Submitted URL: http://account.34sp.com/
Effective URL: https://account.34sp.com/login
Submission: On October 03 via manual from GB — Scanned from GB

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 2a00:1ee0:2:4::3433, located in United Kingdom and belongs to UK-34SP-AS, GB. The main domain is account.34sp.com.
TLS certificate: Issued by R3 on August 11th 2022. Valid for: 3 months.
This is the only time account.34sp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 4 2a00:1ee0:2:4... 41357 (UK-34SP-AS)
4 2a00:1ee0:2:4... 41357 (UK-34SP-AS)
5 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
13 4
Apex Domain
Subdomains
Transfer
5 typekit.net
use.typekit.net — Cisco Umbrella Rank: 1023
p.typekit.net — Cisco Umbrella Rank: 1263
160 KB
4 34sp.net
34sp.net
294 KB
4 34sp.com
account.34sp.com
6 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 94
20 KB
13 4
Domain Requested by
4 use.typekit.net account.34sp.com
4 34sp.net account.34sp.com
34sp.net
4 account.34sp.com 2 redirects 34sp.net
2 www.google-analytics.com account.34sp.com
www.google-analytics.com
1 p.typekit.net account.34sp.com
13 5

This site contains links to these domains. Also see Links.

Domain
www.34sp.com
Subject Issuer Validity Valid
*.34sp.com
R3
2022-08-11 -
2022-11-09
3 months crt.sh
34sp.net
R3
2022-08-09 -
2022-11-07
3 months crt.sh
use.typekit.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-09-14 -
2023-10-15
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-09-12 -
2022-12-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://account.34sp.com/login
Frame ID: D83FB2AEB34313DAA80E6369650EB7B5
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Login | 34SP.com Control Panel

Page URL History Show full URLs

  1. http://account.34sp.com/ HTTP 301
    https://account.34sp.com/ HTTP 302
    https://account.34sp.com/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

479 kB
Transfer

1116 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://account.34sp.com/ HTTP 301
    https://account.34sp.com/ HTTP 302
    https://account.34sp.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
account.34sp.com/
Redirect Chain
  • http://account.34sp.com/
  • https://account.34sp.com/
  • https://account.34sp.com/login
12 KB
5 KB
Document
General
Full URL
https://account.34sp.com/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1ee0:2:4::3433 , United Kingdom, ASN41357 (UK-34SP-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
021e44826987335475a3f1f98b4caef7aa48c1bb09c2f59d5133f8c7d748a2e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 03 Oct 2022 08:10:44 GMT
Server
nginx
Strict-Transport-Security
max-age=31536000;
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Clacks-Overhead
GNU Terry Pratchett
X-Frame-Options
SAMEORIGIN
login
login

Redirect headers

Content-Length
174
Content-Type
text/html; charset=UTF-8
Date
Mon, 03 Oct 2022 08:10:44 GMT
Location
https://account.34sp.com/login
Server
nginx
Strict-Transport-Security
max-age=31536000;
X-Clacks-Overhead
GNU Terry Pratchett
X-Frame-Options
SAMEORIGIN
account.34sp.com.min.2554.css
34sp.net/css/
231 KB
38 KB
Stylesheet
General
Full URL
https://34sp.net/css/account.34sp.com.min.2554.css
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1ee0:2:4::3434 , United Kingdom, ASN41357 (UK-34SP-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
06bb66252c1238c6f29d6bfd0bd9166302ad3fec29483666fe3ae577728003ae

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://account.34sp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Mon, 03 Oct 2022 08:10:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Sep 2022 14:10:50 GMT
Server
nginx
ETag
W/"6310bd6a-39c90"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
access-control-allow-origin
*
Cache-Control
max-age=315360000
Expires
Thu, 31 Dec 2037 23:55:55 GMT
qpz3dyx.js
use.typekit.net/
17 KB
7 KB
Script
General
Full URL
https://use.typekit.net/qpz3dyx.js
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
a06bd6eae1b01b224da07336d128fc6133b35e6fc84b21e6fb3d180f90bcc5af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://account.34sp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Mon, 03 Oct 2022 08:10:45 GMT
server
nginx
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
6713
34sp-colour.svg
34sp.net/img/
3 KB
2 KB
Image
General
Full URL
https://34sp.net/img/34sp-colour.svg
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1ee0:2:4::3434 , United Kingdom, ASN41357 (UK-34SP-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
4a98f55d02e33ae0459b2a79b22437bfbbb521a7ee5476fc7734b312d61d0853
Security Headers
Name Value
Strict-Transport-Security : max-age=31536000;

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://account.34sp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Mon, 03 Oct 2022 08:10:45 GMT
Strict-Transport-Security
: max-age=31536000;
X-Clacks-Overhead
GNU Terry Pratchett
Last-Modified
Thu, 01 Sep 2022 14:06:55 GMT
Server
nginx
Content-Encoding
gzip
ETag
W/"6310bc7f-c86"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=315360000, public
Expires
Thu, 31 Dec 2037 23:55:55 GMT
account.34sp.com.min.2554.js
34sp.net/js/
577 KB
179 KB
Script
General
Full URL
https://34sp.net/js/account.34sp.com.min.2554.js
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1ee0:2:4::3434 , United Kingdom, ASN41357 (UK-34SP-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
bd73081c46516f41f5d21cf6ead0f4dfcf11e1c01a11db0c25e2d95e5c8ac429

