Submitted URL: https://bbplay.horuss.pl/
Effective URL: https://bbplay.horuss.pl/login
Submission: On June 13 via api from US — Scanned from PL

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 213.189.52.246, located in Poland and belongs to ATMAN-ISP-AS ATM S.A., PL. The main domain is bbplay.horuss.pl.
TLS certificate: Issued by R11 on June 12th 2024. Valid for: 3 months.
This is the only time bbplay.horuss.pl was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 14 213.189.52.246 15694 (ATMAN-ISP...)
13 1
Apex Domain
Subdomains
Transfer
14 horuss.pl
bbplay.horuss.pl
765 KB
13 1
Domain Requested by
14 bbplay.horuss.pl 1 redirects bbplay.horuss.pl
13 1

This site contains no links.

Subject Issuer Validity Valid
bbplay.horuss.pl
R11
2024-06-12 -
2024-09-10
3 months crt.sh

This page contains 1 frames:

Primary Page: https://bbplay.horuss.pl/login
Frame ID: 05C2E837EC73BFD4D1ADD19555489DC9
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

BBPlay

Page URL History Show full URLs

  1. https://bbplay.horuss.pl/ HTTP 302
    http://bbplay.horuss.pl/login HTTP 307
    https://bbplay.horuss.pl/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • vaadinBootstrap\.js(?:\?v=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

765 kB
Transfer

1605 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bbplay.horuss.pl/ HTTP 302
    http://bbplay.horuss.pl/login HTTP 307
    https://bbplay.horuss.pl/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
bbplay.horuss.pl/
Redirect Chain
  • https://bbplay.horuss.pl/
  • http://bbplay.horuss.pl/login
  • https://bbplay.horuss.pl/login
2 KB
2 KB
Document
General
Full URL
https://bbplay.horuss.pl/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
6a23c1282a9fb3b53fd57c049924c933f8052361f978d1becebda70eee920dd0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
pl-PL,pl;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-cache
content-length
2105
content-type
text/html
date
Thu, 13 Jun 2024 11:05:26 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
nginx
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

Location
https://bbplay.horuss.pl/login
Non-Authoritative-Reason
HttpsUpgrades
vaadinBootstrap.js
bbplay.horuss.pl/VAADIN/
10 KB
4 KB
Script
General
Full URL
https://bbplay.horuss.pl/VAADIN/vaadinBootstrap.js?v=7.6.8
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
908b341dfe033bc107157c0e867adf117efbc64437803c14d579d65fcfe7659d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
content-encoding
gzip
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-type
application/javascript
cache-control
max-age=3600
content-length
3533
expires
Thu, 13 Jun 2024 12:05:26 GMT
styles.css
bbplay.horuss.pl/VAADIN/themes/bbplay-theme/
284 KB
284 KB
Stylesheet
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/vaadinBootstrap.js?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
cd88cfe91c560dd2b9d9afabc51a570a7bdd86c73d13d710ab52a01c34e8e5a3

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
cache-control
no-cache
server
nginx
content-type
text/css
com.vaadin.DefaultWidgetSet.nocache.js
bbplay.horuss.pl/VAADIN/widgetsets/com.vaadin.DefaultWidgetSet/
8 KB
3 KB
Script
General
Full URL
https://bbplay.horuss.pl/VAADIN/widgetsets/com.vaadin.DefaultWidgetSet/com.vaadin.DefaultWidgetSet.nocache.js?1718276725680
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/vaadinBootstrap.js?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
d3febaadc9ed5aa87435f32ef68747ffe0b88517ae589a5e8175135e3ec36417

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
content-encoding
gzip
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-type
application/javascript
cache-control
public, max-age=0, must-revalidate
content-length
3296
expires
Thu, 13 Jun 2024 11:05:26 GMT
login
bbplay.horuss.pl/
5 KB
5 KB
XHR
General
Full URL
https://bbplay.horuss.pl/login?v-1718276725680
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/vaadinBootstrap.js?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
98b991a249530704ad165ad08156cccb496fe5147aeb2fb5d8e74d7cce7bfb5e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
x-content-type-options
nosniff
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/json;charset=UTF-8
cache-control
no-cache
content-length
4702
x-xss-protection
1; mode=block
5CD95C24EAF55816C4E9CB7BCA48A69B.cache.js
bbplay.horuss.pl/VAADIN/widgetsets/com.vaadin.DefaultWidgetSet/
1 MB
360 KB
Script
General
Full URL
https://bbplay.horuss.pl/VAADIN/widgetsets/com.vaadin.DefaultWidgetSet/5CD95C24EAF55816C4E9CB7BCA48A69B.cache.js
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/widgetsets/com.vaadin.DefaultWidgetSet/com.vaadin.DefaultWidgetSet.nocache.js?1718276725680
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
8b444ceac0d26643ef03b8fc94dfb851a2b9f5831252030593754c3c631d9641

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
content-encoding
gzip
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-type
application/javascript
cache-control
max-age=31536000
content-length
368336
expires
Sun, 30 Jun 2024 11:45:55 GMT
spinner.gif
bbplay.horuss.pl/VAADIN/themes/valo/shared/img/
7 KB
7 KB
Image
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/valo/shared/img/spinner.gif
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
5a1c6055996cc7341ceda074b611734efad98fc47706b243697bb9cec629c94b

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-type
image/gif
date
Thu, 13 Jun 2024 11:05:26 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
7194
expires
Thu, 13 Jun 2024 12:05:26 GMT
open-sans-v13-latin-ext-300.woff2
bbplay.horuss.pl/VAADIN/fonts/
23 KB
23 KB
Font
General
Full URL
https://bbplay.horuss.pl/VAADIN/fonts/open-sans-v13-latin-ext-300.woff2
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
95187fef8e9181908f372efb4d8609d76ad80b30b8b35171ecd22bbd4f2e9a36

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Origin
https://bbplay.horuss.pl
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
23816
expires
Thu, 13 Jun 2024 12:05:26 GMT
favicon.ico
bbplay.horuss.pl/VAADIN/themes/bbplay-theme/
22 KB
22 KB
Other
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
24463825748e7e295d9b15966071be347d8589c33fa67489b78e7b15d7483958

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:26 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
22382
expires
Thu, 13 Jun 2024 12:05:26 GMT
OpenSans-Regular-webfont.woff
bbplay.horuss.pl/VAADIN/themes/valo/fonts/open-sans/
22 KB
22 KB
Font
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/valo/fonts/open-sans/OpenSans-Regular-webfont.woff
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
22e7a1b10c110072f5a0bfd16e2197a76b279ec879bcce8978fada1dc9ee5d40

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Origin
https://bbplay.horuss.pl
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:27 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
22660
expires
Thu, 13 Jun 2024 12:05:27 GMT
themeicons-webfont.woff
bbplay.horuss.pl/VAADIN/themes/base/fonts/
8 KB
8 KB
Font
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/base/fonts/themeicons-webfont.woff
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
4f5bd7ed23fe76a4dca936f76c02bd6d43eac334ff181ef0ba64fba2a83c40f0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Origin
https://bbplay.horuss.pl
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:27 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
7868
expires
Thu, 13 Jun 2024 12:05:27 GMT
OpenSans-Semibold-webfont.woff
bbplay.horuss.pl/VAADIN/themes/valo/fonts/open-sans/
22 KB
23 KB
Font
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/valo/fonts/open-sans/OpenSans-Semibold-webfont.woff
Requested by
Host: bbplay.horuss.pl
URL: https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
26b216fadb2ffcd542ca56c2d84f9918f62e40de89bf88b4211fffacd2a4ad83

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/styles.css?v=7.6.8
Origin
https://bbplay.horuss.pl
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 13 Jun 2024 11:05:27 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
22908
expires
Thu, 13 Jun 2024 12:05:27 GMT
pl.png
bbplay.horuss.pl/VAADIN/themes/bbplay-theme/icons/
815 B
963 B
Image
General
Full URL
https://bbplay.horuss.pl/VAADIN/themes/bbplay-theme/icons/pl.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
213.189.52.246 , Poland, ASN15694 (ATMAN-ISP-AS ATM S.A., PL),
Reverse DNS
web37.mydevil.net
Software
nginx /
Resource Hash
b7469df5e106fbf1ab5f4a510fa88a5b34006f068ee956dbe6d1200ee4798e20

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://bbplay.horuss.pl/login
Accept-Language
pl-PL,pl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-type
image/png
date
Thu, 13 Jun 2024 11:05:27 GMT
cache-control
max-age=3600
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
content-length
815
expires
Thu, 13 Jun 2024 12:05:27 GMT

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 undefined| event object| fence object| sharedStorage object| vaadin function| __gwtStatsEvent function| com_vaadin_DefaultWidgetSet object| __gwt_activeModules function| __gwt_getMetaProperty function| __gwt_isKnownPropertyValue object| __gwt_stylesLoaded function| GwtPotentialElementShim

2 Cookies

Domain/Path Name / Value
bbplay.horuss.pl/ Name: JSESSIONID
Value: 8698F1B5FDD11E1DE4D6345C06A72895
bbplay.horuss.pl/ Name: bbplay-lang
Value: pl

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://bbplay.horuss.pl/login
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block