URL: https://shiny.alpha.phac-aspc.gc.ca/
Submission: On May 15 via api from US — Scanned from CA

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 34.152.5.139, located in Montreal, Canada and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is shiny.alpha.phac-aspc.gc.ca.
TLS certificate: Issued by R3 on May 15th 2024. Valid for: 3 months.
This is the only time shiny.alpha.phac-aspc.gc.ca was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 34.152.5.139 396982 (GOOGLE-CL...)
11 2
Apex Domain
Subdomains
Transfer
11 phac-aspc.gc.ca
shiny.alpha.phac-aspc.gc.ca
642 KB
11 1
Domain Requested by
11 shiny.alpha.phac-aspc.gc.ca shiny.alpha.phac-aspc.gc.ca
11 1

This site contains links to these domains. Also see Links.

Domain
github.com
Subject Issuer Validity Valid
shiny.alpha.phac-aspc.gc.ca
R3
2024-05-15 -
2024-08-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://shiny.alpha.phac-aspc.gc.ca/
Frame ID: F84FCF4DE47849D77661DA08D892A14E
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

PHAC Shiny app directory

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

642 kB
Transfer

638 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
shiny.alpha.phac-aspc.gc.ca/
7 KB
7 KB
Document
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
b783cd40a923a69a85b92132dc984f7093db982d5ffccb979155bed86295614f
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-length
7043
content-type
text/html; charset=utf-8
cross-origin-opener-policy
same-origin
date
Wed, 15 May 2024 23:28:14 GMT
referrer-policy
same-origin
strict-transport-security
max-age=15724800; includeSubDomains
vary
Cookie
x-content-type-options
nosniff
x-frame-options
DENY
htmx.min.js
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/
48 KB
48 KB
Script
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/htmx.min.js
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
b48c1b5943466c16ce5950ade24d7599ceec1d37e40b7d1a156b2fbffb1a4b67
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-bf7c"
content-type
text/javascript; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
49020
jquery-3.6.1.min.js
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/
88 KB
88 KB
Script
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/jquery-3.6.1.min.js
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
24c7030c50c1045cfefddac2d403f4bb2043b34183f6887f5c88a3e12e0236f9
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-15e42"
content-type
text/javascript; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
89666
idiomorph.min.js
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/
8 KB
8 KB
Script
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/idiomorph.min.js
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
182e352f6d6cc654f547883edfd71f96a4ba620330751db99542d46bd03d4dd8
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-2070"
content-type
text/javascript; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
8304
idiomorph-ext.js
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/
522 B
826 B
Script
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/idiomorph-ext.js
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
c39a57632a0e924d67440d6f9d240e5ef958559006c438b337e032948d8c26c5
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-20a"
content-type
text/javascript; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
522
bootstrap.min.js
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/
78 KB
79 KB
Script
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/bootstrap.min.js
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
c74d73c5f08f5b39a6f98683649136911aaba9ffc98339de925b1bbb7c82ea2c
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-139f8"
content-type
text/javascript; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
80376
bootstrap.min.css
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/
190 KB
191 KB
Stylesheet
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/bootstrap.min.css
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
fd7a2e447108f65b7787970b1b76481ef806674b9ce61f9abd2f086cb7fe7362
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-2f92d"
content-type
text/css; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
194861
bootstrap-icons.min.css
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/
80 KB
80 KB
Stylesheet
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/bootstrap-icons.min.css
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
640e493385af5194a19e282631a8d83190caeb13400015c07f0a9a19369f2b02
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-14014"
content-type
text/css; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
81940
styles.css
shiny.alpha.phac-aspc.gc.ca/static/
5 KB
5 KB
Stylesheet
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/styles.css
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
ed46186151409859ba6095377a6771621da3e97117e3170bc4d9cc2d324d1461
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-1206"
content-type
text/css; charset="utf-8"
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
4614
truncated
/
199 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
77e67409caaf5014eaa2e2d96ac6210a1b4a987da0d5b3ff826221fe255d3def

Request headers

Accept-Language
en-CA,en;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
108 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8f27b2160255b0a3bbe960f0af6a1772a8514e2b3ba0acbeea1e622ebb5f3e4a

Request headers

Accept-Language
en-CA,en;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
bootstrap-icons.woff2
shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/fonts/
118 KB
119 KB
Font
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/fonts/bootstrap-icons.woff2?1fa40e8900654d2863d011707b9fb6f2
Requested by
Host: shiny.alpha.phac-aspc.gc.ca
URL: https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/bootstrap-icons.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
cfe45b981d1b91b173361a34cfce5f60893dbd1ac4af2c3ac11fc17552c5401f
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/static/thirdparty/css/bootstrap-icons.min.css
Origin
https://shiny.alpha.phac-aspc.gc.ca
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-1d9fc"
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
121340
favicon.ico
shiny.alpha.phac-aspc.gc.ca/static/
15 KB
15 KB
Other
General
Full URL
https://shiny.alpha.phac-aspc.gc.ca/static/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.152.5.139 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
139.5.152.34.bc.googleusercontent.com
Software
/
Resource Hash
25da0fe57c36987cc6d3e8f0a0d86427c823bdc8aa4bc74a01768605cb77f543
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shiny.alpha.phac-aspc.gc.ca/
Accept-Language
en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 15 May 2024 23:28:15 GMT
strict-transport-security
max-age=15724800; includeSubDomains
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Wed, 15 May 2024 18:06:01 GMT
cross-origin-opener-policy
same-origin
etag
"6644f989-3c2e"
content-type
image/x-icon
access-control-allow-origin
*
cache-control
max-age=0, public
content-length
15406

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| htmx function| $ function| jQuery object| Idiomorph number| uidEvent object| bootstrap function| adjustCardSpacer

1 Cookies

Domain/Path Name / Value
shiny.alpha.phac-aspc.gc.ca/ Name: csrftoken
Value: NTztLhmDZ7uztHEH66XyetRiYOKWLvcz

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY