networks-api-director-uat-updates.wonderschool.io Open in urlscan Pro
2606:4700:20::ac43:4bcf  Public Scan

URL: https://networks-api-director-uat-updates.wonderschool.io/
Submission: On June 03 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:20::ac43:4bcf, located in United States and belongs to CLOUDFLARENET, US. The main domain is networks-api-director-uat-updates.wonderschool.io.
TLS certificate: Issued by E1 on May 31st 2024. Valid for: 3 months.
This is the only time networks-api-director-uat-updates.wonderschool.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:20:... 13335 (CLOUDFLAR...)
3 104.17.24.14 13335 (CLOUDFLAR...)
1 44.221.144.125 14618 (AMAZON-AES)
8 4
Apex Domain
Subdomains
Transfer
4 wonderschool.io
networks-api-director-uat-updates.wonderschool.io
3 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 341
369 KB
1 swagger.io
validator.swagger.io — Cisco Umbrella Rank: 272012
2 KB
8 3
Domain Requested by
4 networks-api-director-uat-updates.wonderschool.io cdnjs.cloudflare.com
3 cdnjs.cloudflare.com networks-api-director-uat-updates.wonderschool.io
1 validator.swagger.io
8 3

This site contains links to these domains. Also see Links.

Domain
validator.swagger.io
Subject Issuer Validity Valid
wonderschool.io
E1
2024-05-31 -
2024-08-29
3 months crt.sh
cdnjs.cloudflare.com
E1
2024-06-02 -
2024-08-31
3 months crt.sh
*.swagger.io
Amazon RSA 2048 M02
2023-12-27 -
2025-01-25
a year crt.sh

This page contains 1 frames:

Primary Page: https://networks-api-director-uat-updates.wonderschool.io/
Frame ID: 6F8F9F7DA9F3FF470498A902C99DA811
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Swagger UI

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

374 kB
Transfer

1501 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
networks-api-director-uat-updates.wonderschool.io/
2 KB
1 KB
Document
General
Full URL
https://networks-api-director-uat-updates.wonderschool.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470df7471f9591be79297cf79f0eec3f5d0d51f01715b6828954319b26773edb
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
max-age=0, private, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
88e1798dded1bb79-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 03 Jun 2024 17:41:35 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tl%2BPPxbVhjRJKFFqsHcQiKhasE7rB1vb49h1kyEp6H1crDRPwl74M%2Bw79yFf%2FqM%2Bp5AGP0MT0qJGPl6a7KVWQPrIDjHbQKHpvDVCb3GZDix58OKsKHkjv8Pc2EcrDTu%2Bl85qTXrjkksjVZCw74Lh49wUg3kWt2CmBKQTqjL1eef7WcOVqt0oywAPD5uluHE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15724800; includeSubDomains
vary
accept-encoding
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
a073fa8dcac222209840f754cda3d049
swagger-ui.css
cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/
141 KB
16 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/swagger-ui.css
Requested by
Host: networks-api-director-uat-updates.wonderschool.io
URL: https://networks-api-director-uat-updates.wonderschool.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dd64d44405c2d046d45b14174ab1df67cee8dbecc6a550c8000648b2839ecc00
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://networks-api-director-uat-updates.wonderschool.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
990321
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
15982
last-modified
Wed, 17 Aug 2022 20:31:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"62fd5004-3e6e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kifMOujAjL859BWIidZTDA%2F5FKddesGWn2M4iIQSXBoU6GV5jgIIAslR84R8KYAZRbd08YSWQAp68s0Uqes27yeoU7cHr9gaX41R6gENA%2FtWrBxrC7FTftVA6me0qjyu8WdZCaTI"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88e179906e429b8f-FRA
expires
Sat, 24 May 2025 17:41:35 GMT
swagger-ui-bundle.js
cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/
1 MB
269 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/swagger-ui-bundle.js
Requested by
Host: networks-api-director-uat-updates.wonderschool.io
URL: https://networks-api-director-uat-updates.wonderschool.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70d1865eb5f791f0414ee48be13f5d9b5214b1ceac17ca8f329161dc89006a09
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://networks-api-director-uat-updates.wonderschool.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
292484
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
274711
last-modified
Wed, 17 Aug 2022 20:31:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"62fd5004-43117"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ug7r%2FIG%2BuuWYPRtXUII0LjeKfxp9OmEPKYBR1eedJV3i4DbyX7ka3grPGkDTKmcs0M6S8cDg316m3kcrqPSK54nBwXZ8J1Vt50V5SdRLPxdhvgZyiz3Tct%2BEMdBkOkBmTIrkynl2"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88e179906e3c9b8f-FRA
expires
Sat, 24 May 2025 17:41:35 GMT
swagger-ui-standalone-preset.js
cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/
305 KB
84 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/swagger-ui-standalone-preset.js
Requested by
Host: networks-api-director-uat-updates.wonderschool.io
URL: https://networks-api-director-uat-updates.wonderschool.io/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a15394338837c2819ffd2a7292db0decc53a73ec224d7f2b9f2205af4b63ef9e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://networks-api-director-uat-updates.wonderschool.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
292484
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
85325
last-modified
Wed, 17 Aug 2022 20:31:00 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"62fd5004-14d4d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HAbJnfA0CeIljyllHodtYFgC%2B43lBW97D%2BC9MK4CkJ1Do9RRks9BFs1yTQwwib4RgSw9kSL55fomM%2BDJruIr9m3M6maEK5bn%2BSOR1nexChQTEQQhnvjt%2FPJBQ3eFz%2BqyPbM7RrF9"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88e179906e469b8f-FRA
expires
Sat, 24 May 2025 17:41:35 GMT
spec
networks-api-director-uat-updates.wonderschool.io/
2 KB
1 KB
Fetch
General
Full URL
https://networks-api-director-uat-updates.wonderschool.io/spec
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.14.0/swagger-ui-bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c869423ff0751c2816489ea170331fd42e22135e67842fff61f9ce29d138cc3
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
x-csrf-token
GSdgXEwDRUxOKmAYNydTfDQEPBIyKHtzhl6o4lp4vx7Ldf8NWqWtujN6
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept
application/json,*/*
Referer
https://networks-api-director-uat-updates.wonderschool.io/
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:35 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9RqbZ%2Fc%2Bpvx9xxF%2FneFLS0OfmkbusIW7DBXSZi6pT5Ab4c3U7zqmVrt8EgWuGZbyn4AGgPQy6cWbv8CmuLSKZaCH9lrY17hc4MBSfyiKS5N%2FGswqxtTMrTMZ4Pd8MxQJc5bbZGMn0NFqr5L%2FrOKtYVIGDx3nCWmf8YWMSYzDqbdtAAaacKNDA8HZzD4RJbs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
cache-control
max-age=0, private, must-revalidate
cf-ray
88e17992ee88bb79-FRA
content-length
699
x-request-id
0c9056ea6b8e7eb2f8aca20fa5234c60
truncated
/
15 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
692881516b5727543e5d0e2afe602c1659d1b50d7af857219c33d12913167520

