Submitted URL: https://kelatrack.com/
Effective URL: https://www.kela.fi/
Submission: On March 06 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 91.223.107.77, located in Vantaa, Finland and belongs to ELISA-AS Helsinki, Finland, FI. The main domain is www.kela.fi.
TLS certificate: Issued by Entrust Certification Authority - L1M on April 29th 2022. Valid for: a year.
This is the only time www.kela.fi was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 162.144.4.119 46606 (UNIFIEDLA...)
14 91.223.107.77 719 (ELISA-AS ...)
14 1
Apex Domain
Subdomains
Transfer
14 kela.fi
www.kela.fi
852 KB
1 kelatrack.com
kelatrack.com
89 B
14 2
Domain Requested by
14 www.kela.fi www.kela.fi
1 kelatrack.com 1 redirects
14 2
Subject Issuer Validity Valid
www.kela.fi
Entrust Certification Authority - L1M
2022-04-29 -
2023-05-27
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.kela.fi/
Frame ID: D78D37651EFC8970DC37118C2A3B44FE
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Henkilöasiakkaat | Kela

Page URL History Show full URLs

  1. https://kelatrack.com/ HTTP 302
    https://www.kela.fi/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

852 kB
Transfer

1854 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://kelatrack.com/ HTTP 302
    https://www.kela.fi/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.kela.fi/
Redirect Chain
  • https://kelatrack.com/
  • https://www.kela.fi/
3 KB
3 KB
Document
General
Full URL
https://www.kela.fi/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
cb17ad9c63b67e2c1df2eb01326c3778305ca33d8c2ef5e27d05716809224109
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
content-encoding
gzip
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
content-type
text/html; charset=utf-8
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Mon, 06 Mar 2023 14:56:04 GMT
etag
W/"adb-BVtyYgtdUouc87ZMUkY7nS79XvM"
keep-alive
timeout=5
referrer-policy
strict-origin-when-cross-origin
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
sec-fetch-site, Accept-Encoding
x-content-type-options
nosniff
x-frame-options
deny

