URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Submission: On July 07 via manual from JP

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 19 HTTP transactions. The main IP is 203.207.60.102, located in New Zealand and belongs to PAYMENTEXPRESS-NZ Payment Express Limited, NZ. The main domain is sec.paymentexpress.com.
TLS certificate: Issued by Symantec Class 3 Secure Server CA - G4 on October 24th 2014. Valid for: 3 years.
This is the only time sec.paymentexpress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
18 203.207.60.102 131168 (PAYMENTEX...)
19 2
Apex Domain
Subdomains
Transfer
18 paymentexpress.com
sec.paymentexpress.com
384 KB
19 1
Domain Requested by
18 sec.paymentexpress.com sec.paymentexpress.com
19 1

This site contains links to these domains. Also see Links.

Domain
www.paymentexpress.com
Subject Issuer Validity Valid
sec.paymentexpress.com
Symantec Class 3 Secure Server CA - G4
2014-10-24 -
2017-10-23
3 years crt.sh

This page contains 1 frames:

Primary Page: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Frame ID: 664.1
Requests: 20 HTTP requests in this frame

Screenshot


Page Statistics

19
Requests

95 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

384 kB
Transfer

625 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
sec.paymentexpress.com/pxmi3/
53 KB
23 KB
Document
General
Full URL
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
25ecbae38a3d9d69835828ea1b61dc42810111e7f33f6051faa92201e7d66d6a
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Content-Security-Policy
default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-ASPNET-VERSION
X-POWERED-BY
Content-Length
23819
X-XSS-Protection
1; mode=block
Pragma
no-cache
Server
Date
Fri, 07 Jul 2017 03:58:48 GMT
Vary
Accept-Encoding
Content-Type
text/html
Cache-Control
no-cache,no-store
Content-Security-Policy
default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Expires
0
30080_0002
sec.paymentexpress.com/pxmi3/
52 KB
12 KB
Stylesheet
General
Full URL
https://sec.paymentexpress.com/pxmi3/30080_0002
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
78bd1248da46182c3d9d3ee5d9eab2fd683a5e713a22a4dc89f2891821f67d7e
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Content-Security-Policy
default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-ASPNET-VERSION
X-POWERED-BY
Content-Length
12625
X-XSS-Protection
1; mode=block
Pragma
no-cache
Server
Date
Fri, 07 Jul 2017 03:58:49 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
no-cache,no-store
Content-Security-Policy
default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Expires
0
csc-mastercard.png
sec.paymentexpress.com/pxmi/images/
54 KB
54 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxmi/images/csc-mastercard.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
359b13aaa6946f7748dc0ca1a5e7d09c010952c536cd6b413152b5e0ff10b910
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Frame-Options
deny
X-ASPNET-VERSION
X-POWERED-BY
Content-Length
55398
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 09 May 2016 23:39:56 GMT
Server
Date
Fri, 07 Jul 2017 03:58:49 GMT
X-Frame-Options
deny
Content-Type
image/png
ETag
"0ee8f174caad11:0"
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
csc-amex.png
sec.paymentexpress.com/pxmi/images/
56 KB
56 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxmi/images/csc-amex.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
65e64730c6b8ff8cfbe722097a2edea27aa439963a3ca3cc6237503d454e4db6
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Frame-Options
deny
X-ASPNET-VERSION
X-POWERED-BY
Content-Length
57447
X-XSS-Protection
1; mode=block
Last-Modified
Mon, 09 May 2016 23:39:24 GMT
Server
Date
Fri, 07 Jul 2017 03:58:50 GMT
X-Frame-Options
deny
Content-Type
image/png
ETag
"01e7d44caad11:0"
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
jquery-1.12.4.js
sec.paymentexpress.com/js/
114 KB
35 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/jquery-1.12.4.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
0628a355be5c49d1f0ea872d99cb58610d38ae3bf0e59f36667b6aebe20439f4

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:49 GMT
Content-Encoding
gzip
ETag
"808b60d94983d21:0"
Last-Modified
Fri, 10 Feb 2017 03:00:35 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
36078
0305_0001
sec.paymentexpress.com/pxmi3/
55 KB
19 KB
Script
General
Full URL
https://sec.paymentexpress.com/pxmi3/0305_0001
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
1f39a4ac9a8885ddbb8096509345a27195c875a9ad0ba30e9b79b9bd82e94798
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-Content-Security-Policy
default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-ASPNET-VERSION
X-POWERED-BY
Content-Length
19598
X-XSS-Protection
1; mode=block
Pragma
no-cache
Server
Date
Fri, 07 Jul 2017 03:58:50 GMT
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
no-cache,no-store
Content-Security-Policy
default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Expires
0
polyfiller.js
sec.paymentexpress.com/js/js-webshim/
15 KB
6 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/js-webshim/polyfiller.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
630bda004e1e2c7f25ad14d1a80a78621077e9fdfd069ff592da0b3e01ff1972

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Encoding
gzip
ETag
"80ba99d0685ad21:0"
Last-Modified
Tue, 20 Dec 2016 02:28:57 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
6330
ApplePay.js
sec.paymentexpress.com/js/
5 KB
2 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/ApplePay.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
8e5f935a666c8064c1d51c6ef841cf4514a3883f48255cb67dcfbadaaeda4752

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Encoding
gzip
ETag
"803dc4a9082d21:0"
Last-Modified
Thu, 09 Feb 2017 04:52:19 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
1567
truncated
/
11 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
15463844dec6dd471479c516ac7dac69935de1dc31636355910ddb5b92794283

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
creditcard.png
sec.paymentexpress.com/pxpay/images/PaymentSchemeRadioButtonLogos/
27 KB
27 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxpay/images/PaymentSchemeRadioButtonLogos/creditcard.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
1b25e9b77e51cc6c7b91ef62296eb08576602d0bdc9912156d090d3fb49b4c9a
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/30080_0002
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Last-Modified
Tue, 04 Jul 2017 03:05:00 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Content-Type
image/png
X-XSS-Protection
1; mode=block
Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
Content-Length
27224
ETag
"95f0e95272f4d21:0"
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
unionpay.png
sec.paymentexpress.com/pxpay/images/PaymentSchemeRadioButtonLogos/
9 KB
9 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxpay/images/PaymentSchemeRadioButtonLogos/unionpay.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
30a0a9ed618ad2db0725dc34aa66a909e1072371ab97d44074ead28943782e5b
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/30080_0002
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Last-Modified
Sun, 19 Mar 2017 23:47:24 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Content-Type
image/png
X-XSS-Protection
1; mode=block
Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
Content-Length
9370
ETag
"27865228ba1d21:0"
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
UnionPay_brand_logo_small.png
sec.paymentexpress.com/pxpay/images/
9 KB
9 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxpay/images/UnionPay_brand_logo_small.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
30a0a9ed618ad2db0725dc34aa66a909e1072371ab97d44074ead28943782e5b
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/30080_0002
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Last-Modified
Sun, 19 Mar 2017 23:47:23 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Content-Type
image/png
X-XSS-Protection
1; mode=block
Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
Content-Length
9370
ETag
"1aca3f28ba1d21:0"
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
visacolour-card-footer.png
sec.paymentexpress.com/pxpay/images/Logos/PaymentScheme/
57 KB
57 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxpay/images/Logos/PaymentScheme/visacolour-card-footer.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
c0866e03ebf3bfb797dc7ce4af5c1518f93d41f6261cb7a0dd758ec30c3944ef
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/30080_0002
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Last-Modified
Tue, 04 Jul 2017 02:04:29 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Content-Type
image/png
X-XSS-Protection
1; mode=block
Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
Content-Length
58862
ETag
"2b37ddf69f4d21:0"
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
mastercardcolour-card-footer.png
sec.paymentexpress.com/pxpay/images/Logos/PaymentScheme/
57 KB
57 KB
Image
General
Full URL
https://sec.paymentexpress.com/pxpay/images/Logos/PaymentScheme/mastercardcolour-card-footer.png
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
bb1c60e594e6127abd46a6d3f23065cb0b4e7d05d823e73c82b13f94533cc66b
Security Headers
Name Value
Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/30080_0002
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=16070400
X-Content-Type-Options
nosniff
Last-Modified
Tue, 04 Jul 2017 02:43:47 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Content-Type
image/png
X-XSS-Protection
1; mode=block
Date
Fri, 07 Jul 2017 03:58:50 GMT
Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:
Accept-Ranges
bytes
Content-Length
58862
ETag
"0f8225c6ff4d21:0"
X-Content-Security-Policy
default-src https://sec.paymentexpress.com 'self' data:; script-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com 'self' data:; options inline-script
shim.css
sec.paymentexpress.com/js/js-webshim/shims/styles/
12 KB
3 KB
Stylesheet
General
Full URL
https://sec.paymentexpress.com/js/js-webshim/shims/styles/shim.css
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/js/jquery-1.12.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
349f4c1e37ec38a30694e239f762be58aee2d5a63f8ff85e1d32cdc2603416dd

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:51 GMT
Content-Encoding
gzip
ETag
"097f3fd144d01:0"
Last-Modified
Mon, 09 Feb 2015 00:47:34 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
2914
form-core.js
sec.paymentexpress.com/js/js-webshim/shims/
5 KB
2 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/js-webshim/shims/form-core.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/js/jquery-1.12.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
a8c6bb083cda2f1280ba6315528412ec9355d2ab77c365b4f35d8f8f5a506b23

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:51 GMT
Content-Encoding
gzip
ETag
"80ba99d0685ad21:0"
Last-Modified
Tue, 20 Dec 2016 02:28:57 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
2134
form-validation.js
sec.paymentexpress.com/js/js-webshim/shims/
17 KB
6 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/js-webshim/shims/form-validation.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/js/jquery-1.12.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
ab2e523e7c952179cac89c964ed043d0fddaa75b7a4d9eadd0397180fe66c81e

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:51 GMT
Content-Encoding
gzip
ETag
"80ba99d0685ad21:0"
Last-Modified
Tue, 20 Dec 2016 02:28:57 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
6447
form-validators.js
sec.paymentexpress.com/js/js-webshim/shims/
8 KB
3 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/js-webshim/shims/form-validators.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/js/jquery-1.12.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
b1f15ca2b718c496e0d1e87086b17c15baee489e1cf04519036b2b137f19b3db

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:51 GMT
Content-Encoding
gzip
ETag
"09c6249354d21:0"
Last-Modified
Sun, 11 Dec 2016 23:07:04 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
3110
jquery.ui.position.js
sec.paymentexpress.com/js/js-webshim/shims/plugins/
6 KB
2 KB
Script
General
Full URL
https://sec.paymentexpress.com/js/js-webshim/shims/plugins/jquery.ui.position.js
Requested by
Host: sec.paymentexpress.com
URL: https://sec.paymentexpress.com/js/jquery-1.12.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
203.207.60.102 , New Zealand, ASN131168 (PAYMENTEXPRESS-NZ Payment Express Limited, NZ),
Reverse DNS
Software
/
Resource Hash
9e04ba92f2dc0981daeac9287e8d5c4ff437f816b6c94ed0d17b5b27f864661f

Request headers

Referer
https://sec.paymentexpress.com/pxmi3/EF4054F622D6C4C1B6E79F9A64375F7F3B37AE89AAFF9903F42D9C4A63BDB5BA78F77F2B82074A208
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Fri, 07 Jul 2017 03:58:52 GMT
Content-Encoding
gzip
ETag
"8005bfd144d01:0"
Last-Modified
Mon, 09 Feb 2015 00:47:33 GMT
Server
X-ASPNET-VERSION
X-POWERED-BY
Vary
Accept-Encoding
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
2559
E0000690749E91CA07880D0AC8F8A8F42ABA18ACEFD8EF680A562556D18349A3C63F94C90791A121650E9BB6908C096803BA78D05253B14C4C4EC8D05253B14C4C4EC
sec.paymentexpress.com/pxmi3/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sec.paymentexpress.com
URL
https://sec.paymentexpress.com/pxmi3/E0000690749E91CA07880D0AC8F8A8F42ABA18ACEFD8EF680A562556D18349A3C63F94C90791A121650E9BB6908C096803BA78D05253B14C4C4EC8D05253B14C4C4EC

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:
Strict-Transport-Security max-age=16070400
X-Content-Security-Policy default-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://www.google.com 'self' data:; script-src https://sec.paymentexpress.com https://assets.secure.checkout.visa.com https://www.google.com https://www.gstatic.com 'self' 'unsafe-inline' data:; style-src https://sec.paymentexpress.com 'self' 'unsafe-inline' data:; img-src https://sec.paymentexpress.com https://secure.checkout.visa.com https://assets.secure.checkout.visa.com 'self' data:; options inline-script
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block