Submitted URL: https://eu.hiperos.com/External/_si7314?xS=J2476twMYxYmVb6noowiFnbcNl%2B7hBi19PROg4g7pCcipkTATr1wfVu0YxQ0afJ6IXeAQyEYc0...
Effective URL: https://eu.hiperos.com/Account/AuthenticationCode
Submission: On December 06 via manual from PH — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 54.75.254.224, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is eu.hiperos.com. The Cisco Umbrella rank of the primary domain is 939533.
TLS certificate: Issued by Amazon RSA 2048 M02 on March 10th 2023. Valid for: a year.
This is the only time eu.hiperos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 12 54.75.254.224 16509 (AMAZON-02)
11 1
Apex Domain
Subdomains
Transfer
12 hiperos.com
eu.hiperos.com — Cisco Umbrella Rank: 939533
132 KB
11 1
Domain Requested by
12 eu.hiperos.com 1 redirects eu.hiperos.com
11 1

This site contains links to these domains. Also see Links.

Domain
www.coupa.com
Subject Issuer Validity Valid
*.hiperos.com
Amazon RSA 2048 M02
2023-03-10 -
2024-04-07
a year crt.sh

This page contains 1 frames:

Primary Page: https://eu.hiperos.com/Account/AuthenticationCode
Frame ID: 9BD184959C5D318C3BD2417BE6DF0446
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Coupa

Page URL History Show full URLs

  1. https://eu.hiperos.com/External/_si7314?xS=J2476twMYxYmVb6noowiFnbcNl%2B7hBi19PROg4g7pCcipkTATr1wfV... HTTP 302
    https://eu.hiperos.com/Account/AuthenticationCode Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

131 kB
Transfer

377 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://eu.hiperos.com/External/_si7314?xS=J2476twMYxYmVb6noowiFnbcNl%2B7hBi19PROg4g7pCcipkTATr1wfVu0YxQ0afJ6IXeAQyEYc0rimCcA2p8I1dyMNSbOsFBKOJoiZy3j50J1BeM3VxLzYYbrDXSDR6ndfKS6fn%2FAi2i%2FNMxxna5nqDxAQTb6qUegVVEsj9MxVRr5eJAFDapgx%2F0ODH1JxAgzi9lnzQ2P6CE%3D HTTP 302
    https://eu.hiperos.com/Account/AuthenticationCode Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request AuthenticationCode
eu.hiperos.com/Account/
Redirect Chain
  • https://eu.hiperos.com/External/_si7314?xS=J2476twMYxYmVb6noowiFnbcNl%2B7hBi19PROg4g7pCcipkTATr1wfVu0YxQ0afJ6IXeAQyEYc0rimCcA2p8I1dyMNSbOsFBKOJoiZy3j50J1BeM3VxLzYYbrDXSDR6ndfKS6fn%2FAi2i%2FNMxxna5n...
  • https://eu.hiperos.com/Account/AuthenticationCode
6 KB
3 KB
Document
General
Full URL
https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
1fac14499a776d45349f2f4beb93d192525bfed414a6d7874aa47b6750481684
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, no-cache="Set-Cookie", no-store, max-age=0
content-encoding
gzip
content-length
2452
content-type
text/html; charset=utf-8
date
Wed, 06 Dec 2023 16:11:38 GMT
expires
Wed, 06 Dec 2023 16:11:38 GMT
last-modified
Wed, 06 Dec 2023 16:11:38 GMT
pragma
no-cache
strict-transport-security
max-age=31536000
vary
*
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

