urlscan.io logo urlscan.io
SecurityTrails logo

www.praca.gov.pl Open in urlscan Pro
217.153.230.100  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.praca.gov.pl/
Effective URL: https://www.praca.gov.pl/eurzad/index.eup
Submission: On September 17 via manual from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 217.153.230.100, located in Warsaw, Poland and belongs to GTSCE GTS Central Europe / Antel Germany, CZ. The main domain is www.praca.gov.pl.
TLS certificate: Issued by Certum Organization Validation CA SHA2 on February 20th 2018. Valid for: 3 years.
This is the only time www.praca.gov.pl was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 12 217.153.230.100 5588 (GTSCE GTS...)
10 1
Apex Domain
Subdomains		 Transfer
12 praca.gov.pl
www.praca.gov.pl
1 MB
10 1
Domain Requested by
12 www.praca.gov.pl 2 redirects www.praca.gov.pl
10 1
Subject Issuer Validity Valid
*.praca.gov.pl
Certum Organization Validation CA SHA2		 2018-02-20 -
2021-02-19		 3 years crt.sh

This page contains 1 frames:

Primary Page: https://www.praca.gov.pl/eurzad/index.eup
Frame ID: 0ED377D35CC7009BBD83C0FC4AA56B84
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.praca.gov.pl/ HTTP 302
    https://www.praca.gov.pl/eurzad/ HTTP 302
    https://www.praca.gov.pl/eurzad/index.eup Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1369 kB
Transfer

3393 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.praca.gov.pl/ HTTP 302
    https://www.praca.gov.pl/eurzad/ HTTP 302
    https://www.praca.gov.pl/eurzad/index.eup Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.eup
www.praca.gov.pl/eurzad/
Redirect Chain
  • https://www.praca.gov.pl/
  • https://www.praca.gov.pl/eurzad/
  • https://www.praca.gov.pl/eurzad/index.eup
3 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/index.eup
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
/
Resource Hash
26d80836354fec75bceccb56dcf5a12f87c740cf0fa3f089c45ebee828f3d83c
Security Headers
Name Value
Content-Security-Policy script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.praca.gov.pl
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
JSESSIONIDEURZAD=66B091870FD8A3848691E5EEC59AC193.node4
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:35 GMT
X-Frame-Options
SAMEORIGIN SAMEORIGIN
Vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
X-UA-Compatible
IE=edge
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Expires
-1
Charset
UTF-8
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Security-Policy
script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
Referrer-Policy
strict-origin-when-cross-origin
Content-Type
text/html;charset=UTF-8
Content-Language
en-US
X-Route
node4
X-Cnection
close
Transfer-Encoding
chunked

