Submitted URL: https://09-r360.secure.force.com/
Effective URL: https://09-r360.secure.force.com/Start
Submission: On April 04 via manual from DE — Scanned from GB

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 160.8.249.23, located in London, United Kingdom and belongs to SALESFORCE, US. The main domain is 09-r360.secure.force.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on April 21st 2021. Valid for: a year.
This is the only time 09-r360.secure.force.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 10 160.8.249.23 14340 (SALESFORCE)
8 1
Apex Domain
Subdomains
Transfer
10 force.com
09-r360.secure.force.com
132 KB
8 1
Domain Requested by
10 09-r360.secure.force.com 2 redirects 09-r360.secure.force.com
8 1

This site contains links to these domains. Also see Links.

Domain
everstream.ai
Subject Issuer Validity Valid
*.eu43.force.com
DigiCert TLS RSA SHA256 2020 CA1
2021-04-21 -
2022-04-20
a year crt.sh

This page contains 1 frames:

Primary Page: https://09-r360.secure.force.com/Start
Frame ID: 35CD594B3445E3240499B67993308453
Requests: 8 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://09-r360.secure.force.com/ HTTP 301
    https://09-r360.secure.force.com/home HTTP 301
    https://09-r360.secure.force.com/Start Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+foundation[^>"]+css

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

131 kB
Transfer

372 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://09-r360.secure.force.com/ HTTP 301
    https://09-r360.secure.force.com/home HTTP 301
    https://09-r360.secure.force.com/Start Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Start
09-r360.secure.force.com/
Redirect Chain
  • https://09-r360.secure.force.com/
  • https://09-r360.secure.force.com/home
  • https://09-r360.secure.force.com/Start
12 KB
13 KB
Document
General
Full URL
https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/ Salesforce.com ApexPages
Resource Hash
46a41d0f1a378e201f42a4a183cb9f2ceee3fa4ddb4565ca96d88d25833221a7
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests frame-ancestors 'self' *.salesforce.com
Strict-Transport-Security max-age=63072004; includeSubDomains
X-Frame-Options ALLOW-FROM 'self'
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control
no-cache,must-revalidate,max-age=0,no-store,private
Content-Security-Policy
upgrade-insecure-requests frame-ancestors 'self' *.salesforce.com
Content-Type
text/html;charset=UTF-8
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Mon, 04 Apr 2022 07:04:52 GMT
P3P
CP="CUR OTR STA"
Strict-Transport-Security
max-age=63072004; includeSubDomains
Transfer-Encoding
chunked
X-FRAME-OPTIONS
ALLOW-FROM 'self'
X-Powered-By
Salesforce.com ApexPages
X-XSS-Protection
0
origin-trial
AklbvN3zzNjVBN1btIvZVEXQottJ9SBp7rLB02aNYemdUf5Qr9j+oRJsDOjqvHP7tqihWlADjfay3d+A5Ky3xAUAAACFeyJvcmlnaW4iOiJodHRwczovL2ZvcmNlLmNvbTo0NDMiLCJmZWF0dXJlIjoiRGlzYWJsZURpZmZlcmVudE9yaWdpblN1YmZyYW1lRGlhbG9nU3VwcHJlc3Npb24iLCJleHBpcnkiOjE2Mzk1MjYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==

Redirect headers

Cache-Control
no-cache,must-revalidate,max-age=0,no-store,private
Content-Security-Policy
upgrade-insecure-requests
Date
Mon, 04 Apr 2022 07:04:52 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://09-r360.secure.force.com/Start
Strict-Transport-Security
max-age=63072004; includeSubDomains
Transfer-Encoding
chunked
stub.js
09-r360.secure.force.com/static/111213/js/perf/
1 KB
1004 B
Script
General
Full URL
https://09-r360.secure.force.com/static/111213/js/perf/stub.js
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
5830f6b53e1ea91abd5de97ef219269702f413575cfe0dd6149712d68d7d61eb
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 06:56:01 GMT
Content-Encoding
gzip
Last-Modified
Thu, 18 Dec 2014 19:28:42 GMT
Age
531
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=10368000
Strict-Transport-Security
max-age=63072004; includeSubDomains
Accept-Ranges
bytes
Content-Length
618
Expires
Tue, 02 Aug 2022 06:56:01 GMT
VFRemote.js
09-r360.secure.force.com/jslibrary/1637251310236/sfdc/
61 KB
21 KB
Script
General
Full URL
https://09-r360.secure.force.com/jslibrary/1637251310236/sfdc/VFRemote.js
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
fd822987d71272a0d31083d19fccc1613e0a297fcaaa01cc9e3bf21b2c8244f6
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 06:56:01 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Apr 2022 21:28:52 GMT
Age
531
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=10368000
Strict-Transport-Security
max-age=63072004; includeSubDomains
Accept-Ranges
bytes
Content-Length
20668
Expires
Tue, 02 Aug 2022 06:56:01 GMT
SfdcCore.js
09-r360.secure.force.com/jslibrary/1633356814236/ui-sfdc-javascript-impl/
183 KB
62 KB
Script
General
Full URL
https://09-r360.secure.force.com/jslibrary/1633356814236/ui-sfdc-javascript-impl/SfdcCore.js
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
0f4154971ce630b3071b6e2e28126d5a5624ade14aa695a7f6a4dc36eaa39078
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 06:24:25 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Apr 2022 21:28:54 GMT
Age
2427
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=10368000
Strict-Transport-Security
max-age=63072004; includeSubDomains
Accept-Ranges
bytes
Content-Length
63316
Expires
Tue, 02 Aug 2022 06:24:25 GMT
picklist4.js
09-r360.secure.force.com/static/111213/js/
10 KB
4 KB
Script
General
Full URL
https://09-r360.secure.force.com/static/111213/js/picklist4.js
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
7da058a4e1bd6368be16eb513d108c61e9016968c859b28bc24ac2629e401773
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 06:24:25 GMT
Content-Encoding
gzip
Last-Modified
Fri, 28 Sep 2018 01:08:08 GMT
Age
2427
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=10368000
Strict-Transport-Security
max-age=63072004; includeSubDomains
Accept-Ranges
bytes
Content-Length
3221
Expires
Tue, 02 Aug 2022 06:24:25 GMT
VFState.js
09-r360.secure.force.com/jslibrary/1635874030236/sfdc/
6 KB
2 KB
Script
General
Full URL
https://09-r360.secure.force.com/jslibrary/1635874030236/sfdc/VFState.js
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
9ed858d6c2cf2798f74f21dcbcd5f8528df9ae12ec15e7d5f246a3b3b592e8d7
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 07:04:52 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Apr 2022 21:28:52 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
public,max-age=10368000
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072004; includeSubDomains
Accept-Ranges
bytes
Expires
Tue, 02 Aug 2022 07:04:52 GMT
app.css
09-r360.secure.force.com/resource/1591772581000/r360_foundation_6/css/
84 KB
14 KB
Stylesheet
General
Full URL
https://09-r360.secure.force.com/resource/1591772581000/r360_foundation_6/css/app.css
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
414762b623f9e478ba2ef6d7b05b3c81fcfd7d3eeaea05a009ad62128ae9215c
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 06:53:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 Jun 2020 07:03:01 GMT
Age
682
X-FRAME-OPTIONS
SAMEORIGIN
Vary
Accept-Encoding
P3P
CP="CUR OTR STA"
Cache-Control
public,max-age=3888000,immutable
Strict-Transport-Security
max-age=63072004; includeSubDomains
Content-Type
text/css
Content-Length
13496
X-XSS-Protection
0
Expires
Thu, 19 May 2022 06:53:30 GMT
Everstream_Logo.png
09-r360.secure.force.com/resource/1634057763000/SCRM/src/img/
14 KB
15 KB
Image
General
Full URL
https://09-r360.secure.force.com/resource/1634057763000/SCRM/src/img/Everstream_Logo.png
Requested by
Host: 09-r360.secure.force.com
URL: https://09-r360.secure.force.com/Start
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.8.249.23 London, United Kingdom, ASN14340 (SALESFORCE, US),
Reverse DNS
dcl10-ncg0-fra3.eu43-fra.force.com
Software
/
Resource Hash
4494e80b4d3db31a6cc7ed8a080e2afac1cab2662d08917c8d45bcf00cc1aace
Security Headers
Name Value
Strict-Transport-Security max-age=63072004; includeSubDomains
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
en-GB,en;q=0.9
Referer
https://09-r360.secure.force.com/Start
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 06:53:30 GMT
Last-Modified
Tue, 12 Oct 2021 16:56:03 GMT
Age
682
X-FRAME-OPTIONS
SAMEORIGIN
P3P
CP="CUR OTR STA"
Cache-Control
public,max-age=3888000,immutable
Strict-Transport-Security
max-age=63072004; includeSubDomains
Content-Type
image/png
Content-Length
14827
X-XSS-Protection
0
Expires
Thu, 19 May 2022 06:53:30 GMT

Verdicts & Comments Add Verdict or Comment

255 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| PerfConstants object| PerfLogLevel object| Perf object| VFExt3 object| Visualforce object| $VFRM function| ApiUtils function| PreferenceBits function| DateUtil object| AbstractAutoCompleteServlet object| AccountAssociationSuggestionsServlet object| Activity object| ActivityPage object| ActivityReminderConstants object| ActivityReminderPage object| ActivityReminderRefreshPage object| ActivityUi object| AddRulesToTerritory2MultiSelectList object| AdvancedCurrencyEnable object| AjaxGetFieldTreeChildren object| AjaxGetUser object| AjaxGetUsersInGroups object| AjaxInNumericRange object| AjaxLoadFieldsForControllingEntity object| AjaxLoadFieldsForEntity object| AjaxLoadPLAForPageServlet object| AjaxLoadPLAForRecordTypeServlet object| AjaxLoadPLAServlet object| AjaxLoadRelatedListItem object| AjaxScanFieldsForShrinkage object| AjaxServlet object| AjaxValidateFormula object| AjaxValidateSpanningFormulasInRelatedList object| Aotp object| AssociationSelectElement object| BaseAssociationConstants object| BaseIntermediateRedirectServlet object| BlowoutServlet object| BodyLayout object| BounceEmailConstants object| BrandingColor object| BusinessHoursPageConstants object| BusyTimesAjaxServlet object| CSRFConstants object| CampaignManageMembers object| CaptchaVerifierServlet object| CaseUi object| ChangePasswordConstants object| ChangeUsernameConstants object| ChartConstants object| ChatterDeflection object| ChatterEmailSettingsConstants object| ChatterFilesConstants object| ChatterService object| ColorInputConstants object| ColorPickerConstants object| ColumnTypeConstants object| CompactLayoutAssignmentConstants object| CompactLayoutUiConst object| ConsoleSidebarSetupEditor object| ContextPaneEditor object| CreateNewElement object| CreateNewList object| CriteriaInputConstants object| CrtConstants object| CrtLayoutElement object| CrtLookupConstants object| CrtObjectElement object| CustomFieldDefinitionUiModel object| CustomMotifDefinitionPageConst object| CustomObjectTeamMemberUiConstants object| CustomObjectTeamTemplateUiConstants object| CustomSchemaObjectDefinitionUiModel object| DashboardConstants object| DataDotComCleanConstants object| DatePickerIds object| Desktop object| DesktopSidebarComponents object| DetailElement object| DeveloperSettings object| DurationInputElement object| DynamicContent object| EditElement object| EditEventMultiUserCalendarElementConstants object| EditPageConstants object| EmailAddrEditConstants object| EmailAttachmentManagementConstants object| EmailAuthorConstants object| EmailCCBccLookupConstants object| EmailChangeVerification object| EmailRelayConstants object| EmailSyncConfigConstants undefined| EmailTaskDescriptionServlet object| TaskDescriptionServlet object| EmailTemplatePreviewConstants object| EntitySharingConstants object| EventDescriptionServlet object| EventObject object| EventPage object| EventUi object| FieldTreeConstants object| FilterEditConstants object| FilterEditPageConstants object| FilterSelectionElement object| FindSimilarOppsFilter object| ForecastRoleUser object| ForecastSettings object| ForecastSharingPrefPopup object| ForecastSummaryPage object| ForecastingDateRangeServlet object| ForecastingDisplayedTypeServlet object| ForecastingJumpToUserServlet object| ForecastingPage object| ForecastingTabPage object| ForecastingTree object| ForecastingViewingIsoServlet object| GenerateRelationshipDefaults object| GoogleDocCreator object| GoogleTalkConstants object| HTPortal object| HelpBubbleConstants object| HighlightsPanelConstants object| HolidayUi object| HomeCalendarAjaxServlet object| HoverTooltipElement object| IFrameElement object| Ideas object| InlineEditConstants object| InlineHelp object| InlineScontrolElement