owasp.org Open in urlscan Pro
2606:4700:10::6816:1a4d Public Scan

Go To Rescan
Add Verdict Report

URL:
https://owasp.org/www-project-secure-headers/
Submission: On August 18 via api (August 18th 2023, 3:56:51 am UTC) from US — Scanned from DE

Summary HTTP 38 Redirects Links 304 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 38 HTTP transactions. The main IP is 2606:4700:10::6816:1a4d, located in United States and belongs to CLOUDFLARENET, US. The main domain is owasp.org. The Cisco Umbrella rank of the primary domain is 150446.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 4th 2023. Valid for: a year.

This is the only time owasp.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	2606:4700:10:... 2606:4700:10::6816:1a4d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1	2606:50c0:800... 2606:50c0:8000::153	54113 (FASTLY) (FASTLY)
1	2606:4700:e4:... 2606:4700:e4::ac40:ae10	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	140.82.121.3 140.82.121.3	36459 (GITHUB) (GITHUB)
1	140.82.121.5 140.82.121.5	36459 (GITHUB) (GITHUB)
38	6

31 2606:4700:10::6816:1a4d (United States)

ASN13335 (CLOUDFLARENET, US)

owasp.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8000::153 (United States)

ASN54113 (FASTLY, US)

buttons.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:e4::ac40:ae10 (United States)

ASN13335 (CLOUDFLARENET, US)

img.shields.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 140.82.121.3 (Frankfurt am Main, Germany)

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-3-fra.github.com

github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 140.82.121.5 (Frankfurt am Main, Germany)

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-5-fra.github.com

api.github.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	owasp.org owasp.org — Cisco Umbrella Rank: 150446	754 KB
4	github.com github.com — Cisco Umbrella Rank: 2857 api.github.com — Cisco Umbrella Rank: 4774	16 KB
1	shields.io img.shields.io — Cisco Umbrella Rank: 45362	1 KB
1	github.io buttons.github.io — Cisco Umbrella Rank: 66204	7 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 62	21 KB
38	5

	Domain	Requested by
31	owasp.org	owasp.org
3	github.com	owasp.org
1	api.github.com	buttons.github.io
1	img.shields.io	owasp.org
1	buttons.github.io	owasp.org
1	www.google-analytics.com	owasp.org
38	6

This site contains links to these domains. Also see Links.

Domain
owasporg.atlassian.net
singapore.globalappsec.org
dc.globalappsec.org
members.owasp.org
owasp.us17.list-manage.com
www.youtube.com
www.owasp.org
github.com
wiki.owasp.org
www.apache.org
www.rfc-editor.org
developer.mozilla.org
www.chromium.org
tools.ietf.org
cheatsheetseries.owasp.org
en.wikipedia.org
hstspreload.org
raymii.org
blogs.windows.com
portswigger.net
blogs.msdn.microsoft.com
msdn.microsoft.com
www.w3.org
scotthelme.co.uk
report-uri.io
content-security-policy.com
report-uri.com
csp-evaluator.withgoogle.com
www.adobe.com
danielnixon.org
rorsecurity.info
gf.dev
w3c.github.io
www.chromestatus.com
html.spec.whatwg.org
caniuse.com
web.dev
xsleaks.dev
spectreattack.com
www.scip.ch
resourcepolicy.fyi
fetch.spec.whatwg.org
cwe.mitre.org
datatracker.ietf.org
www.permissionspolicy.com
labs.detectify.com
blog.qualys.com
groups.google.com
bugzilla.mozilla.org
www.virtuesecurity.com
www.veracode.com
zinoui.com
opencre.org
www.nginx.com
www.opencre.org
webtechsurvey.com
www.liferay.com
www.plesk.com
www.php.net
www.pega.com
varnish-cache.org
www.envoyproxy.io
zipkin.io
knative.dev
www.ibm.com
nextjs.org
ghostlulz.com
speakerdeck.com
securityheaders.com
observatory.mozilla.org
chrome.google.com
docs.spring.io
docs.nwebsec.com
docs.rs
stedolan.github.io
httpd.apache.org
nginx.org
redmine.lighttpd.net
docs.microsoft.com
jub0bs.com
cloud.gov
docs.aws.amazon.com
documentation.b2c.commercecloud.salesforce.com
www.blackhillsinfosec.com
www.progress.com
documentation.bloomreach.com
crashtest-security.com
help.tableau.com
docs.42crunch.com
help.sap.com
docs.secureauth.com
support.detectify.com
www.immuniweb.com
www.bloomberg.com
www.salesforce.com
blackbeltsec.com
contrastsecurity.com
www.epam.com
www.kpmg.com
www.tenable.com
coalfire.com
www.atlassian.com
grammarly.com
www.facebook.com
twitter.com
www.linkedin.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-04` - `2024-05-03`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-07-31` - `2023-10-23`	3 months	crt.sh
*.github.io DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-20`	a year	crt.sh
shields.io GTS CA 1P5	`2023-07-07` - `2023-10-05`	3 months	crt.sh
github.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-14` - `2024-03-14`	a year	crt.sh
*.github.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-16` - `2024-03-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://owasp.org/www-project-secure-headers/
Frame ID: 030E221CB15CE03E090E79D7AF715255
Requests: 38 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OWASP Secure Headers Project | OWASP Foundation

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

38
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

798 kB
Transfer

1216 kB
Size

0
Cookies

304 Outgoing links

These are links going to different origins than the main page.

URL: https://owasporg.atlassian.net/servicedesk/customer/portal/7/create/70?src=-1419759666
Title: Start a New Project...

Search URL Search Domain Scan URL

URL: https://owasporg.atlassian.net/servicedesk/customer/portal/8/group/20/create/90?src=-1419759666
Title: Start a Local Chapter...

Search URL Search Domain Scan URL

URL: https://singapore.globalappsec.org/
Title: OWASP Global AppSec Singapore 2023

Search URL Search Domain Scan URL

URL: https://dc.globalappsec.org/
Title: OWASP Global AppSec DC 2023

Search URL Search Domain Scan URL

URL: https://members.owasp.org/
Title: Membership Portal

Search URL Search Domain Scan URL

URL: https://owasp.us17.list-manage.com/subscribe?u=a8012c9e2e384bf8ea8d7deb7&id=22be76c892
Title: Subscribe to our Mailing List

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/OWASPGLOBAL/videos
Title: Video

Search URL Search Domain Scan URL

URL: https://www.owasp.org/projects

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml

Search URL Search Domain Scan URL

URL: https://github.com/oshp/oshp-validator
Title: Tools

Search URL Search Domain Scan URL

URL: https://github.com/oshp/oshp-stats
Title: Statistics

Search URL Search Domain Scan URL

URL: https://github.com/oshp/
Title: GitHub organization

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=N4F3VWQYU9E
Title: OWASP Spotlight Youtube playlists

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=0SNU9clVhKU
Title: Application Security Podcast Youtube playlists

Search URL Search Domain Scan URL

URL: https://wiki.owasp.org/index.php/OWASP_Secure_Headers_Project
Title: old website

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers
Title: GitHub OWASP organization

Search URL Search Domain Scan URL

URL: https://github.com/oshp/headers
Title: headers

Search URL Search Domain Scan URL

URL: https://github.com/oshp/headers-ui-container
Title: headers-ui-container

Search URL Search Domain Scan URL

URL: https://github.com/ovh/venom
Title: venom

Search URL Search Domain Scan URL

URL: https://github.com/oshp/oshp-validator#tests-suite-mock-service
Title: here

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/blob/master/monitoring_technical_references_dashboard.md
Title: dashboard

Search URL Search Domain Scan URL

URL: https://github.com/oshp/oshp-tracking/discussions
Title: discussions feature

Search URL Search Domain Scan URL

URL: https://github.com/orgs/oshp/projects/2
Title: project feature

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/commits/master.atom
Title: atom web feed

Search URL Search Domain Scan URL

URL: https://github.com/adamaveray
Title: Adam Averay

Search URL Search Domain Scan URL

URL: https://github.com/jmanico
Title: Jim Manico

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/graphs/contributors
Title: page

Search URL Search Domain Scan URL

URL: https://www.apache.org/licenses/LICENSE-2.0
Title: Apache 2.0 License

Search URL Search Domain Scan URL

URL: https://www.rfc-editor.org/rfc/rfc6797
Title: RFC 6797

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#description
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#preloading_strict_transport_security
Title: preload

Search URL Search Domain Scan URL

URL: https://www.chromium.org/hsts/
Title: preload list

Search URL Search Domain Scan URL

URL: https://tools.ietf.org/html/rfc6797
Title: https://tools.ietf.org/html/rfc6797

Search URL Search Domain Scan URL

URL: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
Title: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
Title: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Search URL Search Domain Scan URL

URL: https://www.chromium.org/hsts
Title: https://www.chromium.org/hsts

Search URL Search Domain Scan URL

URL: https://hstspreload.org/
Title: https://hstspreload.org/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
Title: https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security

Search URL Search Domain Scan URL

URL: https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html
Title: https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html

Search URL Search Domain Scan URL

URL: https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/
Title: https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/

Search URL Search Domain Scan URL

URL: https://portswigger.net/web-security/clickjacking
Title: clickjacking

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors
Title: frame-ancestors

Search URL Search Domain Scan URL

URL: https://tools.ietf.org/html/rfc7034
Title: https://tools.ietf.org/html/rfc7034

Search URL Search Domain Scan URL

URL: https://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01
Title: https://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01

Search URL Search Domain Scan URL

URL: https://tools.ietf.org/html/draft-ietf-websec-frame-options-00
Title: https://tools.ietf.org/html/draft-ietf-websec-frame-options-00

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
Title: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

Search URL Search Domain Scan URL

URL: https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/
Title: https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us/library/gg622941%28v=vs.85%29.aspx
Title: https://msdn.microsoft.com/en-us/library/gg622941%28v=vs.85%29.aspx

Search URL Search Domain Scan URL

URL: https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-part-vi-beta-2-update/
Title: https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-part-vi-beta-2-update/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
Title: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

Search URL Search Domain Scan URL

URL: https://www.w3.org/TR/CSP/
Title: https://www.w3.org/TR/CSP/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/Security/CSP
Title: https://developer.mozilla.org/en-US/docs/Web/Security/CSP

Search URL Search Domain Scan URL

URL: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
Title: https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

Search URL Search Domain Scan URL

URL: https://scotthelme.co.uk/content-security-policy-an-introduction/
Title: https://scotthelme.co.uk/content-security-policy-an-introduction/

Search URL Search Domain Scan URL

URL: https://report-uri.io/
Title: https://report-uri.io

Search URL Search Domain Scan URL

URL: https://content-security-policy.com/
Title: https://content-security-policy.com

Search URL Search Domain Scan URL

URL: https://report-uri.com/home/generate
Title: https://report-uri.com/home/generate

Search URL Search Domain Scan URL

URL: https://csp-evaluator.withgoogle.com/
Title: https://csp-evaluator.withgoogle.com/

Search URL Search Domain Scan URL

URL: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html
Title: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html

Search URL Search Domain Scan URL

URL: https://danielnixon.org/http-security-headers/
Title: https://danielnixon.org/http-security-headers/

Search URL Search Domain Scan URL

URL: https://rorsecurity.info/portfolio/new-http-headers-for-more-security
Title: https://rorsecurity.info/portfolio/new-http-headers-for-more-security

Search URL Search Domain Scan URL

URL: https://github.com/twitter/secureheaders/issues/88
Title: https://github.com/twitter/secureheaders/issues/88

Search URL Search Domain Scan URL

URL: https://gf.dev/cross-domain-policy-test
Title: https://gf.dev/cross-domain-policy-test

Search URL Search Domain Scan URL

URL: https://www.w3.org/TR/referrer-policy/
Title: https://www.w3.org/TR/referrer-policy/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
Title: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://w3c.github.io/webappsec-clear-site-data/
Title: https://w3c.github.io/webappsec-clear-site-data/

Search URL Search Domain Scan URL

URL: https://www.chromestatus.com/feature/4713262029471744
Title: https://www.chromestatus.com/feature/4713262029471744

Search URL Search Domain Scan URL

URL: https://github.com/w3c/webappsec-clear-site-data
Title: https://github.com/w3c/webappsec-clear-site-data

Search URL Search Domain Scan URL

URL: https://github.com/w3c/webappsec-clear-site-data/tree/master/demo
Title: https://github.com/w3c/webappsec-clear-site-data/tree/master/demo

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
Title: CORS

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)
Title: Cross-Origin-Resource-Policy

Search URL Search Domain Scan URL

URL: https://html.spec.whatwg.org/multipage/origin.html#coep
Title: https://html.spec.whatwg.org/multipage/origin.html#coep

Search URL Search Domain Scan URL

URL: https://caniuse.com/?search=Cross-Origin-Embedder-Policy
Title: https://caniuse.com/?search=Cross-Origin-Embedder-Policy

Search URL Search Domain Scan URL

URL: https://web.dev/coop-coep/
Title: https://web.dev/coop-coep/

Search URL Search Domain Scan URL

URL: https://web.dev/why-coop-coep/
Title: https://web.dev/why-coop-coep/

Search URL Search Domain Scan URL

URL: https://web.dev/cross-origin-isolation-guide/
Title: https://web.dev/cross-origin-isolation-guide/

Search URL Search Domain Scan URL

URL: https://xsleaks.dev/
Title: XS-Leaks

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies
Title: https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policies

Search URL Search Domain Scan URL

URL: https://github.com/xsleaks/xsleaks
Title: https://github.com/xsleaks/xsleaks

Search URL Search Domain Scan URL

URL: https://portswigger.net/daily-swig/xs-leak
Title: https://portswigger.net/daily-swig/xs-leak

Search URL Search Domain Scan URL

URL: https://portswigger.net/research/xs-leak-detecting-ids-using-portal
Title: https://portswigger.net/research/xs-leak-detecting-ids-using-portal

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Side-channel_attack
Title: side-channel attacks

Search URL Search Domain Scan URL

URL: https://spectreattack.com/
Title: Spectre

Search URL Search Domain Scan URL

URL: https://www.scip.ch/en/?labs.20160414
Title: Cross-Site Script Inclusion (XSSI)

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Glossary/Site
Title: Site

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Glossary/Origin
Title: Origin

Search URL Search Domain Scan URL

URL: https://resourcepolicy.fyi/#corp-and-isolation
Title: CORP header is not specified

Search URL Search Domain Scan URL

URL: https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header
Title: https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

Search URL Search Domain Scan URL

URL: https://resourcepolicy.fyi/
Title: https://resourcepolicy.fyi/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://cwe.mitre.org/data/definitions/525.html
Title: exposure of information via the cache

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expires
Title: Expires

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma
Title: Pragma

Search URL Search Domain Scan URL

URL: https://datatracker.ietf.org/doc/html/rfc7234
Title: HTTP caching standards document

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#browser_compatibility
Title: table

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching
Title: https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching

Search URL Search Domain Scan URL

URL: https://cwe.mitre.org/data/definitions/524.html
Title: https://cwe.mitre.org/data/definitions/524.html

Search URL Search Domain Scan URL

URL: https://portswigger.net/web-security/web-cache-poisoning
Title: https://portswigger.net/web-security/web-cache-poisoning

Search URL Search Domain Scan URL

URL: https://portswigger.net/research/practical-web-cache-poisoning
Title: https://portswigger.net/research/practical-web-cache-poisoning

Search URL Search Domain Scan URL

URL: https://portswigger.net/research/web-cache-entanglement
Title: https://portswigger.net/research/web-cache-entanglement

Search URL Search Domain Scan URL

URL: https://www.chromestatus.com/feature/5745992911552512
Title: Chrome platform status

Search URL Search Domain Scan URL

URL: https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md
Title: page

Search URL Search Domain Scan URL

URL: https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md
Title: https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#directives
Title: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy#directives

Search URL Search Domain Scan URL

URL: https://caniuse.com/permissions-policy
Title: https://caniuse.com/permissions-policy

Search URL Search Domain Scan URL

URL: https://www.w3.org/TR/permissions-policy-1/
Title: https://www.w3.org/TR/permissions-policy-1/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
Title: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy

Search URL Search Domain Scan URL

URL: https://www.permissionspolicy.com/
Title: https://www.permissionspolicy.com/

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Feature_Policy
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://w3c.github.io/webappsec-feature-policy/
Title: https://w3c.github.io/webappsec-feature-policy/

Search URL Search Domain Scan URL

URL: https://scotthelme.co.uk/a-new-security-header-feature-policy/
Title: https://scotthelme.co.uk/a-new-security-header-feature-policy/

