gumpy.uber.space Open in urlscan Pro
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959  Public Scan

Submitted URL: https://gumpy.uber.space/
Effective URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Submission: On March 25 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2a00:d0c0:200:0:c8b3:e2ff:fe13:3959, located in Germany and belongs to UBERSPACE, DE. The main domain is gumpy.uber.space.
TLS certificate: Issued by R3 on January 24th 2023. Valid for: 3 months.
This is the only time gumpy.uber.space was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 12 2a00:d0c0:200... 205766 (UBERSPACE)
11 1
Apex Domain
Subdomains
Transfer
12 uber.space
gumpy.uber.space
108 KB
11 1
Domain Requested by
12 gumpy.uber.space 1 redirects gumpy.uber.space
11 1

This site contains no links.

Subject Issuer Validity Valid
gumpy.uber.space
R3
2023-01-24 -
2023-04-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://gumpy.uber.space/i/?rid=641ebc55e3730
Frame ID: D56E0E3EB5BFD1F7E19C30B57C5C39F3
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Anmelden ยท FreshRSS

Page URL History Show full URLs

  1. https://gumpy.uber.space/ HTTP 302
    https://gumpy.uber.space/i/?rid=641ebc55e3730 Page URL

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

108 kB
Transfer

218 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://gumpy.uber.space/ HTTP 302
    https://gumpy.uber.space/i/?rid=641ebc55e3730 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
gumpy.uber.space/i/
Redirect Chain
  • https://gumpy.uber.space/
  • https://gumpy.uber.space/i/?rid=641ebc55e3730
5 KB
3 KB
Document
General
Full URL
https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
9a94cd274165ff77423e9a57c1d476bd2329648c0b4bda3f77137655d0852908
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private, must-revalidate, max-age=0
content-encoding
gzip
content-length
2243
content-security-policy
default-src 'self'
content-type
text/html; charset=UTF-8
date
Sat, 25 Mar 2023 09:18:13 GMT
etag
"98743a0b82460eb37daaea1ecd0d18d9-gzip"
last-modified
Sat, 25 Mar 2023 09:18:13 GMT
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Sat, 25 Mar 2023 09:18:13 GMT
location
/i/?rid=641ebc55e3730
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
frss.css
gumpy.uber.space/themes/base-theme/
35 KB
8 KB
Stylesheet
General
Full URL
https://gumpy.uber.space/themes/base-theme/frss.css?1670687261
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
46f533f10e6fe818df1e4a78474d437d0f30298e2a68fda322a3307c86fdb09a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gumpy.uber.space/i/?rid=641ebc55e3730
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
referrer-policy
strict-origin-when-cross-origin
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
7810
x-xss-protection
1; mode=block
expires
Mon, 24 Apr 2023 09:18:13 GMT
origine.css
gumpy.uber.space/themes/Origine/
24 KB
5 KB
Stylesheet
General
Full URL
https://gumpy.uber.space/themes/Origine/origine.css?1670687261
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
60c18027d7f9058f81c23d730641ae15a929cd7a18659a84480ae2c2f9c4e4d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gumpy.uber.space/i/?rid=641ebc55e3730
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
referrer-policy
strict-origin-when-cross-origin
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
4578
x-xss-protection
1; mode=block
expires
Mon, 24 Apr 2023 09:18:13 GMT
main.js
gumpy.uber.space/scripts/
53 KB
13 KB
Script
General
Full URL
https://gumpy.uber.space/scripts/main.js?1670687261
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
307d81f9dcac63264ff977167ff50281441072fd06f359f3faa48f32cab8360f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gumpy.uber.space/i/?rid=641ebc55e3730
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
referrer-policy
strict-origin-when-cross-origin
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
12680
x-xss-protection
1; mode=block
expires
Mon, 24 Apr 2023 09:18:13 GMT
extra.js
gumpy.uber.space/scripts/
9 KB
3 KB
Script
General
Full URL
https://gumpy.uber.space/scripts/extra.js?1670687261
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
d4754d01e7d7b95df82018a25418d510cfbe8aaf30eb3c0fd41530faab322cd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gumpy.uber.space/i/?rid=641ebc55e3730
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
referrer-policy
strict-origin-when-cross-origin
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
2848
x-xss-protection
1; mode=block
expires
Mon, 24 Apr 2023 09:18:13 GMT
bcrypt.min.js
gumpy.uber.space/scripts/
25 KB
11 KB
Script
General
Full URL
https://gumpy.uber.space/scripts/bcrypt.min.js?1670687261
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
0f11720f78bedc2b3dcbb4705ee963aa2d111e14390cf8f939d8951d79057f4f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://gumpy.uber.space/i/?rid=641ebc55e3730
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
referrer-policy
strict-origin-when-cross-origin
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
11140
x-xss-protection
1; mode=block
expires
Mon, 24 Apr 2023 09:18:13 GMT
FreshRSS-logo.svg
gumpy.uber.space/themes/icons/
5 KB
2 KB
Image
General
Full URL
https://gumpy.uber.space/themes/icons/FreshRSS-logo.svg
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
6f2204dd7f6c45678f263880c383a3b4e044ff85562cccad83a3fb7b93a554be
Security Headers
Name Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; style-src 'self' 'unsafe-inline'
strict-transport-security
max-age=31536000
content-length
1950
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
expires
Mon, 24 Apr 2023 09:18:13 GMT
OpenSans.woff2
gumpy.uber.space/themes/fonts/
61 KB
61 KB
Font
General
Full URL
https://gumpy.uber.space/themes/fonts/OpenSans.woff2
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/themes/base-theme/frss.css?1670687261
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
3cfb28778895d6adca324710b2000c6e15ef5a7b88d461f39b29ff6fb877b778
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://gumpy.uber.space/themes/base-theme/frss.css?1670687261
Origin
https://gumpy.uber.space
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:14 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
x-frame-options
SAMEORIGIN
content-type
application/font-woff2
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
61980
x-xss-protection
1; mode=block
expires
Mon, 24 Apr 2023 09:18:14 GMT
login.svg
gumpy.uber.space/themes/icons/
501 B
764 B
Image
General
Full URL
https://gumpy.uber.space/themes/icons/login.svg
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
927cdd428e37be097be89ee529f9d20f5db279f741e3fa0bd86df556524507f0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; style-src 'self' 'unsafe-inline'
strict-transport-security
max-age=31536000
content-length
328
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
expires
Mon, 24 Apr 2023 09:18:14 GMT
key.svg
gumpy.uber.space/themes/icons/
526 B
789 B
Image
General
Full URL
https://gumpy.uber.space/themes/icons/key.svg
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
d59799e117accae31b85dba0db8405ad01d1380a1699e2b1fb5f4ac8ecc5479d
Security Headers
Name Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; style-src 'self' 'unsafe-inline'
strict-transport-security
max-age=31536000
content-length
353
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
expires
Mon, 24 Apr 2023 09:18:14 GMT
close.svg
gumpy.uber.space/themes/icons/
534 B
796 B
Image
General
Full URL
https://gumpy.uber.space/themes/icons/close.svg
Requested by
Host: gumpy.uber.space
URL: https://gumpy.uber.space/i/?rid=641ebc55e3730
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:d0c0:200:0:c8b3:e2ff:fe13:3959 , Germany, ASN205766 (UBERSPACE, DE),
Reverse DNS
Software
nginx /
Resource Hash
8afcff447d9cf709acdc7324da2491bf36684b5f193db30a04de3fbd5d1d287e
Security Headers
Name Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sat, 25 Mar 2023 09:18:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
default-src 'self'; style-src 'self' 'unsafe-inline'
strict-transport-security
max-age=31536000
content-length
360
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sat, 10 Dec 2022 15:47:41 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml; charset=utf-8
cache-control
max-age=2592000, public
accept-ranges
bytes
expires
Mon, 24 Apr 2023 09:18:14 GMT

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| poormanSalt function| forgetOpenCategories function| init_crypto_form function| showPW_this function| showPW function| hidePW function| init_password_observers function| init_archiving function| open_slider_listener function| init_slider function| updateHref function| init_url_observers function| init_select_observers function| data_leave_validation function| init_configuration_alert function| init_extra_afterDOM object| $jscomp object| dcodeIO function| xmlHttpRequestJson object| context function| badAjax function| needsScroll function| str2int function| numberFormat function| incLabel function| incUnreadsFeed function| incUnreadsTag function| removeArticle function| send_mark_read_queue function| send_mark_queue_tick function| delayedClick function| mark_read function| mark_previous_read function| mark_favorite function| toggleContent function| prev_entry function| next_entry function| next_unread_entry function| prev_feed function| next_feed function| first_feed function| last_feed function| prev_category function| next_category function| next_unread_category function| first_category function| last_category function| collapse_entry function| toggle_media function| user_filter function| auto_share function| onScroll function| init_posts function| rememberOpenCategory function| openCategory function| loadJs function| init_column_categories function| init_shortcuts function| init_stream function| init_nav_entries function| loadDynamicTags function| refreshFeed function| refreshFeeds function| refreshDynamicOpml function| refreshDynamicOpmls function| init_actualize function| openNotification function| closeNotification function| init_notifications function| notifs_html5_is_supported function| notifs_html5_ask_permission function| notifs_html5_show function| init_notifs_html5 function| refreshUnreads function| load_more_posts function| init_load_more function| init_confirm_action function| faviconNbUnread function| removeFirstLoadSpinner function| init_normal function| init_main_beforeDOM function| init_main_afterDOM

1 Cookies

Domain/Path Name / Value
gumpy.uber.space/i/ Name: FreshRSS
Value: bspcvp04al4bu8cqah0je1hfqp

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block