object| InviterLookup object| InviterLookupMatch object| JSPDispatcher object| JigsawImport object| JigsawSearch object| Kb2Id object| KnowledgeSettingsUI object| ListView object| LiveAgentAddToTranscriptSearch object| LiveAgentAutoQuery object| LiveAgentConsoleAjaxServlet object| LiveAgentConstants object| LiveAgentFindOrCreate object| LiveChatButtonConstants object| LookupInputElement object| LookupUi object| LookupValidationServlet object| LookupsUi object| MCFilterPaneParams object| MCXHRParams object| MRUAutoCompleteServlet object| MWPicker object| MacroPage object| MailmergeTemplateSelectElementConst object| ManageableInfo object| MapServletParams object| MenuButtonElement object| MobilePushServiceTest object| MotifInputElementConst object| MouseOverElement object| MultiLookupInputElement object| MultiSelectList object| MultiUserCalendar object| MyCustomObjectConstants object| NewLayoutEditor object| NonUddKeyConstants object| OrganizerPage object| PersonalSetup object| PersonalSetupConstants object| PortalStyleConfigEditorConstants object| ProfileEditConstants object| ProfileListInlineEditConstants object| QuickTextAutoCompleteServlet object| RelatedListPrioritizationServlet object| RelatedListServlet object| RelatedListSuppressionServlet object| ReportChartMetadataServlet object| ReportConstants object| ReportsFch object| RequestInfo object| RoleTreeCookieConstants object| RtaImageServlet object| RuleFilterPageConstants object| ScheduleElement object| SchedulePage object| SchedulingUtils object| SchemaBuilder object| SchemaBuilderConfig object| SearchClickLogging object| SearchRelatedList object| SearchSettingsConstants object| SeascLogRecordHandler object| SectionElement object| ServiceDeskHotkeyEditor object| ServiceDeskPage object| SessionTimeServlet object| SetupSearchElement object| SetupTreeNodeConstants object| SideTabPreferenceServlet object| SidebarConstants object| SidetabConstants object| SlaProcessUi object| SoftphoneConstants object| SoftphoneLayoutEditorConstants object| SoftphoneMatchTypeEnum object| SoftphoneScreenPopTypeEnum object| StageManager object| SuggestedTimeProvider object| SummaryFieldConstants object| SummaryLayoutEditor object| SynonymConstants object| TabOrganizerConstants object| TabSetPageConstants object| TagConstants object| TagMode object| TaskMassAction object| TaskOwnerLookup object| TaskUi object| Territory2RuleLookup object| TimePickerInputElementConstants object| Udd object| UiData object| UnifiedSearchComponents object| UnifiedSearchUI object| UserDeactivate object| UserInterfaceUI object| ViralInviteSignupConstants object| VisualforceConstants object| WhoWhatQueue object| findSimilarQueryPage object| vaSelectElementConst object| UserContext object| TWEEN function| SfdcFramework function| LC object| Mustache function| Sizzle object| Sfdc number| data-uidSfdc function| picklist function| picklistForInlineEditing function| multiPicklist function| Bitset object| SfdcApp object| UITheme object| LoginCtr function| inIframe string| username function| continueLoginCheck function| closeDialog object| passwordFieldList

4 Cookies

Domain/Path Name / Value
09-r360.secure.force.com/ Name: CookieConsentPolicy
Value: 0:1
09-r360.secure.force.com/ Name: LSKey-c$CookieConsentPolicy
Value: 0:1
.force.com/ Name: BrowserId
Value: hlezprPlEeygdNlps4YIRw
.force.com/ Name: BrowserId_sec
Value: hlezprPlEeygdNlps4YIRw

1 Console Messages

Source Level URL
Text
network error URL: https://09-r360.secure.force.com/Start
Message:
Failed to load resource: the server responded with a status of 401 (Unauthorized)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests frame-ancestors 'self' *.salesforce.com
Strict-Transport-Security max-age=63072004; includeSubDomains
X-Frame-Options ALLOW-FROM 'self'
X-Xss-Protection 0