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
validator
validator.swagger.io/
2 KB
2 KB
Image
General
Full URL
https://validator.swagger.io/validator?url=https%3A%2F%2Fnetworks-api-director-uat-updates.wonderschool.io%2Fspec
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.221.144.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-221-144-125.compute-1.amazonaws.com
Software
Jetty(9.4.53.v20231009) /
Resource Hash
503516f9cccdbfa57c8ca528d4397cd78ad1a154f4c2a9c2e3ddf944885cfddc

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://networks-api-director-uat-updates.wonderschool.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:36 GMT
server
Jetty(9.4.53.v20231009)
access-control-allow-methods
GET, POST, DELETE, PUT
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Disposition
access-control-allow-headers
Content-Type, api_key, Authorization
content-length
1635
favicon-32x32.png
networks-api-director-uat-updates.wonderschool.io/
33 B
433 B
Other
General
Full URL
https://networks-api-director-uat-updates.wonderschool.io/favicon-32x32.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5af74e69563a4b9bf6f5a573839115bdae155f60b2f5efcc740d57a3d0446ae7
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://networks-api-director-uat-updates.wonderschool.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:36 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vRo9oJBaeibdxetIVYbqCfN3YvBPFwB0qB7utm%2FY9%2FyUjfU5zIegmlPGXXdMzD8fju7xacW3siFaMmGhkNQbjGmHN1X18XKUDOG0jWCHltvwoox3TwLP2rjfSe1MWm6gNNDPUIQcL%2FLAKQemZ1xmx52eqrZliCn83T%2BPgzLZLlfdAj%2BdG8BDejBakqvQUNg%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
cache-control
max-age=0, private, must-revalidate
cf-ray
88e179930eb5bb79-FRA
content-length
53
x-request-id
4d62003317d2631b96902052a0e48f36
truncated
/
239 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fb5873d70e03e1dfb1e4a734cea4ada473e8520b7fec49c7e9d387cc25ac43a6

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
127 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
88184aef40a6a66fdd5841732efb6bd1ec40d2cf5cc35dd2abe5ab80070d02b4

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
favicon-16x16.png
networks-api-director-uat-updates.wonderschool.io/
33 B
403 B
Other
General
Full URL
https://networks-api-director-uat-updates.wonderschool.io/favicon-16x16.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5af74e69563a4b9bf6f5a573839115bdae155f60b2f5efcc740d57a3d0446ae7
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://networks-api-director-uat-updates.wonderschool.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 17:41:36 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yry%2FR2I40FoHB6zNKxNsHLDYmH6U8sDpHW64feghJ%2FrNcBWniDsfHcTzHClG81d%2FR9CMJoumwgb3PGeglzd92zmqlCFOSaXujWembW9%2FZ437KD%2BOwdiQdFSMNTS7cevqDrydhjSZhy8MPEsX27%2FjmJs9d8Ikh5RX%2BunKmkWaqEN9MyiwEt%2BQ45lLru3WQpw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
cache-control
max-age=0, private, must-revalidate
cf-ray
88e179955a36bb79-FRA
content-length
53
x-request-id
30d55699af71affa64145de075095ac0

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| regeneratorRuntime function| SwaggerUIBundle object| SwaggerUIStandalonePreset object| versions string| server_base object| ui

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://networks-api-director-uat-updates.wonderschool.io/favicon-32x32.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://networks-api-director-uat-updates.wonderschool.io/favicon-16x16.png
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN