urlscan.io logo urlscan.io
SecurityTrails logo

authenticate.historyhit.com Open in urlscan Pro
2606:4700:4400::6812:2346  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://staging-login-historyhit.scoutstaging.co.uk/
Effective URL: https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIE...
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On December 03 via api from IT — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:4400::6812:2346, located in United States and belongs to CLOUDFLARENET, US. The main domain is authenticate.historyhit.com.
TLS certificate: Issued by E1 on November 10th 2023. Valid for: 3 months.
This is the only time authenticate.historyhit.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 3 176.74.16.116 41000 (FREETHOUG...)
1 2 2606:4700:440... 13335 (CLOUDFLAR...)
1 2600:9000:214... 16509 (AMAZON-02)
3 2a00:b980:2:3... 41000 (FREETHOUG...)
6 4
Apex Domain
Subdomains		 Transfer
5 historyhit.com
authenticate.historyhit.com
www.historyhit.com — Cisco Umbrella Rank: 271823
625 KB
3 scoutstaging.co.uk
staging-login-historyhit.scoutstaging.co.uk
3 KB
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 6793
62 KB
6 3
Domain Requested by
3 www.historyhit.com authenticate.historyhit.com
cdn.auth0.com
3 staging-login-historyhit.scoutstaging.co.uk 3 redirects
2 authenticate.historyhit.com 1 redirects
1 cdn.auth0.com authenticate.historyhit.com
6 4

This site contains no links.

Subject Issuer Validity Valid
authenticate.historyhit.com
E1		 2023-11-10 -
2024-02-08		 3 months crt.sh
*.auth0.com
Amazon RSA 2048 M01		 2023-02-24 -
2024-03-24		 a year crt.sh
historyhit.com
R3		 2023-11-27 -
2024-02-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
Frame ID: 43AC57699B2CE7EC1F653C59548DA3F9
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log in | HistoryHit

Page URL History Show full URLs

  1. http://staging-login-historyhit.scoutstaging.co.uk/ HTTP 301
    https://staging-login-historyhit.scoutstaging.co.uk/ HTTP 302
    https://staging-login-historyhit.scoutstaging.co.uk/sso/login HTTP 302
    https://authenticate.historyhit.com/authorize?state=f6559746a4c119209bcdbba25dc0fa77&client_id=gLaPe59Z9rPisHay2... HTTP 302
    https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcn... Page URL

Page Statistics

6
Requests

83 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

686 kB
Transfer

886 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://staging-login-historyhit.scoutstaging.co.uk/ HTTP 301
    https://staging-login-historyhit.scoutstaging.co.uk/ HTTP 302
    https://staging-login-historyhit.scoutstaging.co.uk/sso/login HTTP 302
    https://authenticate.historyhit.com/authorize?state=f6559746a4c119209bcdbba25dc0fa77&client_id=gLaPe59Z9rPisHay2hZswLQoVDVwjpP0&audience=https%3A%2F%2Flogin.historyhit.com&redirect_uri=https%3A%2F%2Fstaging-login-historyhit.scoutstaging.co.uk%2Fsso%2Flogin%2Fcallback&scope=openid%20profile%20email%20offline_access&response_mode=query&response_type=code&nonce=43594126cfdf7d9eaf8e0e948675defe&code_challenge=qQ1fUEY-1XRhkdp_cX8xzb4w0xfxzWqIVox7sgRITpY&code_challenge_method=S256 HTTP 302
    https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
authenticate.historyhit.com/u/
Redirect Chain
  • http://staging-login-historyhit.scoutstaging.co.uk/
  • https://staging-login-historyhit.scoutstaging.co.uk/
  • https://staging-login-historyhit.scoutstaging.co.uk/sso/login
  • https://authenticate.historyhit.com/authorize?state=f6559746a4c119209bcdbba25dc0fa77&client_id=gLaPe59Z9rPisHay2hZswLQoVDVwjpP0&audience=https%3A%2F%2Flogin.historyhit.com&redirect_uri=https%3A%2F%...
  • https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clB...
23 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2346 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6c214e327553bce33930699da7d449fbbf1cbdd3e255248accc84ada48dc3db
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, max-age=0, no-transform
cf-cache-status
DYNAMIC
cf-ray
82f79f040ba16519-LHR
content-language
en
content-security-policy
frame-ancestors 'none'
content-type
text/html; charset=utf-8
date
Sun, 03 Dec 2023 00:16:28 GMT
etag
W/"5b08-7mRwkxYX41M3I8vx44/NrVuIFfA"
expires
Sun, 03 Dec 2023 00:16:28 GMT
pragma
no-cache
referrer-policy
same-origin
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-auth0-requestid
11170e514b1c1c24611b
x-content-type-options
nosniff
x-frame-options
deny
x-ratelimit-limit
20
x-ratelimit-remaining
19
x-ratelimit-reset
1701562595
x-robots-tag
noindex, nofollow
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, max-age=0, no-transform
cf-cache-status
DYNAMIC
cf-ray
82f79f02c9e76519-LHR
content-length
424
content-type
text/html; charset=utf-8
date
Sun, 03 Dec 2023 00:16:28 GMT
location
/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
pragma
no-cache
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept, Accept-Encoding
x-auth0-requestid
7a7446ea31a0802ca830
x-content-type-options
nosniff
x-ratelimit-limit
100
x-ratelimit-remaining
99
x-ratelimit-reset
1701562589
main.cdn.min.css
cdn.auth0.com/ulp/react-components/1.82.34/css/ 		263 KB
62 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.auth0.com/ulp/react-components/1.82.34/css/main.cdn.min.css
Requested by
Host: authenticate.historyhit.com
URL: https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:da00:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e402e7fd8be199fc19bb216e51ef20b0e0b685520919efeabf5f59fdb00dfbde
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id
vn7fjvGq_4qkXMZqKXG06DVPfnG1HmEG
content-encoding
gzip
via
1.1 d01ad8df731d3f120823f9e20df55146.cloudfront.net (CloudFront)
date
Sat, 02 Dec 2023 09:10:09 GMT
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains
x-amz-cf-pop
FRA53-C1
age
54387
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
FAILED
last-modified
Fri, 17 Nov 2023 18:26:27 GMT
server
AmazonS3
etag
W/"aaa7d223fe8edf4885e4e1c35ebfaeaa"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=2628000,public
x-robots-tag
noindex
x-amz-cf-id
INOHZVkBtsLn7yzxDt_MaDt3_DddOKElAYvQUdogOSMSJPht35wOiw==
logo-scaled.jpg
www.historyhit.com/app/uploads/2020/10/ 		362 KB
362 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.historyhit.com/app/uploads/2020/10/logo-scaled.jpg
Requested by
Host: authenticate.historyhit.com
URL: https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:b980:2:3::a093:540e Cricklewood, United Kingdom, ASN41000 (FREETHOUGHT-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ea538017b8309bc3f115e1a3b8449adb18df316bbc730e696a296d449bdf40d3

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 00:16:29 GMT
last-modified
Wed, 07 Oct 2020 10:50:25 GMT
server
nginx
etag
"5f7d9d71-5a6c7"
vary
Accept
content-type
image/jpeg
accept-ranges
bytes
content-length
370375
History-Hit-Subscribe-to-History-Hit.jpg
www.historyhit.com/app/uploads/2023/08/ 		222 KB
222 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.historyhit.com/app/uploads/2023/08/History-Hit-Subscribe-to-History-Hit.jpg
Requested by
Host: cdn.auth0.com
URL: https://cdn.auth0.com/ulp/react-components/1.82.34/css/main.cdn.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:b980:2:3::a093:540e Cricklewood, United Kingdom, ASN41000 (FREETHOUGHT-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
898c06b457028a951a0f0058edc5ec4396f3e4ce94048c36de9a0bfcffa6b215

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://cdn.auth0.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 00:16:29 GMT
last-modified
Fri, 18 Aug 2023 11:30:50 GMT
server
nginx
etag
"64df566a-3770a"
vary
Accept
content-type
image/webp
accept-ranges
bytes
content-length
227082
Logo_Light-1-1.png
www.historyhit.com/app/uploads/2021/10/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.historyhit.com/app/uploads/2021/10/Logo_Light-1-1.png
Requested by
Host: authenticate.historyhit.com
URL: https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:b980:2:3::a093:540e Cricklewood, United Kingdom, ASN41000 (FREETHOUGHT-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
3a0a04664d8d4daa94838ba6aa5c125ad500504a912d5c548bf45aea748b59f2

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://authenticate.historyhit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Sun, 03 Dec 2023 00:16:29 GMT
last-modified
Fri, 29 Oct 2021 11:21:55 GMT
server
nginx
etag
"617bd953-41f0"
vary
Accept
content-type
image/webp
accept-ranges
bytes
content-length
16880
truncated
/ 		650 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aaf1eac584819e98c7f78a20216bd2fb10ee29e10b290983bc0fa82d0f293bce

Request headers

Referer
Origin
https://authenticate.historyhit.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
w3tc.woff
www.historyhit.com/app/plugins/w3-total-cache/pub/fonts/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.historyhit.com
URL
https://www.historyhit.com/app/plugins/w3-total-cache/pub/fonts/w3tc.woff

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

7 Cookies

Domain/Path Name / Value
staging-login-historyhit.scoutstaging.co.uk/ Name: auth0_transient_0
Value: %7B%22tag%22%3A%223y6AwmChyUc%5C%2Fqy1UwVoB5g%3D%3D%22%2C%22iv%22%3A%22GctLpOTya03Krdou%22%2C%22data%22%3A%2227392fplbv2cq4V43rxlFdVmugcH5l8GWtHOAwJk7Ex95hPfTsz1%5C%2FezUmZI3cVsHDoceDYwwVIAAPQizk2i8MpGW6JcDv77hJDN8Dqk%5C%2FkX9%2BykuoD4z42nlPC1x0GmaclDdGdvoI3C5XYLlJpNN6mYavdDIwIenhCLCXFXw8gKibtPeRiLqxrByajj9dWlJbEeQEsmZ95H1lSUj7A52jkUJgx8f8QArbMT3%2B0sFwfSlY2Gj5jYu7J6GbK%2BzDHzxWt0cInWQy9FWduxQM1%2BXiSvaguy5JfK1scYYmhitdqvOdgIjE98xlWEdJ%22%7D
staging-login-historyhit.scoutstaging.co.uk/ Name: XSRF-TOKEN
Value: eyJpdiI6IlVWU3g5V3c2dEFPdldadHU0Zkl2OWc9PSIsInZhbHVlIjoiZHU2K0tTTUVRalNQRUpmU1VIczRncmlrOXJDcUYvSWpxUHh0d01hREJtNmFwem9HQWdxY0N6TEdpNFpmbll2ajR2U3hVTEZtSWZZOXFYVnl1OG9Uei9VMnJmdGt4cjBDRUJhYUZQOTU3VjJiWHRVTUgxOFFRRHhFcFI2T1Y4QmUiLCJtYWMiOiJmMThiNmUzZGFkZmZjMGM4YWNmNjcxZDRjNWM2MDFmMzExOGY0YTUxODNmODhjODUyNTYyNDcwZTBhZDQ3YmIwIiwidGFnIjoiIn0%3D
staging-login-historyhit.scoutstaging.co.uk/ Name: historyhitlogin_session
Value: eyJpdiI6InF2a2xIOGZmQXFlR1ltZHB4VnJCT3c9PSIsInZhbHVlIjoiR1JIc3FlallDRVhPS1kyU3lsVDQvOFQzWEVZVnhNdFdQOWxjbjJHUTdOM04xaU9hU2hqS1JQbTJibDZxZVp1RjBGTllnWW9qanQ0NU4vdGJ4NmtoT2lUamoxcmNXMlZZRUFxU0x2UUhSbWVHN0NVL2F2ai9LNG5EcEVrWDNZM2EiLCJtYWMiOiI3ZDAwNzI3OTFhN2FkYjNhYWMwODY0NzUxYWQ2ZmNiYjU1NDY3ODMzMTNiYmRmZWVkMjU4NTdlMmMwNjgzZmRlIiwidGFnIjoiIn0%3D
authenticate.historyhit.com/ Name: did
Value: s%3Av0%3A341caad0-9171-11ee-ba8a-8373dd06f579.W9x8NXcjQNZlmmXiLDmFje26OG4Izgd%2BIxB9FQVBAMM
authenticate.historyhit.com/ Name: auth0
Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQFOTU6IRZxazhChWa1jSgeCyF4DmQ6c1W_NuXNyCdmB_CyWMUbb5ZgoZ4PXoyBSc1c7zgWm5vUsXGHIi_3kC5UCmY29va2llg6dleHBpcmVz1_-3GwAAZW-9XK5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.EhIMnml1usY25HhJ2Mo3fbtYnmqsDqV1zkRFt63l%2BRI
authenticate.historyhit.com/ Name: did_compat
Value: s%3Av0%3A341caad0-9171-11ee-ba8a-8373dd06f579.W9x8NXcjQNZlmmXiLDmFje26OG4Izgd%2BIxB9FQVBAMM
authenticate.historyhit.com/ Name: auth0_compat
Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQFOTU6IRZxazhChWa1jSgeCyF4DmQ6c1W_NuXNyCdmB_CyWMUbb5ZgoZ4PXoyBSc1c7zgWm5vUsXGHIi_3kC5UCmY29va2llg6dleHBpcmVz1_-3GwAAZW-9XK5vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.EhIMnml1usY25HhJ2Mo3fbtYnmqsDqV1zkRFt63l%2BRI

2 Console Messages

Source Level URL
Text
javascript error URL: https://authenticate.historyhit.com/u/login?state=hKFo2SBhQ1R1c3dRTEVjQXNXQzg0cGZENXBRTkc2NDMtc3p5eqFur3VuaXZlcnNhbC1sb2dpbqN0aWTZIEQ3VDdJcjlpX3FNanBKQ2RKWHZIRFl5V0FlU3YwMUU3o2NpZNkgZ0xhUGU1OVo5clBpc0hheTJoWnN3TFFvVkRWd2pwUDA
Message:
Access to font at 'https://www.historyhit.com/app/plugins/w3-total-cache/pub/fonts/w3tc.woff' from origin 'https://authenticate.historyhit.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.historyhit.com/app/plugins/w3-total-cache/pub/fonts/w3tc.woff
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block