Search URL Search Domain Scan URL

URL: https://github.com/w3c/webappsec-feature-policy/blob/master/features.md
Title: https://github.com/w3c/webappsec-feature-policy/blob/master/features.md

Search URL Search Domain Scan URL

URL: https://caniuse.com/feature-policy
Title: https://caniuse.com/feature-policy

Search URL Search Domain Scan URL

URL: https://www.chromestatus.com/feature/5677171733430272
Title: source

Search URL Search Domain Scan URL

URL: https://datatracker.ietf.org/doc/html/rfc9163
Title: Expect-CT Extension for HTTP

Search URL Search Domain Scan URL

URL: https://scotthelme.co.uk/a-new-security-header-expect-ct/
Title: https://scotthelme.co.uk/a-new-security-header-expect-ct/

Search URL Search Domain Scan URL

URL: https://scotthelme.co.uk/using-security-features-to-do-bad-things/
Title: HPKP Suicide and Ransom PKP

Search URL Search Domain Scan URL

URL: https://tools.ietf.org/html/rfc7469
Title: https://tools.ietf.org/html/rfc7469

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
Title: https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning
Title: https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning

Search URL Search Domain Scan URL

URL: https://raymii.org/s/articles/HTTP_Public_Key_Pinning_Extension_HPKP.html
Title: https://raymii.org/s/articles/HTTP_Public_Key_Pinning_Extension_HPKP.html

Search URL Search Domain Scan URL

URL: https://labs.detectify.com/2016/07/05/what-hpkp-is-but-isnt/
Title: https://labs.detectify.com/2016/07/05/what-hpkp-is-but-isnt/

Search URL Search Domain Scan URL

URL: https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead
Title: https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead

Search URL Search Domain Scan URL

URL: https://scotthelme.co.uk/im-giving-up-on-hpkp/
Title: https://scotthelme.co.uk/im-giving-up-on-hpkp/

Search URL Search Domain Scan URL

URL: https://groups.google.com/a/chromium.org/forum/m/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ
Title: https://groups.google.com/a/chromium.org/forum/m/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ

Search URL Search Domain Scan URL

URL: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
Title: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Search URL Search Domain Scan URL

URL: https://www.chromestatus.com/feature/5021976655560704
Title: https://www.chromestatus.com/feature/5021976655560704

Search URL Search Domain Scan URL

URL: https://bugzilla.mozilla.org/show_bug.cgi?id=528661
Title: https://bugzilla.mozilla.org/show_bug.cgi?id=528661

Search URL Search Domain Scan URL

URL: https://blogs.windows.com/windowsexperience/2018/07/25/announcing-windows-10-insider-preview-build-17723-and-build-18204/
Title: https://blogs.windows.com/windowsexperience/2018/07/25/announcing-windows-10-insider-preview-build-17723-and-build-18204/

Search URL Search Domain Scan URL

URL: https://github.com/zaproxy/zaproxy/issues/5849
Title: https://github.com/zaproxy/zaproxy/issues/5849

Search URL Search Domain Scan URL

URL: https://scotthelme.co.uk/security-headers-updates/#removing-the-x-xss-protection-header
Title: https://scotthelme.co.uk/security-headers-updates/#removing-the-x-xss-protection-header

Search URL Search Domain Scan URL

URL: https://portswigger.net/daily-swig/google-chromes-xss-auditor-goes-back-to-filter-mode
Title: https://portswigger.net/daily-swig/google-chromes-xss-auditor-goes-back-to-filter-mode

Search URL Search Domain Scan URL

URL: https://www.virtuesecurity.com/blog/understanding-xss-auditor/
Title: https://www.virtuesecurity.com/blog/understanding-xss-auditor/

Search URL Search Domain Scan URL

URL: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers
Title: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers

Search URL Search Domain Scan URL

URL: https://zinoui.com/blog/security-http-headers#x-xss-protection
Title: http://zinoui.com/blog/security-http-headers#x-xss-protection

Search URL Search Domain Scan URL

URL: https://caniuse.com/stricttransportsecurity
Title: https://caniuse.com/stricttransportsecurity

Search URL Search Domain Scan URL

URL: https://caniuse.com/x-frame-options
Title: https://caniuse.com/x-frame-options

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_x-content-type-options
Title: https://caniuse.com/mdn-http_headers_x-content-type-options

Search URL Search Domain Scan URL

URL: https://caniuse.com/?search=content-security-policy
Title: https://caniuse.com/?search=content-security-policy

Search URL Search Domain Scan URL

URL: https://caniuse.com/referrer-policy
Title: https://caniuse.com/referrer-policy

Search URL Search Domain Scan URL

URL: https://caniuse.com/publickeypinning
Title: https://caniuse.com/publickeypinning

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_expect-ct
Title: https://caniuse.com/mdn-http_headers_expect-ct

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_x-xss-protection
Title: https://caniuse.com/mdn-http_headers_x-xss-protection

Search URL Search Domain Scan URL

URL: https://caniuse.com/?search=Clear-Site-Data
Title: https://caniuse.com/?search=Clear-Site-Data

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy
Title: https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_cross-origin-opener-policy
Title: https://caniuse.com/mdn-http_headers_cross-origin-opener-policy

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_cross-origin-resource-policy
Title: https://caniuse.com/mdn-http_headers_cross-origin-resource-policy

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_cache-control
Title: https://caniuse.com/mdn-http_headers_cache-control

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_pragma
Title: https://caniuse.com/mdn-http_headers_pragma

Search URL Search Domain Scan URL

URL: https://opencre.org/cre/636-347?name=OWASP+Secure+Headers+Project&section=configuration&link=https%3A%2F%2Fowasp.org%2Fwww-project-secure-headers%2F%23div-bestpractices
Title: OpenCRE

Search URL Search Domain Scan URL

URL: https://cwe.mitre.org/data/definitions/200.html
Title: disclosure of technical information

Search URL Search Domain Scan URL

URL: https://www.nginx.com/resources/glossary/reverse-proxy-server/
Title: reverse proxy

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Web_application_firewall
Title: web application firewall

Search URL Search Domain Scan URL

URL: https://www.opencre.org/cre/403-005?name=OWASP+Secure+Headers+Project&section=Prevent+information+disclosure+via+HTTP+headers&link=https%3A%2F%2Fowasp.org%2Fwww-project-secure-headers%2F%23div-bestpractices_prevent-information-disclosure-via-http-headers
Title: OpenCRE

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/
Title: WebTechSurvey

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/server
Title: Server

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/liferay-portal
Title: Liferay-Portal

Search URL Search Domain Scan URL

URL: https://www.liferay.com/
Title: Liferay

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-turbo-charged-by
Title: X-Turbo-Charged-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-powered-by
Title: X-Powered-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-server-powered-by
Title: X-Server-Powered-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-powered-cms
Title: X-Powered-CMS

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Content_management_system
Title: CMS

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/SourceMap
Title: SourceMap

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Tools/Debugger/How_to/Use_a_source_map
Title: source map

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-aspnetmvc-version
Title: X-AspNetMvc-Version

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-aspnet-version
Title: X-AspNet-Version

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-sourcefiles
Title: X-SourceFiles

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-redirect-by
Title: X-Redirect-By

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/List_of_HTTP_header_fields
Title: Wikipedia

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-generator
Title: X-Generator

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-generated-by
Title: X-Generated-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-cms
Title: X-CMS

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-powered-by-plesk
Title: X-Powered-By-Plesk

Search URL Search Domain Scan URL

URL: https://www.plesk.com/
Title: Plesk

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-php-version
Title: X-Php-Version

Search URL Search Domain Scan URL

URL: https://www.php.net/
Title: PHP

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/powered-by
Title: Powered-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-content-encoded-by
Title: X-Content-Encoded-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/product
Title: Product

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-cf-powered-by
Title: X-CF-Powered-By

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-framework
Title: X-Framework

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/host-header
Title: Host-Header

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/pega-host
Title: Pega-Host

Search URL Search Domain Scan URL

URL: https://www.pega.com/
Title: PEGA

Search URL Search Domain Scan URL

URL: https://github.com/Atmosphere/atmosphere
Title: X-Atmosphere-first-request

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-mod-pagespeed
Title: X-Mod-Pagespeed

Search URL Search Domain Scan URL

URL: https://github.com/apache/incubator-pagespeed-mod
Title: mod_pagespeed

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-page-speed
Title: X-Page-Speed

Search URL Search Domain Scan URL

URL: https://github.com/apache/incubator-pagespeed-ngx
Title: mod_pagespeed

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-varnish-backend
Title: X-Varnish-Backend

Search URL Search Domain Scan URL

URL: https://varnish-cache.org/
Title: Varnish

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-varnish-server
Title: X-Varnish-Server

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-envoy-upstream-service-time
Title: X-Envoy-Upstream-Service-Time

Search URL Search Domain Scan URL

URL: https://www.envoyproxy.io/
Title: Envoy

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-envoy-attempt-count
Title: X-Envoy-Attempt-Count

Search URL Search Domain Scan URL

URL: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers
Title: X-Envoy-External-Address

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-b3-parentspanid
Title: X-B3-ParentSpanId

Search URL Search Domain Scan URL

URL: https://zipkin.io/
Title: Zipkin

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-b3-sampled
Title: X-B3-Sampled

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-b3-spanid
Title: X-B3-SpanId

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-b3-traceid
Title: X-B3-TraceId

Search URL Search Domain Scan URL

URL: https://knative.dev/docs/serving/istio-authorization/
Title: K-Proxy-Request

Search URL Search Domain Scan URL

URL: https://knative.dev/
Title: Knative

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-old-content-length
Title: X-Old-Content-Length

Search URL Search Domain Scan URL

URL: https://www.ibm.com/docs/en/sva/8.0.1?topic=responses-filtering-changes-content-length-header
Title: WebSEAL

Search URL Search Domain Scan URL

URL: https://www.ibm.com/docs/en/was/8.5.5?topic=SSEQTP_8.5.5/com.ibm.websphere.nd.multiplatform.doc/ae/rweb_custom_props.htm
Title: $wsep

Search URL Search Domain Scan URL

URL: https://www.ibm.com/products/websphere-application-server
Title: WebSphere Application Server

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-nextjs-matched-path
Title: X-Nextjs-Matched-Path

Search URL Search Domain Scan URL

URL: https://nextjs.org/
Title: Next.js

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-nextjs-page
Title: X-Nextjs-Page

Search URL Search Domain Scan URL

URL: https://webtechsurvey.com/response-header/x-nextjs-cache
Title: X-Nextjs-Cache

Search URL Search Domain Scan URL

URL: https://github.com/search?q=repo%3Avercel%2Fnext.js%20X-Nextjs-Redirect&type=code
Title: X-Nextjs-Redirect

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Disposition
Title: Content-Disposition

Search URL Search Domain Scan URL

URL: http://ghostlulz.com/xss-svg/
Title: SVG file

Search URL Search Domain Scan URL

URL: https://portswigger.net/web-security/cross-site-scripting/stored
Title: stored cross-site scripting

Search URL Search Domain Scan URL

URL: https://speakerdeck.com/righettod/trap-bad-guys-in-your-browser-with-http-security-headers
Title: Trap bad guys in your browser with HTTP security headers

Search URL Search Domain Scan URL

URL: https://github.com/riramar/hsecscan
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/rfc-st/humble
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://securityheaders.com/
Title: 🌎

Search URL Search Domain Scan URL

URL: https://observatory.mozilla.org/
Title: 🌎

Search URL Search Domain Scan URL

URL: https://github.com/mozilla/http-observatory/
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/mozilla/http-observatory-website/
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://chrome.google.com/webstore/detail/recx-security-analyser/ljafjhbjenhgcgnikniijchkngljgjda
Title: 🌎

Search URL Search Domain Scan URL

URL: https://github.com/drwetter/testssl.sh
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/Santandersecurityresearch/DrHeader
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/google/csp-evaluator
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://docs.spring.io/spring-security/reference/features/exploits/headers.html
Title: 🌎

Search URL Search Domain Scan URL

URL: https://docs.nwebsec.com/
Title: 🌎

Search URL Search Domain Scan URL

URL: https://github.com/andrewlock/NetEscapades.AspNetCore.SecurityHeaders
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/GaProgMan/OwaspHeaders.Core
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/github/secure_headers
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/aidantwoods/SecureHeaders
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/bepsvpt/secure-headers
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/frodsan/rack-secure_headers
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/helmetjs/helmet
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/rwjblue/ember-cli-content-security-policy/
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/nlf/blankie
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/mozilla/django-csp
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/sdelements/django-security
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/TypeError/secure
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://github.com/goddtriffin/helmet
Title: 👩‍💻

Search URL Search Domain Scan URL

URL: https://docs.rs/crate/owasp-headers/latest
Title: 🌎

Search URL Search Domain Scan URL

URL: https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#appendix-big-changes-since-this-was-called-feature-policy
Title: one

Search URL Search Domain Scan URL

URL: https://stedolan.github.io/jq/
Title: jq

Search URL Search Domain Scan URL

URL: https://httpd.apache.org/docs/current/mod/mod_headers.html
Title: https://httpd.apache.org/docs/current/mod/mod_headers.html

Search URL Search Domain Scan URL

URL: https://nginx.org/en/docs/http/ngx_http_headers_module.html
Title: https://nginx.org/en/docs/http/ngx_http_headers_module.html

Search URL Search Domain Scan URL

URL: https://redmine.lighttpd.net/projects/lighttpd/wiki/Mod_setenv
Title: https://redmine.lighttpd.net/projects/lighttpd/wiki/Mod_setenv

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/iis/configuration/system.webserver/httpprotocol/customheaders
Title: https://docs.microsoft.com/en-us/iis/configuration/system.webserver/httpprotocol/customheaders

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name
Title: forbidden header names

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://xsleaks.dev/docs/defenses/opt-in/fetch-metadata/
Title: XS-Leaks

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest#directives
Title: here

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/API/Request/mode
Title: mode

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode#directives
Title: here

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site#directives
Title: here

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site
Title: Mozilla MDN

Search URL Search Domain Scan URL

URL: https://web.dev/same-site-same-origin/
Title: here

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_sec-fetch-dest
Title: https://caniuse.com/mdn-http_headers_sec-fetch-dest

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_sec-fetch-mode
Title: https://caniuse.com/mdn-http_headers_sec-fetch-mode

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_sec-fetch-user
Title: https://caniuse.com/mdn-http_headers_sec-fetch-user

Search URL Search Domain Scan URL

URL: https://caniuse.com/mdn-http_headers_sec-fetch-site
Title: https://caniuse.com/mdn-http_headers_sec-fetch-site

Search URL Search Domain Scan URL

URL: https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/#are-site-and-origin-interchangeable
Title: https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/#are-site-and-origin-interchangeable

Search URL Search Domain Scan URL

URL: https://portswigger.net/daily-swig/firefox-becomes-latest-browser-to-support-fetch-metadata-request-headers
Title: https://portswigger.net/daily-swig/firefox-becomes-latest-browser-to-support-fetch-metadata-request-headers

Search URL Search Domain Scan URL

URL: https://cloud.gov/docs/management/headers/
Title: Cloud.gov

Search URL Search Domain Scan URL

URL: https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/improving-security-by-enabling-security-specific-headers.html
Title: Amazon AWS

Search URL Search Domain Scan URL

URL: https://documentation.b2c.commercecloud.salesforce.com/DOC1/topic/com.demandware.dochelp/content/b2c_commerce/topics/b2c_security_best_practices/b2c_declarative_security_via_http_headers.html?resultof=%22%68%65%61%64%65%72%73%22%20%22%68%65%61%64%65%72%22%20
Title: Salesforce

Search URL Search Domain Scan URL

URL: https://www.blackhillsinfosec.com/fixing-content-security-policies-with-cloudflare-workers/
Title: Black Hills Information Security

Search URL Search Domain Scan URL

URL: https://www.progress.com/documentation/sitefinity-cms/110/predefined-security-headers-in-http-response
Title: Progress

Search URL Search Domain Scan URL

URL: https://documentation.bloomreach.com/14/library/concepts/security/configure-security-response-headers.html
Title: Bloomreach

Search URL Search Domain Scan URL

URL: https://crashtest-security.com/enable-security-headers/
Title: CrashTest Security

Search URL Search Domain Scan URL

URL: https://help.tableau.com/current/server-linux/en-us/security_http_headers.htm
Title: Tableau

Search URL Search Domain Scan URL

URL: https://docs.42crunch.com/latest/content/extras/protection_security_headers.htm
Title: 42Crunch

Search URL Search Domain Scan URL

URL: https://help.sap.com/docs/SAP_UPSCALE_COMMERCE/4620dd88ff9047c89ffb7fa897207a46/30af09ca9e394505a85661fa530d1263.html
Title: SAP

Search URL Search Domain Scan URL

URL: https://docs.secureauth.com/2104/en/identity-platform-http-security-header-best-practices.html
Title: SecureAuth

Search URL Search Domain Scan URL

URL: https://support.detectify.com/support/solutions/articles/48001048949-https-stripping
Title: Detectify

Search URL Search Domain Scan URL

URL: https://www.immuniweb.com/websec/about
Title: ImmuniWeb

Search URL Search Domain Scan URL

URL: https://github.com/nmap/nmap/blob/master/scripts/http-security-headers.nse
Title: Nmap

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/www-project-secure-headers/blob/master/index.md
Title: Edit on GitHub

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/owasp-swag/tree/master/projects/secure-headers-project
Title: OWASP Swag repository

Search URL Search Domain Scan URL

URL: https://www.bloomberg.com/company/values/tech-at-bloomberg/

Search URL Search Domain Scan URL

URL: https://www.salesforce.com/

Search URL Search Domain Scan URL

URL: https://blackbeltsec.com/

Search URL Search Domain Scan URL

URL: http://contrastsecurity.com/

Search URL Search Domain Scan URL

URL: http://www.epam.com/

Search URL Search Domain Scan URL

URL: http://www.kpmg.com/us/cyber

Search URL Search Domain Scan URL

URL: https://www.tenable.com/

Search URL Search Domain Scan URL

URL: http://coalfire.com/

Search URL Search Domain Scan URL

URL: http://www.atlassian.com/trust

Search URL Search Domain Scan URL

URL: http://grammarly.com/security

Search URL Search Domain Scan URL

URL: https://github.com/OWASP/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OWASPFoundation

Search URL Search Domain Scan URL

URL: https://twitter.com/owasp

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/owasp/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/OWASPGLOBAL

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

38 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
owasp.org/www-project-secure-headers/ 176 KB
41 KB 188ms
144ms Document
text/html 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45512d9190b06b08f5bf539745d388ea399690fb8c28986800de83fd3bf6b76e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 0
cache-control: max-age=600
cf-cache-status: DYNAMIC
cf-ray: 7f873a8fa8005c62-FRA
content-encoding: br
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
content-type: text/html; charset=utf-8
date: Fri, 18 Aug 2023 03:56:45 GMT
expires: Fri, 18 Aug 2023 04:06:45 GMT
last-modified: Sun, 13 Aug 2023 00:06:23 GMT
permissions-policy: geolocation=(self)
referrer-policy: same-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-fastly-request-id: 6cf18e86512c2a32385139de51ac02dfd7e72978
x-frame-options: SAMEORIGIN
x-github-request-id: 19FE:83A0:2445822:2513906:64DEEBFD
x-proxy-cache: MISS
x-served-by: cache-fra-eddf8230103-FRA
x-timer: S1692331005.405669,VS0,VE105

GET
H2 200 js.cookie.js Show response
owasp.org/www--site-theme/assets/js/ 4 KB
2 KB 136ms
131ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/js/js.cookie.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

357c0ad66cf329f64d356786a5dd19700f8b4498b283db0922e374e68e544298

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 9021b8aa508e11fb86eddbe26cdf8457a6112ba7
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:29 GMT
x-served-by: cache-fra-eddf8230085-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: A55E:CD65:E8C011:EE1D39:64DBB95D
x-timer: S1692121438.469698,VS0,VE2
etag: W/"64dbb859-fce"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a9098975c62-FRA
x-cache-hits: 1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 47ms
7ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 18 Aug 2023 03:49:43 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 422
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Fri, 18 Aug 2023 05:49:43 GMT

GET
H2 200 styles.css
owasp.org/www--site-theme/assets/css/ 128 KB
26 KB 39ms
34ms Stylesheet
text/css 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/css/styles.css

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea313025ebfe6e5677fceab5f9bfa510ec1f4da1312358339f00b0d26f45a447

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: ad16c59c59af5eb23a78bbdf5ff3e243830bed15
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:30 GMT
x-served-by: cache-fra-eddf8230134-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:44 GMT
server: cloudflare
x-github-request-id: 67B2:1251:E45DEF:E9BED5:64DBBA2C
x-timer: S1692121966.392882,VS0,VE3
etag: W/"64dbb860-1fe9b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a9098955c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 jquery-3.4.1.min.js Show response
owasp.org/www--site-theme/assets/js/ 86 KB
31 KB 38ms
33ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/js/jquery-3.4.1.min.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 0453aff7dd93352c4c156beb7cbb27d6054c6f8b
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:30 GMT
x-served-by: cache-fra-eddf8230069-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: 41FE:EA2B:E2F684:E8580D:64DBB95D
x-timer: S1692121438.257301,VS0,VE2
etag: W/"64dbb859-15851"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a9098985c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 util.js Show response
owasp.org/www--site-theme/assets/js/ 2 KB
1 KB 29ms
25ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/js/util.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbe2121765e2f3e921a42bcb9b0c78635b68cee1dccd1b1ec31089b9382ff514

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: c2edb53dc455ef23984c6ce99ac7809076cafeb0
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
age: 205
x-cache: HIT
x-proxy-cache: MISS
expires: Fri, 18 Aug 2023 04:02:43 GMT
x-served-by: cache-fra-eddf8230076-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: BBC0:BD1A:E4D8C7:EA3C19:64DBB95D
x-timer: S1692121438.305175,VS0,VE2
etag: W/"64dbb859-89b"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a9098995c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 yaml.min.js Show response
owasp.org/www--site-theme/assets/js/ 42 KB
11 KB 40ms
36ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/js/yaml.min.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8ccdf0e45f181fc04f0d202779fff71aa76f27f0428a792e0e6f13fe1d0b085

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 844db48fd36a75d0f04cbea108aae3ded2c196f7
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:30 GMT
x-served-by: cache-fra-eddf8230067-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: CB94:B787:A38C8E:A75787:64DBB95C
x-timer: S1692121438.212875,VS0,VE3
etag: W/"64dbb859-a944"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a90a89a5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 luxon.min.js Show response
owasp.org/www--site-theme/assets/js/ 68 KB
21 KB 127ms
123ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/js/luxon.min.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f46950820ce4e5032d2519c3b0c2a73f48b64071b5efd95b7f52d3755f69d3ce

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 85bf68564c8d9d528bba1c35ee8e3f8338f4a6dd
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:31 GMT
x-served-by: cache-fra-eddf8230053-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: 7886:61CC:E21726:E7741E:64DBB95D
x-timer: S1692121438.213889,VS0,VE1
etag: W/"64dbb859-111e3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a90a89b5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 kjua.min.js Show response
owasp.org/www--site-theme/assets/js/ 28 KB
12 KB 134ms
130ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/js/kjua.min.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53d3b023092e049484c4e39ce6f50d1b8dd10074795e66da06e1140792a91d9a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 5d73bc4f7fe7dff8ed20ec08ab12b6f0cbbb2055
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:04:23 GMT
x-served-by: cache-fra-eddf8230094-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: 1236:E398:EDAD0E:F30E97:64DBB95D
x-timer: S1692121438.223158,VS0,VE2
etag: W/"64dbb859-6f0d"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a90a89c5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 buttons.js Show response
buttons.github.io/ 19 KB
7 KB 45ms
5ms Script
application/javascript 2606:50c0:8000::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://buttons.github.io/buttons.js
Requested by: Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8000::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 0738580e85e7fdef026f377d497b2791985a1b161bb9b573ed15798e1d91ea48

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 459eb70b859154dbed98859f5a40630065deaf03
date: Fri, 18 Aug 2023 03:56:45 GMT
content-encoding: gzip
via: 1.1 varnish
x-cache-hits: 2
age: 118
x-cache: HIT
x-proxy-cache: HIT
content-length: 6828
x-served-by: cache-fra-eddf8230087-FRA
last-modified: Mon, 14 Aug 2023 15:05:27 GMT
server: GitHub.com
x-github-request-id: DFA4:E125:25EFAEA:26DCA72:64DA4380
x-timer: S1692331006.755942,VS0,VE0
etag: W/"64da42b7-4d5e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
expires: Mon, 14 Aug 2023 15:18:48 GMT