Redirect headers

Date
Thu, 17 Sep 2020 15:43:35 GMT
X-Frame-Options
SAMEORIGIN SAMEORIGIN
Vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
Set-Cookie
JSESSIONIDEURZAD=66B091870FD8A3848691E5EEC59AC193.node4; Path=/; Secure; HttpOnly; SameSite=None ROUTEID=.node4; path=/formularze
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Pragma
no-cache
Expires
0
Content-Security-Policy
script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
Referrer-Policy
strict-origin-when-cross-origin
Location
index.eup
Content-Type
text/html;charset=UTF-8
Content-Length
0
X-Route
node4
X-Cnection
close
eup-normal.css
www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/ 		575 KB
55 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/index.eup
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
Apache /
Resource Hash
d81b46088cbf68dc94da80e2e6424fd157ce6465e22522b20a2896c9ef5bfb41
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.praca.gov.pl/eurzad/index.eup
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:35 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Tue, 15 Sep 2020 07:35:30 GMT
Server
Apache
Cache-Control
public
Age
152777
ETag
W/"589215-1600155330000"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
X-Cnection
close
X-Route
node4
Accept-Ranges
bytes
Content-Length
55653
Expires
Wed, 15 Sep 2021 21:17:18 GMT
script.js
www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/js/ 		2 MB
407 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/js/script.js
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/index.eup
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
Apache /
Resource Hash
8f3995062942d654bbe57ac19e92824c214c36352a860a2d004bf012939af443
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.praca.gov.pl/eurzad/index.eup
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:36 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Tue, 15 Sep 2020 07:35:26 GMT
Server
Apache
Cache-Control
public
Age
21763
ETag
W/"1844714-1600155326000"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
X-Cnection
close
X-Route
node1
Accept-Ranges
bytes
Content-Length
416628
Expires
Fri, 17 Sep 2021 09:40:52 GMT
szafirsdk-module.js
www.praca.gov.pl/eurzad/podpis/lib/ 		26 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/podpis/lib/szafirsdk-module.js
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/js/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
/
Resource Hash
c16e2c5248f4eea677929f114c3931c83271b84720b569c9c70890ddb8ae559a
Security Headers
Name Value
Content-Security-Policy script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.praca.gov.pl/eurzad/index.eup
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 17 Sep 2020 15:43:36 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Content-Type
text/javascript;charset=UTF-8
X-Cnection
close
Transfer-Encoding
chunked
Content-Security-Policy
script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Route
node4
Vary
Origin,Accept-Encoding,Access-Control-Request-Method,Access-Control-Request-Headers
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Expires
0
szafirsdk-messages.js
www.praca.gov.pl/eurzad/podpis/lib/ 		13 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/podpis/lib/szafirsdk-messages.js
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/js/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
/
Resource Hash
d07b1a10af231c7bbf84a29cb9cdf5dd5f9958b67a2710c66d667db9d8fbd025
Security Headers
Name Value
Content-Security-Policy script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.praca.gov.pl/eurzad/index.eup
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 17 Sep 2020 15:43:36 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Content-Type
text/javascript;charset=UTF-8
X-Cnection
close
Transfer-Encoding
chunked
Content-Security-Policy
script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Route
node4
Vary
Origin,Accept-Encoding,Access-Control-Request-Method,Access-Control-Request-Headers
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Expires
0
img-normal.png
www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/img/ 		752 KB
752 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/img/img-normal.png
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
Apache /
Resource Hash
4b88ae735c6916d4be43f5493fb435a6729f12332f2a44b8dff09c8b85fe7cef
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:36 GMT
X-Route
node4
Last-Modified
Tue, 15 Sep 2020 07:34:48 GMT
Server
Apache
Cache-Control
public
Age
152777
ETag
W/"769804-1600155288000"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
X-Cnection
close
Accept-Ranges
bytes
Content-Length
769804
Expires
Wed, 15 Sep 2021 21:17:19 GMT
zielona_linia.svg
www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/img/svg/ 		563 B
922 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/img/svg/zielona_linia.svg
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
Apache /
Resource Hash
ee809929ea1951924dd426a92485bb509547d021583a0e390941ed25ceeb4e22
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:36 GMT
X-Route
node4
Last-Modified
Mon, 18 May 2020 07:28:00 GMT
Server
Apache
Cache-Control
public
Age
152777
ETag
W/"563-1589786880000"
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
X-Cnection
close
Accept-Ranges
bytes
Content-Length
563
Expires
Wed, 15 Sep 2021 21:17:19 GMT
pobierzTrescKlauzuli.eup
www.praca.gov.pl/eurzad/ 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/pobierzTrescKlauzuli.eup
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/js/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
/
Resource Hash
0587404b3b862106b8d1794867fb8dc8dd64fa9eb71330254d218006c9158c32
Security Headers
Name Value
Content-Security-Policy script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json; q=1.0, */*; q=0.1
Referer
https://www.praca.gov.pl/eurzad/index.eup
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 17 Sep 2020 15:43:37 GMT
X-Route
node4
X-Content-Type-Options
nosniff
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Content-Type
application/json;charset=UTF-8
X-Cnection
close
Transfer-Encoding
chunked
Content-Security-Policy
script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
Vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
X-XSS-Protection
1; mode=block
Referrer-Policy
strict-origin-when-cross-origin
Expires
0
FiraSansOT-Regular.otf
www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/fonts/ 		108 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/fonts/FiraSansOT-Regular.otf
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
Apache /
Resource Hash
469428b4cd346aa466155d4c28ce55cd2ee680363423f73854c0eef4f8348dfb
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://www.praca.gov.pl
Referer
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:37 GMT
X-Route
node4
Vary
Accept-Encoding
Last-Modified
Mon, 18 May 2020 07:28:00 GMT
Server
Apache
Cache-Control
public
Age
152778
ETag
W/"110244-1589786880000"
X-Frame-Options
SAMEORIGIN
Content-Type
font/otf
X-Cnection
close
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
68792
Expires
Wed, 15 Sep 2021 21:17:18 GMT
FiraSansOT-Medium.otf
www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/fonts/ 		110 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/fonts/FiraSansOT-Medium.otf
Requested by
Host: www.praca.gov.pl
URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.153.230.100 Warsaw, Poland, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
Software
Apache /
Resource Hash
f061b1a12092df3a6e3cd4364b4ab63ed1c9ce3de7706e63e518bdf84a0ca5a9
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://www.praca.gov.pl
Referer
https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/styles/eup-normal.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 17 Sep 2020 15:43:37 GMT
X-Route
node4
Vary
Accept-Encoding
Last-Modified
Mon, 18 May 2020 07:28:00 GMT
Server
Apache
Cache-Control
public
Age
152777
ETag
W/"112860-1589786880000"
X-Frame-Options
SAMEORIGIN
Content-Type
font/otf
X-Cnection
close
Accept-Ranges
bytes
Content-Encoding
gzip
Content-Length
71397
Expires
Wed, 15 Sep 2021 21:17:19 GMT

Verdicts & Comments Add Verdict or Comment

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| requirejs function| require function| define function| $ function| jQuery object| angular object| DEV_PANEL object| zalaczniki boolean| mCustomScrollbar object| SZAFIR_MESSAGES function| appendAsyncSzafirAppletResultPart function| setAsyncSzafirAppletResult function| setAsyncSzafirAppletError object| SZAFIR_SDK

1 Cookies

Domain/Path Name / Value
www.praca.gov.pl/ Name: JSESSIONIDEURZAD
Value: 66B091870FD8A3848691E5EEC59AC193.node4

1 Console Messages

Source Level URL
Text
console-api error URL: https://www.praca.gov.pl/eurzad/compressed_2.0.52_1.32.20/js/script.js(Line 1)
Message:
ReferenceError: isSafariOsx is not defined

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src * 'self' 'unsafe-eval' 'unsafe-inline' blob: data: gap:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block