urlscan.io logo urlscan.io
SecurityTrails logo

www.bnpparibasfortis.be Open in urlscan Pro
193.58.4.82  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.bnpparibasfortis.be/promo/KCMA/Proxy.asp?proxyTarget=/site/renderers/commfull.aspx&ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOz...
Effective URL: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA...
Submission: On January 17 via api from BE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 193.58.4.82, located in Belgium and belongs to BNP-PARIBAS France, FR. The main domain is www.bnpparibasfortis.be.
TLS certificate: Issued by Entrust Certification Authority - L1M on January 14th 2020. Valid for: 2 years.
This is the only time www.bnpparibasfortis.be was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 7 193.58.4.82 25215 (BNP-PARIB...)
6 1
Apex Domain
Subdomains		 Transfer
7 bnpparibasfortis.be
www.bnpparibasfortis.be
128 KB
6 1
Domain Requested by
7 www.bnpparibasfortis.be 1 redirects www.bnpparibasfortis.be
6 1

This site contains no links.

Subject Issuer Validity Valid
www.bnpparibasfortis.be
Entrust Certification Authority - L1M		 2020-01-14 -
2022-01-22		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Frame ID: 45F6237FE99D253D26FD4A020F03D60B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.bnpparibasfortis.be/promo/KCMA/Proxy.asp?proxyTarget=/site/renderers/commfull.aspx&ID=3vu3wCgEM2... HTTP 307
    https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+... Page URL

Detected technologies

Overall confidence: 50%
Detected patterns
  • url /\.aspx?(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • url /\.aspx?(?:$|\?)/i
Overall confidence: 50%
Detected patterns
  • url /\.aspx?(?:$|\?)/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

127 kB
Transfer

143 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.bnpparibasfortis.be/promo/KCMA/Proxy.asp?proxyTarget=/site/renderers/commfull.aspx&ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw HTTP 307
    https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set commfull.aspx
www.bnpparibasfortis.be/site/renderers/
Redirect Chain
  • https://www.bnpparibasfortis.be/promo/KCMA/Proxy.asp?proxyTarget=/site/renderers/commfull.aspx&ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
  • https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
28 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.58.4.82 , Belgium, ASN25215 (BNP-PARIBAS France, FR),
Reverse DNS
bnpparisbasfortis.com
Software
/
Resource Hash
dc3d392b3689b2243281028f8f3e850082ada940ce96017ba670be11577e499c
Security Headers
Name Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
www.bnpparibasfortis.be
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
per_ebew_web=!RRZo1fEJySbN7ZpFstCmiaylY2SFZVa2XzVybCw/tPUdsT+SnWOVtRbvrhKptgk43laGQ1s3AyX/Ri4=; TS0167a2a0=0178fc74f923ad5b3d45e6adbaef0cd3a06c672a0e8989faf3d37622288a0056c5bda3a94137459a7727bc5b10261f15305ba272c7b061a575783e949c4019800962d5ec3d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-type
text/html; charset=Windows-1252
date
Sun, 17 Jan 2021 06:18:52 GMT
p3p
CP="NON CUR OTPi OUR NOR UNI"
x-old-content-length
28769
cache-control
private
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Content-Security-Policy
reflected-xss block
Set-Cookie
ASP.NET_SessionId=fsl3vpqdgfzbql3rphyulqcg; Path=/; SameSite=Lax; HttpOnly; Secure; CR=9elsPyFA4AfCFB3bUO0MrFnqIkj/mncn8aJhMXP86d+JuHqC/tmG1NXW9Ljz6gI4H+E+icZPP0TJg9PYnc09N5YHRGwuxDgQ9swGR7ixLcBfh73hZWXsKKaOheYz31pEPPFiuylI6vHK9A7WLHS4kkctm+c+hH9w; Path=/; Secure; per_ebew_web=!HBbeilZn2kG20hpFstCmiaylY2SFZVeN2PyD+0kyjBgsr+Onim+xRvbySQLhiwBxgp+aKKCNQFUVUs4=; expires=Sun, 17-Jan-2021 06:33:53 GMT; path=/; Httponly; Secure TS0167a2a0=0178fc74f9f51ff5f74e8ffddbc83e012f1cba07428989faf3d37622288a0056c5bda3a94137459a7727bc5b10261f15305ba272c7ee2875a1e77f7091607e74c0742b99e08ed1126cfc659a4098e9190199e6c2e3e46d5d21fe229d41806da3f784d21038; Path=/; Secure; HTTPOnly
Vary
Accept-Encoding
Content-Encoding
gzip
Transfer-Encoding
chunked

Redirect headers

content-length
382
content-type
text/html; charset=iso-8859-1
date
Sun, 17 Jan 2021 06:18:52 GMT
location
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
p3p
CP="NON CUR OTPi OUR NOR UNI"
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Content-Security-Policy
reflected-xss block
Set-Cookie
per_ebew_web=!RRZo1fEJySbN7ZpFstCmiaylY2SFZVa2XzVybCw/tPUdsT+SnWOVtRbvrhKptgk43laGQ1s3AyX/Ri4=; expires=Sun, 17-Jan-2021 06:33:52 GMT; path=/; Httponly; Secure TS0167a2a0=0178fc74f923ad5b3d45e6adbaef0cd3a06c672a0e8989faf3d37622288a0056c5bda3a94137459a7727bc5b10261f15305ba272c7b061a575783e949c4019800962d5ec3d; Path=/; Secure; HTTPOnly
Vary
Accept-Encoding
BRANDBAR_DESKTOP_600X80_NL_x2.png
www.bnpparibasfortis.be/Images/Generic/Mails/Mailing2016/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bnpparibasfortis.be/Images/Generic/Mails/Mailing2016/BRANDBAR_DESKTOP_600X80_NL_x2.png
Requested by
Host: www.bnpparibasfortis.be
URL: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.58.4.82 , Belgium, ASN25215 (BNP-PARIBAS France, FR),
Reverse DNS
bnpparisbasfortis.com
Software
/
Resource Hash
6cff3a28397d61ab6daafb8c3b74cdd464ad47f0cf1abaa5b1edba4c8d3fb396
Security Headers
Name Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 06:18:52 GMT
X-Content-Type-Options
nosniff
last-modified
Wed, 11 Jan 2017 11:09:57 GMT
etag
"97c4c3efb6bd21:0"
X-Frame-Options
SAMEORIGIN
p3p
CP="NON CUR OTPi OUR NOR UNI"
Content-Security-Policy
reflected-xss block
Strict-Transport-Security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-type
image/png
content-length
18510
X-XSS-Protection
1; mode=block
602228825_ADS_RPB_Edenred_Awareness_Campaign_EmailHeader_600x200_NL.jpg
www.bnpparibasfortis.be/Images/COMM/campaigns/2021/01/edenred/ 		90 KB
91 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bnpparibasfortis.be/Images/COMM/campaigns/2021/01/edenred/602228825_ADS_RPB_Edenred_Awareness_Campaign_EmailHeader_600x200_NL.jpg
Requested by
Host: www.bnpparibasfortis.be
URL: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.58.4.82 , Belgium, ASN25215 (BNP-PARIBAS France, FR),
Reverse DNS
bnpparisbasfortis.com
Software
/
Resource Hash
66f7d4a5e17ace5a97ca81a7117dd9a40edddc5867587fd900ecde230a922728
Security Headers
Name Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 06:18:52 GMT
X-Content-Type-Options
nosniff
last-modified
Thu, 07 Jan 2021 14:14:39 GMT
etag
"f82c776fffe4d61:0"
X-Frame-Options
SAMEORIGIN
p3p
CP="NON CUR OTPi OUR NOR UNI"
Content-Security-Policy
reflected-xss block
Strict-Transport-Security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-type
image/jpeg
content-length
92398
X-XSS-Protection
1; mode=block
qr-code.png
www.bnpparibasfortis.be/Images/COMM/campaigns/2021/01/edenred/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bnpparibasfortis.be/Images/COMM/campaigns/2021/01/edenred/qr-code.png
Requested by
Host: www.bnpparibasfortis.be
URL: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.58.4.82 , Belgium, ASN25215 (BNP-PARIBAS France, FR),
Reverse DNS
bnpparisbasfortis.com
Software
/
Resource Hash
4cdcd198081a0e4c8e516e79ef8c9d4b1313ac0937fb9b5828dede67fef0a92b
Security Headers
Name Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 06:18:54 GMT
X-Content-Type-Options
nosniff
last-modified
Thu, 07 Jan 2021 14:14:44 GMT
etag
"78b68872ffe4d61:0"
X-Frame-Options
SAMEORIGIN
p3p
CP="NON CUR OTPi OUR NOR UNI"
Content-Security-Policy
reflected-xss block
Strict-Transport-Security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-type
image/png
content-length
2979
X-XSS-Protection
1; mode=block
icone_website_x2.png
www.bnpparibasfortis.be/Images/Generic/Mails/Mailing2016/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bnpparibasfortis.be/Images/Generic/Mails/Mailing2016/icone_website_x2.png
Requested by
Host: www.bnpparibasfortis.be
URL: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.58.4.82 , Belgium, ASN25215 (BNP-PARIBAS France, FR),
Reverse DNS
bnpparisbasfortis.com
Software
/
Resource Hash
ca882fe46f97b3e24937bf5c675c55a25abd9c959ffc9ce87c41bded9d67c5bf
Security Headers
Name Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 06:18:52 GMT
X-Content-Type-Options
nosniff
last-modified
Wed, 26 Apr 2017 09:50:11 GMT
etag
"76f2267f72bed21:0"
X-Frame-Options
SAMEORIGIN
p3p
CP="NON CUR OTPi OUR NOR UNI"
Content-Security-Policy
reflected-xss block
Strict-Transport-Security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-type
image/png
content-length
1940
X-XSS-Protection
1; mode=block
icone_community_x2.png
www.bnpparibasfortis.be/Images/Generic/Mails/Mailing2016/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bnpparibasfortis.be/Images/Generic/Mails/Mailing2016/icone_community_x2.png
Requested by
Host: www.bnpparibasfortis.be
URL: https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.58.4.82 , Belgium, ASN25215 (BNP-PARIBAS France, FR),
Reverse DNS
bnpparisbasfortis.com
Software
/
Resource Hash
d24365694c3949dd369c63a53e198154a29692bc1c45085fbf80cdc0062afeb9
Security Headers
Name Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.bnpparibasfortis.be/site/renderers/commfull.aspx?ID=3vu3wCgEM2FBLrjA6JEYj+v3EVTUOzWB2Uiuj6UeM1q+T6Kh_uk8o45tXgd612wA81HaQjmXJxcpjRNKz1wlwEIJMa3hw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 17 Jan 2021 06:18:54 GMT
X-Content-Type-Options
nosniff
last-modified
Wed, 26 Apr 2017 09:50:11 GMT
etag
"cfe207f72bed21:0"
X-Frame-Options
SAMEORIGIN
p3p
CP="NON CUR OTPi OUR NOR UNI"
Content-Security-Policy
reflected-xss block
Strict-Transport-Security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-type
image/png
content-length
1457
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

4 Cookies

Domain/Path Name / Value
www.bnpparibasfortis.be/ Name: TS0167a2a0
Value: 0178fc74f922d3f0362d04fedf2666558fb54bf86e8989faf3d37622288a0056c5bda3a94137459a7727bc5b10261f15305ba272c7833efae1ba7b6cfd1ec746bfc03f37f3ceb5604483f74e1ffe026d3e45e5173487b74d59ffb885a085689ad41bf27ae4
www.bnpparibasfortis.be/ Name: CR
Value: 9elsPyFA4AfCFB3bUO0MrFnqIkj/mncn8aJhMXP86d+JuHqC/tmG1NXW9Ljz6gI4H+E+icZPP0TJg9PYnc09N5YHRGwuxDgQ9swGR7ixLcBfh73hZWXsKKaOheYz31pEPPFiuylI6vHK9A7WLHS4kkctm+c+hH9w
www.bnpparibasfortis.be/ Name: per_ebew_web
Value: !5DwVFHBok69HGsFFstCmiaylY2SFZSnR2PNto67RHtMseUGsAPpgvv04rOm01ueGBCNbj1WMr9CCEno=
www.bnpparibasfortis.be/ Name: ASP.NET_SessionId
Value: fsl3vpqdgfzbql3rphyulqcg

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy reflected-xss block
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block