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://account.34sp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Mon, 03 Oct 2022 08:10:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 01 Sep 2022 14:06:13 GMT
Server
nginx
ETag
W/"6310bc55-904cc"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
access-control-allow-origin
*
Cache-Control
max-age=315360000
Expires
Thu, 31 Dec 2037 23:55:55 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://account.34sp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 03 Oct 2022 07:01:59 GMT
last-modified
Sun, 11 Sep 2022 13:50:09 GMT
server
Golfe2
age
4126
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19826
expires
Mon, 03 Oct 2022 09:01:59 GMT
l
use.typekit.net/af/c4c302/000000000000000000012192/27/
33 KB
34 KB
Font
General
Full URL
https://use.typekit.net/af/c4c302/000000000000000000012192/27/l?subset_id=2&fvd=n6&v=3
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
442a2fe4026ccf4056cfee8320624aa4dceb59dfdfb3d08998208914041b8e25

Request headers

Referer
https://account.34sp.com/
Origin
https://account.34sp.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 08:10:45 GMT
server
nginx
etag
"9d5008d041639c6d4922c710a6aaeb2b11526a89"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
34048
l
use.typekit.net/af/9b05f3/000000000000000000013365/27/
46 KB
46 KB
Font
General
Full URL
https://use.typekit.net/af/9b05f3/000000000000000000013365/27/l?subset_id=2&fvd=n4&v=3
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
2d36e12bfbde85feb98c8b66f8a4a40f9a5db6918f49234a2ddece526d933237

Request headers

Referer
https://account.34sp.com/
Origin
https://account.34sp.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 08:10:45 GMT
server
nginx
etag
"0ffa5e8c8eb076cc21ede9987250dfa4f2af4438"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
46668
fontawesome-webfont.woff2
34sp.net/fonts/fontawesome/
75 KB
76 KB
Font
General
Full URL
https://34sp.net/fonts/fontawesome/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: 34sp.net
URL: https://34sp.net/css/account.34sp.com.min.2554.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1ee0:2:4::3434 , United Kingdom, ASN41357 (UK-34SP-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://34sp.net/css/account.34sp.com.min.2554.css
Origin
https://account.34sp.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Mon, 03 Oct 2022 08:10:45 GMT
Last-Modified
Thu, 01 Sep 2022 13:58:34 GMT
Server
nginx
ETag
"6310ba8a-12d68"
Content-Type
application/octet-stream
access-control-allow-origin
*
Cache-Control
max-age=315360000
Accept-Ranges
bytes
Content-Length
77160
Expires
Thu, 31 Dec 2037 23:55:55 GMT
l
use.typekit.net/af/ae4f6c/000000000000000000010096/27/
73 KB
73 KB
Font
General
Full URL
https://use.typekit.net/af/ae4f6c/000000000000000000010096/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1b8317ae6294595053dacaccc8d7d05bda2bc6b82be88e074edc8583a6f3b9c5

Request headers

Referer
https://account.34sp.com/
Origin
https://account.34sp.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 08:10:45 GMT
server
nginx
etag
"a6094d3b0b9610bca7d041a6bb6011aa335d9368"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
74572
poll
account.34sp.com/
2 B
247 B
XHR
General
Full URL
https://account.34sp.com/poll
Requested by
Host: 34sp.net
URL: https://34sp.net/js/account.34sp.com.min.2554.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1ee0:2:4::3433 , United Kingdom, ASN41357 (UK-34SP-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://account.34sp.com/login
X-Requested-With
XMLHttpRequest
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Mon, 03 Oct 2022 08:10:45 GMT
Strict-Transport-Security
max-age=31536000;
X-Clacks-Overhead
GNU Terry Pratchett
Server
nginx
Content-Length
2
X-Frame-Options
SAMEORIGIN
Content-Type
text/html; charset=UTF-8
collect
www.google-analytics.com/j/
2 B
207 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j97&a=516097849&t=pageview&_s=1&dl=https%3A%2F%2Faccount.34sp.com%2Flogin&ul=en-us&de=UTF-8&dt=Login%20%7C%2034SP.com%20Control%20Panel&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=801921190&gjid=1497212880&cid=1684067028.1664784645&tid=UA-196724-10&_gid=1724076458.1664784645&_r=1&_slc=1&z=1002756901
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://account.34sp.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 03 Oct 2022 08:10:45 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://account.34sp.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
p.gif
p.typekit.net/
35 B
228 B
Image
General
Full URL
https://p.typekit.net/p.gif?s=1&k=qpz3dyx&ht=tk&h=account.34sp.com&f=10884.10886.15586&a=23081030&js=1.21.0&app=typekit&e=js&_=1664784645571
Requested by
Host: account.34sp.com
URL: https://account.34sp.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://account.34sp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

unused62
8096267
date
Mon, 03 Oct 2022 08:10:45 GMT
last-modified
Sat, 09 Oct 2021 02:10:03 GMT
server
nginx
etag
"6160f9fb-23"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
35

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| Typekit string| GoogleAnalyticsObject function| ga function| $ function| jQuery function| Waypoint object| Mustache object| d3 object| Rickshaw object| jQuery111005300720531228174 number| install_interval number| install_width object| install_timer function| install_status function| install_bar function| update_restore_status boolean| validation_timeout object| google_tag_data object| gaplugins object| gaGlobal object| gaData

4 Cookies

Domain/Path Name / Value
.34sp.com/ Name: 34sp
Value: 91ca06c4-54ef-41f9-d1fc-537c478c7c4e
.34sp.com/ Name: _ga
Value: GA1.2.1684067028.1664784645
.34sp.com/ Name: _gid
Value: GA1.2.1724076458.1664784645
.34sp.com/ Name: _gat
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;
X-Frame-Options SAMEORIGIN