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Mon, 06 Mar 2023 14:56:04 GMT
location
https://www.kela.fi
server
Apache
main.0e93f171.js
www.kela.fi/static/js/
994 KB
306 KB
Script
General
Full URL
https://www.kela.fi/static/js/main.0e93f171.js
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
2c8573ba967d0a1bcc91da488a31a43b4fb638081d1df218a2aacf017e1a9b00
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.kela.fi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
x-content-type-options
nosniff
date
Mon, 06 Mar 2023 14:56:04 GMT
content-encoding
gzip
cross-origin-resource-policy
same-origin
content-length
311994
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 23 Feb 2023 13:53:34 GMT
cross-origin-opener-policy
same-origin
etag
W/"4c2ba-1867e8cfb30"
x-frame-options
deny
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
keep-alive
timeout=5
main.bd2ba099.css
www.kela.fi/static/css/
322 KB
51 KB
Stylesheet
General
Full URL
https://www.kela.fi/static/css/main.bd2ba099.css
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
65e92713e8589b6f2981604c775e5cd5b00a58eae4d75abc9304f07c1ab31f52
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.kela.fi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
x-content-type-options
nosniff
date
Mon, 06 Mar 2023 14:56:04 GMT
content-encoding
gzip
cross-origin-resource-policy
same-origin
content-length
50764
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 23 Feb 2023 13:53:33 GMT
cross-origin-opener-policy
same-origin
etag
W/"c64c-1867e8cf748"
x-frame-options
deny
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
keep-alive
timeout=5
settings
www.kela.fi/api/platform/
653 B
2 KB
XHR
General
Full URL
https://www.kela.fi/api/platform/settings
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
6fd7053790b7a8eb4c0a2af612377ada8852800a3ceef7535c1eee2a36f0908d
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
cross-origin-opener-policy
same-origin
etag
W/"28d-VPaHosz4xtcePAFFsWARxSOUVfw"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
content-length
653
fault-messages
www.kela.fi/api/
5 KB
3 KB
XHR
General
Full URL
https://www.kela.fi/api/fault-messages
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
dbae9e0d4b14342bb2ad5fbaf958a0067d0b2927aa81d5be3032e5377abe032d
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-opener-policy
same-origin
etag
W/"1459-26/psAy1QJCJvttuI3ZMe1FLqsU"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
fi
www.kela.fi/api/node-cache/pageload/henkiloasiakkaat/
54 KB
17 KB
XHR
General
Full URL
https://www.kela.fi/api/node-cache/pageload/henkiloasiakkaat/fi?siteName=kelafi
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
aa35cf3287fc76b35f487cff8d3fe35101e87185a9c2706cda15bb2b1a2f07ab
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-opener-policy
same-origin
etag
W/"d68b-g97xh19lDW/oSJuLBLnmApP96ns"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
fi
www.kela.fi/api/node-cache/navigation/2797/
12 KB
3 KB
XHR
General
Full URL
https://www.kela.fi/api/node-cache/navigation/2797/fi?siteName=kelafi
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
1c63a42dfbf54cfcf93a507de6c39d5b3b3a076ae6fdf5060df0e98857cbd33b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-opener-policy
same-origin
etag
W/"314b-fvT/WA05F81oPsvjX3IehnRmsHo"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
lato-normal.75614cfcfedd509b1f7a.woff2
www.kela.fi/static/media/
178 KB
180 KB
Font
General
Full URL
https://www.kela.fi/static/media/lato-normal.75614cfcfedd509b1f7a.woff2
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/css/main.bd2ba099.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Referer
https://www.kela.fi/static/css/main.bd2ba099.css
Origin
https://www.kela.fi
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
x-content-type-options
nosniff
date
Mon, 06 Mar 2023 14:56:05 GMT
cross-origin-resource-policy
same-origin
content-length
182708
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 23 Feb 2023 13:53:33 GMT
cross-origin-opener-policy
same-origin
etag
W/"2c9b4-1867e8cf748"
x-frame-options
deny
vary
sec-fetch-site
content-type
font/woff2
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
keep-alive
timeout=5
NotoSans-Regular.e775d26574be5ec79b7e.woff2
www.kela.fi/static/media/
182 KB
183 KB
Font
General
Full URL
https://www.kela.fi/static/media/NotoSans-Regular.e775d26574be5ec79b7e.woff2
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/css/main.bd2ba099.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
526759420a37a3ff4ae444a90872d9c13d316af2a5ddc5a44d97c699524ddc3a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Referer
https://www.kela.fi/static/css/main.bd2ba099.css
Origin
https://www.kela.fi
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
x-content-type-options
nosniff
date
Mon, 06 Mar 2023 14:56:05 GMT
cross-origin-resource-policy
same-origin
content-length
186516
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 23 Feb 2023 13:53:33 GMT
cross-origin-opener-policy
same-origin
etag
W/"2d894-1867e8cf748"
x-frame-options
deny
vary
sec-fetch-site
content-type
font/woff2
cache-control
max-age=31536000, must-revalidate
accept-ranges
bytes
keep-alive
timeout=5
search-suggestions