cache-control
private
content-length
144
content-type
text/html; charset=utf-8
date
Wed, 06 Dec 2023 16:11:38 GMT
expires
0
location
/Account/AuthenticationCode
pragma
no-cache
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
ExistingStylesheet.css
eu.hiperos.com/branding/default/css/
104 KB
24 KB
Stylesheet
General
Full URL
https://eu.hiperos.com/branding/default/css/ExistingStylesheet.css
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a97e38097c68827dde113f6b80f1b6f3c9b4c28c2192dfe288dcf8e11517cbbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:34 GMT
etag
"0b7b1c8c824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
23784
x-xss-protection
1; mode=block
Site.css
eu.hiperos.com/Content/
5 KB
2 KB
Stylesheet
General
Full URL
https://eu.hiperos.com/Content/Site.css
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7198a9d3aa2c2a198b2d458f137fa2d1096bc77d5fb1de893e63971dc0f875f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:36 GMT
etag
"0e4e2c9c824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
1924
x-xss-protection
1; mode=block
bootstrap-overload.css
eu.hiperos.com/Content/bootstrap/
138 KB
31 KB
Stylesheet
General
Full URL
https://eu.hiperos.com/Content/bootstrap/bootstrap-overload.css
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
4ffd7574164764d589e795eba564b52f901d97799bd27112deb328700ec9e3b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:36 GMT
etag
"0e4e2c9c824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
31455
x-xss-protection
1; mode=block
Account.css
eu.hiperos.com/Content/
7 KB
3 KB
Stylesheet
General
Full URL
https://eu.hiperos.com/Content/Account.css
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7cdc995baf79b9c53c42880e15800da41c4a385578cef5179e63d2fb76752d0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:36 GMT
etag
"0e4e2c9c824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
2490
x-xss-protection
1; mode=block
jquery-1.12.4.min.js
eu.hiperos.com/Scripts/
94 KB
43 KB
Script
General
Full URL
https://eu.hiperos.com/Scripts/jquery-1.12.4.min.js
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
10179abdf852679c47fa85f0fb4b85d4e7a4ff8a7fb35bb208b44279076e560f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:40 GMT
etag
"03e45ccc824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
42931
x-xss-protection
1; mode=block
LoginUtilities.js
eu.hiperos.com/Scripts/
519 B
1 KB
Script
General
Full URL
https://eu.hiperos.com/Scripts/LoginUtilities.js
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
4c36881fe232d3c887b0d6ee1c0c235dbc58e564d1e3497d2318b1bf717a6b5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:40 GMT
etag
"03e45ccc824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
409
x-xss-protection
1; mode=block
big-spinner.gif
eu.hiperos.com/Content/
12 KB
13 KB
Image
General
Full URL
https://eu.hiperos.com/Content/big-spinner.gif
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
82c86f25b7a8b09e0890b0c42da3ccf25e5910d9ace9bb75ceacdf0a5706a64e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Sat, 02 Dec 2023 02:39:36 GMT
etag
"0e4e2c9c824da1:0"
x-frame-options
SAMEORIGIN
content-type
image/gif
cache-control
max-age=31536000
accept-ranges
bytes
content-length
12542
x-xss-protection
1; mode=block
LoginLogo.png
eu.hiperos.com/branding/images/
5 KB
5 KB
Image
General
Full URL
https://eu.hiperos.com/branding/images/LoginLogo.png
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
75bba391adb929abea827c78dfacc4219dea7c87442841dab012dfec5fc89ee5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Sat, 02 Dec 2023 02:39:34 GMT
etag
"0b7b1c8c824da1:0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
4751
x-xss-protection
1; mode=block
footer-logo.png
eu.hiperos.com/branding/images/
4 KB
4 KB
Image
General
Full URL
https://eu.hiperos.com/branding/images/footer-logo.png
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/Account/AuthenticationCode
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ab9e660be06a41ef7be9ab4c0bc8dca88671fe86b8d2f7210f53e81a88ca57fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/Account/AuthenticationCode
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Sat, 02 Dec 2023 02:39:34 GMT
etag
"0b7b1c8c824da1:0"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
3670
x-xss-protection
1; mode=block
open-sans.css
eu.hiperos.com/branding/fonts/open-sans/
2 KB
1 KB
Stylesheet
General
Full URL
https://eu.hiperos.com/branding/fonts/open-sans/open-sans.css
Requested by
Host: eu.hiperos.com
URL: https://eu.hiperos.com/branding/default/css/ExistingStylesheet.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.75.254.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-75-254-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
105501c763493efe1b12bc8425d767a83d8fe75b25d9acb003f82a32ab57970d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eu.hiperos.com/branding/default/css/ExistingStylesheet.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Wed, 06 Dec 2023 16:11:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Sat, 02 Dec 2023 02:39:34 GMT
etag
"0b7b1c8c824da1:0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
cache-control
max-age=31536000
accept-ranges
bytes
content-length
695
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery object| authenticationCode string| CSRF_H_2971_token object| SRF_H_2971_headers object| SRF_H_2971_config object| HiperosLocalizationObject object| mvcClientValidationMetadata

4 Cookies

Domain/Path Name / Value
eu.hiperos.com/ Name: ASP.NET_SessionId
Value: cnnbawh2bcoob4srbp4ea511
eu.hiperos.com/ Name: __RequestVerificationToken
Value: 1uLQIj7ZRxur4NjmjX3qJV-gyvqbqT2RoX73b5BsPvctdhJKOK6yvqY2KnqglYC6dy97Lm492nirTQEsYbWCzorTyeU1
eu.hiperos.com/ Name: AWSALB
Value: JggMsybQ6lmew2TKENm9cCgEcz2WlUnKP8TMIvqf0q6U83ocLoXir/xfQVWQRRkKeEvGIIKra0g52lM5oJik1ACOsRQSBXo2hLsoALDUSw6gAEAZ+JlBQQ2D+Hmn
eu.hiperos.com/ Name: AWSALBCORS
Value: JggMsybQ6lmew2TKENm9cCgEcz2WlUnKP8TMIvqf0q6U83ocLoXir/xfQVWQRRkKeEvGIIKra0g52lM5oJik1ACOsRQSBXo2hLsoALDUSw6gAEAZ+JlBQQ2D+Hmn

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block