.com
URL: https://my.freedomlogic.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:1600:1c:6c97:2040:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
1af746de18630ad9779271adc712683414efb00019a5d84f0cb26accb277b4e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.freedomlogic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 15:54:32 GMT
content-encoding
gzip
via
1.1 56a77d6c9e6b49fa4179a99507a9582e.cloudfront.net (CloudFront)
last-modified
Wed, 15 Nov 2023 22:11:12 GMT
server
nginx/1.17.6
x-amz-cf-pop
FRA60-P6
age
38062
etag
W/"65554200-36a0"
x-cache
Hit from cloudfront
content-type
text/css
x-amz-cf-id
uNnMsvkccz-vApVHspzO-08pXAEn6mi4Rkbih20kXEutwTxGP_3iIA==
modernizr-d71351c04245b2d414a59a4afb8f6f9faf6f49eab02c3ccd0cbbf575a230b3e3.js
d9oc8kitmydd.cloudfront.net/assets/
12 KB
12 KB
Script
General
Full URL
https://d9oc8kitmydd.cloudfront.net/assets/modernizr-d71351c04245b2d414a59a4afb8f6f9faf6f49eab02c3ccd0cbbf575a230b3e3.js
Requested by
Host: my.freedomlogic.com
URL: https://my.freedomlogic.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:1600:1c:6c97:2040:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
d71351c04245b2d414a59a4afb8f6f9faf6f49eab02c3ccd0cbbf575a230b3e3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.freedomlogic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 21:19:19 GMT
via
1.1 56a77d6c9e6b49fa4179a99507a9582e.cloudfront.net (CloudFront)
last-modified
Wed, 27 Nov 2019 19:25:13 GMT
server
nginx/1.17.6
x-amz-cf-pop
FRA60-P6
age
18575
etag
"5ddecd99-3070"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
12400
x-amz-cf-id
B_G5fABTAvBH7_b5AqhO_flOHsZA0DZz4KjUNnMNr9spMm2U3qY_9A==
logo.png
s3.amazonaws.com/com.freedomlogic.production/application/logos/6/original/
50 KB
50 KB
Image
General
Full URL
https://s3.amazonaws.com/com.freedomlogic.production/application/logos/6/original/logo.png
Requested by
Host: my.freedomlogic.com
URL: https://my.freedomlogic.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
16.182.64.160 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
8b24f8e07507ac6ff94a00d05b8e3cd221562b933a66da5edcf97845b94d3706

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.freedomlogic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Thu, 18 Jan 2024 02:28:55 GMT
Last-Modified
Fri, 27 Mar 2020 00:45:16 GMT
Server
AmazonS3
x-amz-request-id
4TZQF1HQPZH5NDC2
ETag
"d4b03274c5b54b43c648e731f7404bb6"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
50874
x-amz-id-2
j/l0AsuoFv7cn+sO7QQUI70dy2L6kwi+FGXLkuU884iZkQfzpiL4qeFd2ol0H6jWC5ZcR6EVMM4=
js
maps.googleapis.com/maps/api/
183 KB
63 KB
Script
General
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyCffI_dlz590olXiToVSc9MsZgyP24kac4&callback=_googleMapCallback
Requested by
Host: my.freedomlogic.com
URL: https://my.freedomlogic.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
f7418a53f83bc81c7d10864e22bbc42734e4937b9cbbdf44b2c48775223f3082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.freedomlogic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 02:28:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Accept-Language, Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64178
x-xss-protection
0
desktop-b97742e43ffc0d623174d9da19087a519e1fd001fdf5312b78978cfa2ea383ba.js
d9oc8kitmydd.cloudfront.net/assets/
3 MB
3 MB
Script
General
Full URL
https://d9oc8kitmydd.cloudfront.net/assets/desktop-b97742e43ffc0d623174d9da19087a519e1fd001fdf5312b78978cfa2ea383ba.js
Requested by
Host: my.freedomlogic.com
URL: https://my.freedomlogic.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:1600:1c:6c97:2040:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
b97742e43ffc0d623174d9da19087a519e1fd001fdf5312b78978cfa2ea383ba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.freedomlogic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 12:25:20 GMT
via
1.1 56a77d6c9e6b49fa4179a99507a9582e.cloudfront.net (CloudFront)
last-modified
Wed, 10 Jan 2024 20:17:15 GMT
server
nginx/1.17.6
x-amz-cf-pop
FRA60-P6
age
50613
etag
"659efb4b-316d6e"
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
3239278
x-amz-cf-id
X-U1di6BxnDh1cngeDmi5fhppn9raF5Lo-FcARh04OzbnjN8ByUFVw==
truncated
/
260 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4d50a8c01a47e2159ab5549bf3a3a24098bad491cf937ce5494be41cffa37ee1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
188 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0799a6a5b7442d8ec6a191ae5b9a358db7430ac22b3b95656f6067c6267d18d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png
checkbox-2d94f055fb89cfb19c1de5b6313ab852d5eccee0cfdee34acb640b0c129a8ecc.png
d9oc8kitmydd.cloudfront.net/assets/forms/
337 B
650 B
Image
General
Full URL
https://d9oc8kitmydd.cloudfront.net/assets/forms/checkbox-2d94f055fb89cfb19c1de5b6313ab852d5eccee0cfdee34acb640b0c129a8ecc.png
Requested by
Host: d9oc8kitmydd.cloudfront.net
URL: https://d9oc8kitmydd.cloudfront.net/assets/applications/freedomlogic/login-1af746de18630ad9779271adc712683414efb00019a5d84f0cb26accb277b4e4.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2644:1600:1c:6c97:2040:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.17.6 /
Resource Hash
2d94f055fb89cfb19c1de5b6313ab852d5eccee0cfdee34acb640b0c129a8ecc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://d9oc8kitmydd.cloudfront.net/assets/applications/freedomlogic/login-1af746de18630ad9779271adc712683414efb00019a5d84f0cb26accb277b4e4.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Wed, 17 Jan 2024 19:31:01 GMT
via
1.1 56a77d6c9e6b49fa4179a99507a9582e.cloudfront.net (CloudFront)
last-modified
Wed, 27 Nov 2019 19:25:13 GMT
server
nginx/1.17.6
x-amz-cf-pop
FRA60-P6
age
25073
etag
"5ddecd99-151"
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
337
x-amz-cf-id
Q68LsGzG_9f_t2ZROfFY3P1RML5_4N85zrYeO1-9XcNyHAb02asGLw==
gen_204
maps.googleapis.com/maps/api/mapsjs/
3 B
45 B
XHR
General
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyCffI_dlz590olXiToVSc9MsZgyP24kac4&callback=_googleMapCallback
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://my.freedomlogic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Thu, 18 Jan 2024 02:28:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://my.freedomlogic.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0

Verdicts & Comments Add Verdict or Comment

199 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| app_t function| app_section object| Modernizr function| yepnope string| google_maps_api_key boolean| hasGoogleMaps function| _googleMapCallback function| requestUserMedia function| RecordRTC function| RecordRTCConfiguration function| GetRecorderType function| MRecordRTC function| bytesToSize function| invokeSaveAsDialog function| isElectron function| setSrcObject function| isMediaRecorderCompatible function| MediaStreamRecorder function| StereoAudioRecorder function| CanvasRecorder function| WhammyRecorder function| GifRecorder function| MultiStreamsMixer function| MultiStreamRecorder function| RecordRTCPromisesHandler function| InfoBubble function| Xinha function| dumpValues function| getUserMedia string| webrtcDetectedBrowser number| webrtcDetectedVersion number| webrtcMinimumVersion object| webrtcUtils undefined| orgEnumerateDevices function| constraintsToChrome function| origGetUserMedia string| browserFakeUserAgent undefined| lastTime boolean| isEdge boolean| isOpera boolean| isSafari boolean| isChrome object| Whammy object| DiskStorage function| Cookie function| Cufon object| swfobject function| SWFUpload undefined| path object| __xinhas boolean| use_clone_img function| $ function| jQuery object| pjax number| currentUserId string| environment string| layout string| appName function| refreshCSRF object| csrf string| authenticity_token string| csrfParam string| csrfToken function| defaultParams object| Twilio function| ClipboardJS object| Chartist function| moment undefined| daterangepicker function| Quill function| resetXinhaKeywords function| extendXinhaKeywords string| xinha_keywordsVersion string| keywordsBuyerTitle string| keywordsPropertyTitle object| xinha_keywords1 object| xinha_keywords2 object| xinha_keywords3 object| xinha_keywords4 object| xinha_keywords5 object| xinha_keywords6 object| xinha_keywords7 object| xinha_keywords8 object| icons object| Colors function| currencyFormat function| module function| uniqueId function| commaize function| numberToCurrency function| constructorName function| stubDate object| image_paths function| image_path function| image_url object| Observations function| cookie object| CustomDropdown object| Form function| FormConditional function| GCObject function| ManageRows object| GoogleMap function| onMapsAvailable object| MapContent function| MultiCheckboxSelect function| Promotion function| Details object| Account object| Admin object| Attachments object| Autoresponders object| Broadcast object| Buyers object| Classroom object| Communications object| Community function| Comparables object| Contacts object| ContractWizard function| CSVImport object| CustomFields function| Dashboard function| DealNegotiator object| DirectMail object| Duplicates object| Email function| HelpWizard object| Leads function| Login object| Marketing object| Attom object| LeadFinder object| ZipFinder function| Merge function| Message object| Messages object| Numbers object| Offerbot function| Onboarding function| Optin object| OverlayEscapeHandling function| Overlay object| Phone function| phoneCallTo object| Projects object| Properties object| Syndication object| Reports object| Sales function| SearchScreen function| Shortcut object| Signature object| Signup function| SmartSearch object| SocialMedia object| Tasks object| Templates object| Upgrade object| Uploadify object| Webforms object| Websites object| Whiteboard function| Wizard object| Workflows string| _editor_url string| _editor_lang string| _editor_skin string| _editor_icons boolean| _editor_simple function| HTMLArea function| XinhaLoader object| xinha_editors function| xinha_init object| xinha_config object| xinha_plugins object| CreditCard function| subjx object| Domains object| Followup object| Forms function| CountyUpdate function| LeadCampaignSelect function| Menu function| Modal object| modal function| ProblemEmail function| PurchaseAgreement object| Signing object| Sites object| SkipTrace object| SMS object| overlay object| formHelper object| google object| module$exports$mapsapi$geometry$spherical object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView

2 Cookies

Domain/Path Name / Value
my.freedomlogic.com/ Name: _freedomsoft_session
Value: Z1prbi9BdlRmc0FnamIySGNSWnVVWTVUaFBDekdaU05nWG9oUGNOZ0JBbGcrdWF2Vk9ra05ZZHVnR2Z0ZEUxMWl0ZDlNSmN4RnVuUHFTN05STC8xWXphRGlROVFKM1ZTWDExL1pyWENVa25rQ3lQZ0pRY0l4cHpqZkJtRXJxL3Z6eU1ueDBLd1VJbUVoNG5wcG1BUVFYUDVIa2N1SkVNRFFCUDRpU21JTkt6V2o5MFZmQVI4L2JPUHJUMFY1Q0V5LS1VUnlNVGc4NWc1d1hBeTd5bXBtQ25BPT0%3D--d97fa17cfb14df9a1048b8d86c90f4b4c5188d6d
my.freedomlogic.com/ Name: timezone
Value: 3600

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block