www.kela.fi/api/
1 KB
2 KB
XHR
General
Full URL
https://www.kela.fi/api/search-suggestions?lang=fi
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
b580a0095de873f2b50b4250fd9b01885832eb5ed1130afaccb6358cbbf110c6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-opener-policy
same-origin
etag
W/"566-PrIvMr0cpAet8dK6vaOf+DfUXUI"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
fi
www.kela.fi/api/node-cache/content-sets/ajankohtaista-henkiloasiakkaat/
2 KB
2 KB
XHR
General
Full URL
https://www.kela.fi/api/node-cache/content-sets/ajankohtaista-henkiloasiakkaat/fi?siteName=kelafi&page=0&size=4
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
5260077a25217d8440c4e74bbf889d36f7e6bd65236291e53ef36ce147191a49
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-opener-policy
same-origin
etag
W/"82e-QWRGAF5fUSqYmdn2LCeeIrYPl9Y"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
footer
www.kela.fi/api/node-cache/menu/
5 KB
3 KB
XHR
General
Full URL
https://www.kela.fi/api/node-cache/menu/footer
Requested by
Host: www.kela.fi
URL: https://www.kela.fi/static/js/main.0e93f171.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
f4cce0e69c339bc115346b617e636ba68a37e3d103e5fead46c9c357a6435d77
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.kela.fi/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
content-encoding
gzip
cross-origin-opener-policy
same-origin
etag
W/"1384-JpF0X8CBhlrXZGOXvR2Z8vLg3PY"
date
Mon, 06 Mar 2023 14:56:05 GMT
x-frame-options
deny
vary
sec-fetch-site, Accept-Encoding
content-type
application/json; charset=utf-8
Transfer-Encoding
chunked
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
cross-origin-resource-policy
same-origin
keep-alive
timeout=5
1dc99e59-438e-fbe7-ac67-9bba76c4ab06
www.kela.fi/api/documents/20124/1071622/Henkiloasiakkaat-paakuva.png/
80 KB
81 KB
Image
General
Full URL
https://www.kela.fi/api/documents/20124/1071622/Henkiloasiakkaat-paakuva.png/1dc99e59-438e-fbe7-ac67-9bba76c4ab06?t=1636547421641
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
ae3ba8f3c8545362cbb8a41957999e1a8d712f66636ff5a18e3195b58b1efb08
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.kela.fi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
x-content-type-options
nosniff
date
Mon, 06 Mar 2023 14:56:05 GMT
cross-origin-resource-policy
same-origin
content-disposition
inline; filename="Henkiloasiakkaat-paakuva.png"
content-length
81675
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed Nov 10 2021 12:30:21 GMT+0000 (Coordinated Universal Time)
cross-origin-opener-policy
same-origin
etag
W/"13f0b-lw+H+Earp/KgivQ/kAr4X1Mb4Qw"
x-frame-options
deny
vary
sec-fetch-site
content-type
image/png
cache-control
max-age=300, must-revalidate
keep-alive
timeout=5
expires
Sat Aug 12 9995 13:30:00 GMT+0000 (Coordinated Universal Time)
d3bdd428-2cac-d33e-9e2f-69d0ad7fd5db
www.kela.fi/api/documents/20128/0/Nosto_sahkotuki%20(1).png/
15 KB
17 KB
Image
General
Full URL
https://www.kela.fi/api/documents/20128/0/Nosto_sahkotuki%20(1).png/d3bdd428-2cac-d33e-9e2f-69d0ad7fd5db
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.223.107.77 Vantaa, Finland, ASN719 (ELISA-AS Helsinki, Finland, FI),
Reverse DNS
Software
/
Resource Hash
262a1e32575ac0e2926100c04138f63086c9cafe8312fb31b9076f6103c8e189
Security Headers
Name Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.kela.fi/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-security-policy
default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
x-content-type-options
nosniff
date
Mon, 06 Mar 2023 14:56:05 GMT
cross-origin-resource-policy
same-origin
content-disposition
inline; filename="Nosto_sahkotuki (1).png"
content-length
15545
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed Mar 01 2023 07:02:58 GMT+0000 (Coordinated Universal Time)
cross-origin-opener-policy
same-origin
etag
W/"3cb9-vjUj1jJDjXc5hE5XuiAv61RTnoU"
x-frame-options
deny
vary
sec-fetch-site
content-type
image/png
cache-control
max-age=300, must-revalidate
keep-alive
timeout=5
expires
Sat Aug 12 9995 13:30:00 GMT+0000 (Coordinated Universal Time)

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackChunkkelafi_platform function| clearImmediate function| setImmediate number| __mobxInstanceCount object| __mobxGlobals

3 Cookies

Domain/Path Name / Value
www.kela.fi/ Name: 547216f17a12f830335fa450d4815df0
Value: 73bfcb5734a2e642782e1e5996ff3b4b
.www.kela.fi/ Name: KelaAA01d28664
Value: 018411a76263f05867ee2a274b6787fb07d49d8bfab7ad99f751a3d13ace7890f3d0b7cc4ef9d5fd6c9ac41cf2540d449ab92e6a6d496645d9dc82fbf37c5cee58ff66cb15
www.kela.fi/ Name: __Host-siteLanguage
Value: fi

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline' https://chattirobottipalvelu.kela.fi https://occhat.elisa.fi https://analytiikka.ahtp.fi; style-src 'self' https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi 'unsafe-inline'; img-src 'self' https://uutiskirje.kela.fi https://static.kela.fi https://occhat.elisa.fi data:; font-src 'self'; connect-src 'self' wss://occhat.elisa.fi https://occhat.elisa.fi https://chattirobottipalvelu.kela.fi https://laskurit.kela.fi https://analytiikka.ahtp.fi; frame-src 'self' https://video.kela.fi blob:
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny