urlscan.io logo urlscan.io
SecurityTrails logo

portal.mvp.bafin.de Open in urlscan Pro
217.111.31.183  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://portal.mvp.bafin.de/
Effective URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Submission: On September 22 via manual from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 217.111.31.183, located in Germany and belongs to COLT COLT Technology Services Group Limited, GB. The main domain is portal.mvp.bafin.de.
TLS certificate: Issued by GlobalSign Organization Validation CA... on April 16th 2019. Valid for: 2 years.
This is the only time portal.mvp.bafin.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13 217.111.31.183 8220 (COLT COLT...)
12 1
Apex Domain
Subdomains		 Transfer
13 bafin.de
portal.mvp.bafin.de
211 KB
12 1
Domain Requested by
13 portal.mvp.bafin.de 1 redirects portal.mvp.bafin.de
12 1

This site contains no links.

Subject Issuer Validity Valid
portal.mvp.bafin.de
GlobalSign Organization Validation CA - SHA256 - G2		 2019-04-16 -
2021-07-09		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Frame ID: FAFA48F9B1F66D35D165F3FFBE3C650E
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://portal.mvp.bafin.de/ HTTP 307
    https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

211 kB
Transfer

206 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://portal.mvp.bafin.de/ HTTP 307
    https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set login.html
portal.mvp.bafin.de/MvpPortalWeb/app/
Redirect Chain
  • https://portal.mvp.bafin.de/
  • https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
6 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
760a5724f3656377946564b62b312909bba0c94f1cd1a0eb404378f4424425a9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Host
portal.mvp.bafin.de
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
Set-Cookie
MvpSession=CE3AB447E9161600C2059876526D2604330ED24C0000kx0pt7ptUXddypaT6is8wLi:1b7vk05l0; Path=/; Secure; HttpOnly
Expires
Thu, 01 Dec 1994 16:00 GMT
Cache-Control
private, must-revalidate
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin
X-Permitted-Cross-Domain-Policies
master-only
X-XSS-Protection
1; mode=block

Redirect headers

Location
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Content-Type
text/xml
Connection
close
reset.css
portal.mvp.bafin.de/MvpPortalWeb/static/css/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/reset.css
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
c1294bdf063296c4dfd9b5462237703a8ad24b0b10832d5573be4c42db0a96e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
text/css
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
main.css
portal.mvp.bafin.de/MvpPortalWeb/static/css/ 		30 KB
30 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/main.css
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
37efd964f46bd69afc5f948fd37989a26dbaead08f1983b554e9c54d0c39e366
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
text/css
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
styles.css
portal.mvp.bafin.de/MvpPortalWeb/static/css/ 		9 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/styles.css
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
eddfbeb68e662de23060238c514da6b2ee44f465f7237e2406d6a4e8f828f5d3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
text/css
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
displaytag.css
portal.mvp.bafin.de/MvpPortalWeb/static/css/ 		3 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/displaytag.css
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
b827930baabe3703ba714b2a2cf04b7e5469c930eb4e911acc9cef53a9fb7f58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
text/css
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
icons.css
portal.mvp.bafin.de/MvpPortalWeb/static/css/icon-font/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/icon-font/icons.css
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
125115512395815f6bf3c08ff24c5e19841e1e1ab81e488623810601fb73f974
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
text/css
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
jquery-3.2.1.min.js
portal.mvp.bafin.de/MvpPortalWeb/static/js/thirdparty/jquery/ 		85 KB
85 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/js/thirdparty/jquery/jquery-3.2.1.min.js
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
application/javascript
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
bafin_logo.png
portal.mvp.bafin.de/MvpPortalWeb/static/images/corporate/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/images/corporate/bafin_logo.png
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
ce5a35253e0be8533d08200816cb841167eb45b780bafb93a6c3964596d5588a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
print.css
portal.mvp.bafin.de/MvpPortalWeb/static/css/ 		1 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/print.css
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
68845d96a8ad11e013954334a66b1317e9736842c300e0dfe87363735d9b720f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/app/login.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
text/css
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
background.png
portal.mvp.bafin.de/MvpPortalWeb/static/images/corporate/ 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/images/corporate/background.png
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/static/css/main.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
be2f596c4eaf8e399a01adff1aabf9160f9b108770b95b3990e8c906bc486617
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
information.png
portal.mvp.bafin.de/MvpPortalWeb/static/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/images/information.png
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/static/css/main.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
bcf9b788408bd931205a5a69fa660d99326bcd5588753362d4e0e9f4a109526f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT
user_go.png
portal.mvp.bafin.de/MvpPortalWeb/static/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://portal.mvp.bafin.de/MvpPortalWeb/static/images/user_go.png
Requested by
Host: portal.mvp.bafin.de
URL: https://portal.mvp.bafin.de/MvpPortalWeb/static/css/styles.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
217.111.31.183 , Germany, ASN8220 (COLT COLT Technology Services Group Limited, GB),
Reverse DNS
Software
/
Resource Hash
aeea2cbf8235ac8b96c63c955b74cedd9c9c4c3a392543705abc1f2067882771
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://portal.mvp.bafin.de/MvpPortalWeb/static/css/styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
master-only
X-Frame-Options
sameorigin
Content-Type
image/png
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Dec 1994 16:00 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| flowSubmit

1 Cookies

Domain/Path Name / Value
portal.mvp.bafin.de/ Name: MvpSession
Value: CE3AB447E9161600C2059876526D2604330ED24C0000kx0pt7ptUXddypaT6is8wLi:1b7vk05l0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block