GET
H2 200 logo.png
owasp.org/assets/images/ 11 KB
12 KB 131ms
130ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/logo.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8902e5836a324eae0ab281a9be7d62683e025d503ce6778cce6768fb908c1089

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 95bbd4fa39796fb8c6afe551cf80b5d02726e1b9
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:04:54 GMT
content-length: 11091
x-served-by: cache-fra-eddf8230105-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:58 GMT
server: cloudflare
x-github-request-id: 15B6:E398:2FBF7D2:30D23D4:64DEEBB5
x-timer: S1692331006.740787,VS0,VE97
etag: "64dee9ee-2b53"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a91b95d5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 direct-link-handler.js Show response
owasp.org/www-project-secure-headers/assets/js/ 2 KB
2 KB 127ms
126ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www-project-secure-headers/assets/js/direct-link-handler.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2396036f7419d686ba86e291d3166b71b9f4fa52640cd224d119b16da1da24c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://owasp.org/www-project-secure-headers/
Origin: https://owasp.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 061d138ccd42a5d6fb99b154a172eee32987f573
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: HIT
expires: Fri, 18 Aug 2023 04:06:45 GMT
x-served-by: cache-fra-eddf8230043-FRA
referrer-policy: same-origin
last-modified: Sun, 13 Aug 2023 00:06:15 GMT
server: cloudflare
x-github-request-id: 0AF0:61CC:160F7F4:1695EE0:64DC8BF7
x-timer: S1692189284.677502,VS0,VE1
etag: W/"64d81e77-883"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a91792a5c62-FRA
x-cache-hits: 1

GET
H2 200 styles.css
owasp.org/www-project-secure-headers/assets/css/ 145 B
386 B 129ms
128ms Stylesheet
text/css 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www-project-secure-headers/assets/css/styles.css

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d1b23f8a47d2603cae545df2f5e0d6a410531f9c2d3349080c7c875c2e751bb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 72e0e2f46af14d1eb50422f08f1aa03063232622
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: REVALIDATED
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: HIT
expires: Fri, 18 Aug 2023 04:06:45 GMT
x-served-by: cache-fra-eddf8230049-FRA
referrer-policy: same-origin
last-modified: Sun, 13 Aug 2023 00:06:15 GMT
server: cloudflare
x-github-request-id: A1D0:B62C:197BF14:1A12F07:64DCD3C4
x-timer: S1692195005.251107,VS0,VE1
etag: W/"64d81e77-91"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
cf-ray: 7f873a91b9595c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 owasp-lab%20project-f7b73c.svg
img.shields.io/badge/ 1 KB
1 KB 55ms
15ms Image
image/svg+xml 2606:4700:e4::ac40:ae10
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.shields.io/badge/owasp-lab%20project-f7b73c.svg
Requested by: Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:ae10 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecf51e84a6ff11c64d16a98dab511416dd10ff44a76cdcd4e05443e223779d33

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 18 Aug 2023 03:56:45 GMT
via: 2 fly.io
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 44377
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 15 Aug 2023 08:57:29 GMT
fly-request-id: 01H8229CQSTG4RJX0FKB35CW0J-fra
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YCdzVIYfs4vbAK5Y5LO5YnX4GraCtlkw0%2BcvRjqjNfwncyUlxsmVn1PfLmb4mG1aGaL8aWYhXTv3n1KXkv%2B3RGSLG8RP25DwyuduaELahviA2NDiSRkJ1GLq4c0m5Ttyj5ZXf1auSROYVYuE5g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
cf-ray: 7f873a91fc3b1db3-FRA

GET
H2 200 badge.svg
github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml/ 2 KB
4 KB 261ms
233ms Image
image/svg+xml 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://github.com/OWASP/www-project-secure-headers/actions/workflows/check-external-links.yml/badge.svg?branch=master

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

3e3351cf49f3196ee3eb5bef6fe234e98077f6b447419ee6d102a75db75ec2d4

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events .actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ wss://.actions.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ wss://*.actions.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1004
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
server: GitHub.com
x-github-request-id: BB8C:0D36:3631DFF:3702ACE:64DEEBFD
etag: W/"3e3351cf49f3196ee3eb5bef6fe234e9"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: image/svg+xml; charset=utf-8
cache-control: max-age=300, private
accept-ranges: bytes

GET
H2 200 badge.svg
github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml/ 2 KB
4 KB 230ms
202ms Image
image/svg+xml 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://github.com/OWASP/www-project-secure-headers/actions/workflows/headers-generate-json-files.yml/badge.svg?branch=master

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

78834b11897ddc090a4776c6a4a63d3edbe6eeb999ff10685834b3c14432d65f

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events .actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ wss://.actions.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ wss://*.actions.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1000
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
server: GitHub.com
x-github-request-id: BB8C:0D36:3631DFF:3702ACF:64DEEBFD
etag: W/"78834b11897ddc090a4776c6a4a63d3e"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: image/svg+xml; charset=utf-8
cache-control: max-age=300, private
accept-ranges: bytes

GET
H2 200 badge.svg
github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml/ 2 KB
4 KB 303ms
276ms Image
image/svg+xml 140.82.121.3
GITHUB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://github.com/OWASP/www-project-secure-headers/actions/workflows/monitoring-technical-references-generate-dashboard.yml/badge.svg?branch=master

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.3 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-3-fra.github.com

Software

GitHub.com /

Resource Hash

03448ffc9e3b2aa76851f9487a804e6d540300ccbd5721af9876ece77f214cae

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events .actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ wss://.actions.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ wss://*.actions.githubusercontent.com github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com objects-origin.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
content-length: 1012
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
server: GitHub.com
x-github-request-id: BB8C:0D36:3631DFF:3702AD0:64DEEBFD
etag: W/"03448ffc9e3b2aa76851f9487a804e6d"
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: image/svg+xml; charset=utf-8
cache-control: max-age=300, private
accept-ranges: bytes

GET
H2 200 email-decode.min.js Show response
owasp.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
840 B 10ms
8ms Script
application/javascript 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 18 Aug 2023 03:56:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 17 Aug 2023 10:58:09 GMT
server: cloudflare
etag: W/"64ddfd41-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 7f873a91b95c5c62-FRA
expires: Sun, 20 Aug 2023 03:56:45 GMT

GET
H2 200 fa-solid-900.woff2
owasp.org/assets/fontawesome/ 74 KB
74 KB 123ms
122ms Font
font/woff2 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/assets/fontawesome/fa-solid-900.woff2

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://owasp.org/www--site-theme/assets/css/styles.css
Origin: https://owasp.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 709b5403537deddf2105ecf38c7838590ac90cc0
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:03:16 GMT
content-length: 75440
x-served-by: cache-fra-eddf8230112-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:58 GMT
server: cloudflare
x-github-request-id: E312:3259:308CDE7:31A0D7C:64DEEBB3
x-timer: S1692331006.745595,VS0,VE91
etag: "64dee9ee-126b0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a91c95f5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 ubuntu-regular.woff2
owasp.org/assets/font/ 29 KB
29 KB 133ms
132ms Font
font/woff2 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/assets/font/ubuntu-regular.woff2

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44beeee5122983409ccd274c152f020a953c769cfaf3bd13a31eb276abf5ec55

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://owasp.org/www--site-theme/assets/css/styles.css
Origin: https://owasp.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 76501b26420e50b1802e359dd343f8be2da588a3
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:00:08 GMT
content-length: 29476
x-served-by: cache-fra-eddf8230121-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:58 GMT
server: cloudflare
x-github-request-id: A896:56CA:1DE0B68:1E922BC:64DEEBB2
x-timer: S1692331006.748245,VS0,VE96
etag: "64dee9ee-7324"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a91c9605c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 ubuntu-medium.woff2
owasp.org/assets/font/ 28 KB
28 KB 127ms
127ms Font
font/woff2 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/assets/font/ubuntu-medium.woff2

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8565a2bb056746aea663c4d9a0a4a85e431f07bb9d70533c6f025e44948fa458

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://owasp.org/www--site-theme/assets/css/styles.css
Origin: https://owasp.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: d770785409cb54119d008e19b9d6da980711d499
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: HIT
expires: Fri, 18 Aug 2023 04:04:58 GMT
content-length: 28576
x-served-by: cache-fra-eddf8230075-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:58 GMT
server: cloudflare
x-github-request-id: 5BA6:EA2B:2E0576A:2F18CA2:64DEEBB4
x-timer: S1692331006.879871,VS0,VE95
etag: "64dee9ee-6fa0"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a9299ea5c62-FRA
x-cache-hits: 1

GET
H2 200 fa-brands-400.woff2
owasp.org/assets/fontawesome/ 73 KB
74 KB 135ms
135ms Font
font/woff2 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/assets/fontawesome/fa-brands-400.woff2

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f49b8706547682e2c5ed6642a2f2dcbd287da458314b967c60d774aa7edb473

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://owasp.org/www--site-theme/assets/css/styles.css
Origin: https://owasp.org
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: ce6e088f837b1ed422753c8314e380fccdd9818a
date: Fri, 18 Aug 2023 03:56:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:32 GMT
content-length: 74508
x-served-by: cache-fra-eddf8230032-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:58 GMT
server: cloudflare
x-github-request-id: 7F74:072A:2F2CA86:303EF7E:64DEEBB4
x-timer: S1692331006.885244,VS0,VE97
etag: "64dee9ee-1230c"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a9299ed5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 www-project-secure-headers Show response
api.github.com/repos/owasp/ 7 KB
3 KB 198ms
169ms XHR
application/json 140.82.121.5
GITHUB

General

Check archive.org

Show headers Download Go to

Full URL

https://api.github.com/repos/owasp/www-project-secure-headers

Requested by

Host: buttons.github.io
URL: https://buttons.github.io/buttons.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

140.82.121.5 Frankfurt am Main, Germany, ASN36459 (GITHUB, US),

Reverse DNS

lb-140-82-121-5-fra.github.com

Software

GitHub.com /

Resource Hash

66e272083c6fe269aeb97379f488a1d380f87b3c76e223dc9b00a38e3ffcbe4b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-content-type-options: nosniff
content-security-policy: default-src 'none'
content-encoding: gzip
x-ratelimit-used: 1
x-github-media-type: github.v3; format=json
x-github-api-version-selected: 2022-11-28
content-length: 1502
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
last-modified: Mon, 07 Aug 2023 00:08:33 GMT
server: GitHub.com
x-github-request-id: 9E4C:F3E7:14549D5:149AA25:64DEEBFD
etag: W/"39eff601b70c98c145612fbc18a70534aa3993963635ad322b176f1fc38561de"
vary: Accept, Accept-Encoding, Accept, X-Requested-With
x-frame-options: deny
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
cache-control: public, max-age=60, s-maxage=60
x-ratelimit-resource: core
x-ratelimit-reset: 1692334605
x-ratelimit-limit: 60
accept-ranges: bytes
x-ratelimit-remaining: 59

GET
H2 200 banner-data.yml Show response
owasp.org/www-project-secure-headers/assets/sitedata/ 734 B
1 KB 134ms
133ms XHR
text/yaml 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www-project-secure-headers/assets/sitedata/banner-data.yml

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/js/yaml.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ff87211a6a1e788fdea117ba81b8676bd41189423ebde72ed7fe19447acdf5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 6375a958063b888e0104159263912a409a8aa2a0
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
age: 0
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:45 GMT
x-cache-hits: 0
x-served-by: cache-fra-eddf8230022-FRA
referrer-policy: same-origin
last-modified: Sun, 13 Aug 2023 00:06:18 GMT
server: cloudflare
x-github-request-id: E120:EA2B:2E07373:2F1A9BE:64DEEBFD
x-timer: S1692331006.927825,VS0,VE103
etag: W/"64d81e7a-2de"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/yaml
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: geolocation=(self)
cf-ray: 7f873a92ea215c62-FRA
x-proxy-cache: MISS

GET
H2 200 popup-data.yml Show response
owasp.org/www-project-secure-headers/assets/sitedata/ 1 KB
2 KB 120ms
119ms XHR
text/yaml 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www-project-secure-headers/assets/sitedata/popup-data.yml

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/js/yaml.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef6559103903953e244a5ffee1101b36faff6d5bd378d44a4514944b643434de

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: b882c2342cb60e19c34715ed6e5333b3ade9cd5f
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
age: 0
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
x-cache-hits: 0
x-served-by: cache-fra-eddf8230033-FRA
referrer-policy: same-origin
last-modified: Sun, 13 Aug 2023 00:06:18 GMT
server: cloudflare
x-github-request-id: 373A:CD65:2F77A20:308A07F:64DEEBFD
x-timer: S1692331006.074788,VS0,VE88
etag: W/"64d81e7a-539"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/yaml
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: geolocation=(self)
cf-ray: 7f873a93dab35c62-FRA
x-origin-cache: HIT
x-proxy-cache: MISS

GET
H2 200 menus.json Show response
owasp.org/www--site-theme/assets/sitedata/ 6 KB
2 KB 119ms
119ms XHR
application/json 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/www--site-theme/assets/sitedata/menus.json

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/js/jquery-3.4.1.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ceca610985a049a717ff0935525de51ff966681b61d730d17f0ec7298956472

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://owasp.org/www-project-secure-headers/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 6856a3bffa26d14c41f0375a89438bb1ad9915d9
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: DYNAMIC
content-encoding: br
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
age: 0
x-cache: HIT
x-proxy-cache: HIT
expires: Fri, 18 Aug 2023 04:01:04 GMT
x-served-by: cache-fra-eddf8230040-FRA
referrer-policy: same-origin
last-modified: Tue, 15 Aug 2023 17:39:37 GMT
server: cloudflare
x-github-request-id: 179E:BD1A:2DCE5DE:2EE1380:64DEEBB8
x-timer: S1692331006.197676,VS0,VE90
etag: W/"64dbb859-1688"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: geolocation=(self)
cf-ray: 7f873a949b295c62-FRA
x-cache-hits: 1

GET
H2 200 events.yml Show response
owasp.org/assets/sitedata/ 3 KB
5 KB 33ms
33ms XHR
text/yaml 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/assets/sitedata/events.yml

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/js/yaml.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12c5833f3f8bf7c757c3828ca9fb2f708b67f739e01e7d0ec333c86c3a3e8c03

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 4da758473820bcd59dcf7ab038d347085e2aa1d8
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
age: 6
x-cache: HIT
expires: Fri, 18 Aug 2023 04:04:10 GMT
x-cache-hits: 1
x-served-by: cache-fra-eddf8230139-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: C0D0:E398:2FBF97E:30D257D:64DEEBB8
x-timer: S1692331006.201007,VS0,VE1
etag: W/"64dee9eb-d07"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/yaml
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: geolocation=(self)
cf-ray: 7f873a949b2a5c62-FRA
x-origin-cache: HIT
x-proxy-cache: HIT

GET
H2 200 corp_members.yml Show response
owasp.org/assets/sitedata/ 119 KB
119 KB 124ms
124ms XHR
text/yaml 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://owasp.org/assets/sitedata/corp_members.yml

Requested by

Host: owasp.org
URL: https://owasp.org/www--site-theme/assets/js/yaml.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45de21369d153b74b8fa4768c8faa42f6e8b3344899e78092afe897cee91c300

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 81a44e6db0ff12750b3b1b8be996ea009292709d
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
age: 0
x-cache: HIT
expires: Fri, 18 Aug 2023 03:59:52 GMT
x-cache-hits: 1
x-served-by: cache-fra-eddf8230120-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 9D92:1EEF:661D54:68B748:64DEEBB8
x-timer: S1692331006.234405,VS0,VE95
etag: W/"64dee9eb-1da96"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/yaml
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: geolocation=(self)
cf-ray: 7f873a94db495c62-FRA
x-origin-cache: HIT
x-proxy-cache: HIT

GET
H2 200 Bloomberg.png
owasp.org/assets/images/corp-member-logo/ 27 KB
29 KB 133ms
132ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/Bloomberg.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3493c13c8ef8fc260cbb4b334cac01ccbb61e2bd01023372c07e9590dbf8cfeb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 627536d7ff6418950a4f4fcd2224bf06e232a353
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
content-length: 27643
x-served-by: cache-fra-eddf8230043-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: FAC2:3095:16B0B29:1735627:64DEEBFE
x-timer: S1692331006.395718,VS0,VE99
etag: "64dee9eb-6bfb"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbe65c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

GET
H2 200 salesforce.png
owasp.org/assets/images/corp-member-logo/ 6 KB
8 KB 136ms
134ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/salesforce.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

889850c939bd8424253a67211f9eda5d2939ca0126d93814bd904e0dc09538a9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 4f7f09fe4333f3058268f7331f1857c6865b9396
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
content-length: 6446
x-served-by: cache-fra-eddf8230046-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 5B2A:F7EB:4E5064:50573E:64DEEBFE
x-timer: S1692331006.403775,VS0,VE94
etag: "64dee9eb-192e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbe85c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

GET
H2 200 black_belt_logo.png
owasp.org/assets/images/corp-member-logo/ 32 KB
33 KB 124ms
122ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/black_belt_logo.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

111e908d4931f17d51f19b3f8f02adba325fc1e29c878c8661e288944af8a31c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 57dfba21703180ba2a658136519cac11dc354283
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:38 GMT
content-length: 33043
x-served-by: cache-fra-eddf8230039-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: A0BA:CD65:2F75B1F:3088088:64DEEBBA
x-timer: S1692331006.395225,VS0,VE93
etag: "64dee9eb-8113"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbe95c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 contrast_logo_rgb.png
owasp.org/assets/images/corp-member-logo/ 74 KB
76 KB 129ms
127ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/contrast_logo_rgb.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fec084f5786c0a8718738f088745b13664eff7b553264ee615131abe2467b886

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 8eaafd5702580e739196adc22fbb959c472f7f2d
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
content-length: 75999
x-served-by: cache-fra-eddf8230139-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 9CFC:BD1A:2DCFFD3:2EE2E6F:64DEEBFE
x-timer: S1692331006.392840,VS0,VE97
etag: "64dee9eb-128df"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbeb5c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

GET
H2 200 EPAMSystemsLogo.jpeg
owasp.org/assets/images/corp-member-logo/ 11 KB
11 KB 134ms
133ms Image
image/jpeg 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/EPAMSystemsLogo.jpeg

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85a4805934ba775aa7e17fa33654f9459271e437473172ff347adca3c9d9225a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 0492060186e8446e9d085203008ec828ddf76207
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
content-length: 10756
x-served-by: cache-fra-eddf8230068-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: FF4E:CD65:2F77A45:308A0B7:64DEEBFE
x-timer: S1692331006.396639,VS0,VE99
etag: "64dee9eb-2a04"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbec5c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

GET
H2 200 KPMG_Logo.jpeg
owasp.org/assets/images/corp-member-logo/ 7 KB
7 KB 131ms
130ms Image
image/jpeg 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/KPMG_Logo.jpeg

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b27f88df0096830f8202207b01da2f55e7aa8a221afac11c125705fd2b130ec

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 246d281499bf5ea1a436936b4d13c015f29043ae
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
content-length: 7056
x-served-by: cache-fra-eddf8230045-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 9072:83A0:244587D:251396D:64DEEBFD
x-timer: S1692331006.395244,VS0,VE99
etag: "64dee9eb-1b90"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbed5c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

GET
H2 200 tenable_logo.png
owasp.org/assets/images/corp-member-logo/ 36 KB
36 KB 122ms
121ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/tenable_logo.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66bf051c02926d6a928217c001ac52b239880dd7ae5c73346d946876274f04be

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 7d3f7a686288cdd77bc89552347c2c7de06272ea
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: HIT
expires: Fri, 18 Aug 2023 04:05:38 GMT
content-length: 36996
x-served-by: cache-fra-eddf8230030-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: E49A:B787:2AACFEF:2BA625E:64DEEBBA
x-timer: S1692331006.396200,VS0,VE91
etag: "64dee9eb-9084"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbee5c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 Coalfire.png
owasp.org/assets/images/corp-member-logo/ 8 KB
8 KB 133ms
132ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/Coalfire.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea7b775f0f003a40ed003d5f8a9c125a9baf76d3738ccf3046f46579fce1cca4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 7b1b77a0ebb123a90f68a8b2b4b5fec1e35c414c
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: HIT
x-cache: MISS
expires: Fri, 18 Aug 2023 04:05:44 GMT
content-length: 8113
x-served-by: cache-fra-eddf8230123-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 6BEA:9E97:2DB1F04:2EC44F1:64DEEBFE
x-timer: S1692331006.400344,VS0,VE94
etag: "64dee9eb-1fb1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbef5c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

GET
H2 200 atlassian.png
owasp.org/assets/images/corp-member-logo/ 13 KB
15 KB 35ms
34ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/atlassian.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

301bd1ee060975e36b34fe4dbb9c43dd4d5c53e68a1a14aeca46c5a392486e22

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 453347fa4df78ee3bb9449532e649d07217d08dd
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: HIT
expires: Fri, 18 Aug 2023 04:06:40 GMT
content-length: 13455
x-served-by: cache-fra-eddf8230046-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 21C2:1527:196B1A4:19FFD73:64DEEBF8
x-timer: S1692331006.397949,VS0,VE1
etag: "64dee9eb-348f"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbf05c62-FRA
x-origin-cache: HIT
x-cache-hits: 1

GET
H2 200 GrammarlyLogo.png
owasp.org/assets/images/corp-member-logo/ 35 KB
35 KB 129ms
129ms Image
image/png 2606:4700:10::6816:1a4d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://owasp.org/assets/images/corp-member-logo/GrammarlyLogo.png

Requested by

Host: owasp.org
URL: https://owasp.org/www-project-secure-headers/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:1a4d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7d515c0862c758debefe4dfbae52305d10a9c253035c12ae1e9904a943bb4233

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://owasp.org/www-project-secure-headers/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

x-fastly-request-id: 9ae875af6f612c4353780722421814b55a1607c8
date: Fri, 18 Aug 2023 03:56:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 varnish
cf-cache-status: EXPIRED
x-content-type-options: nosniff
content-security-policy: default-src 'self' https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com
x-proxy-cache: MISS
x-cache: MISS
expires: Fri, 18 Aug 2023 04:06:46 GMT
content-length: 35528
x-served-by: cache-fra-eddf8230051-FRA
referrer-policy: same-origin
last-modified: Fri, 18 Aug 2023 03:47:55 GMT
server: cloudflare
x-github-request-id: 934E:E398:2FC14D2:30D41DE:64DEEBFE
x-timer: S1692331006.399783,VS0,VE93
etag: "64dee9eb-8ac8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
permissions-policy: geolocation=(self)
accept-ranges: bytes
cf-ray: 7f873a95dbf15c62-FRA
x-origin-cache: HIT
x-cache-hits: 0

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' https://api.github.com https://.githubusercontent.com https://.google-analytics.com https://owaspadmin.azurewebsites.net https://.twimg.com https://platform.twitter.com https://www.youtube.com https://.doubleclick.net; frame-ancestors 'self'; frame-src https://.vuejs.org https://.stripe.com https://.wufoo.com https://.sched.com https://.google.com https://.twitter.com https://www.youtube.com https://w.soundcloud.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://.vuejs.org https://.stripe.com https://.wufoo.com https://.youtube.com https://.meetup.com https://.sched.com https://.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://.gstatic.com https://.twitter.com https://.twimg.com; style-src 'self' 'unsafe-inline' https://.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://.twimg.com data:; font-src 'self' fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://.globalappsec.org data: www.w3.org https://licensebuttons.net https://img.shields.io https://.twitter.com https://github.githubassets.com https://.twimg.com https://platform.twitter.com https://.githubusercontent.com https://.vercel.app https://.cloudfront.net https://.coreinfrastructure.org https://.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://.googleapis.com https://.google.com https://*.gstatic.com
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.github.com
buttons.github.io
github.com
img.shields.io
owasp.org
www.google-analytics.com
140.82.121.3
140.82.121.5
2606:4700:10::6816:1a4d
2606:4700:e4::ac40:ae10
2606:50c0:8000::153
2a00:1450:4001:828::200e
03448ffc9e3b2aa76851f9487a804e6d540300ccbd5721af9876ece77f214cae
0738580e85e7fdef026f377d497b2791985a1b161bb9b573ed15798e1d91ea48
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
111e908d4931f17d51f19b3f8f02adba325fc1e29c878c8661e288944af8a31c
12c5833f3f8bf7c757c3828ca9fb2f708b67f739e01e7d0ec333c86c3a3e8c03
1f49b8706547682e2c5ed6642a2f2dcbd287da458314b967c60d774aa7edb473
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
301bd1ee060975e36b34fe4dbb9c43dd4d5c53e68a1a14aeca46c5a392486e22
3493c13c8ef8fc260cbb4b334cac01ccbb61e2bd01023372c07e9590dbf8cfeb
357c0ad66cf329f64d356786a5dd19700f8b4498b283db0922e374e68e544298
3e3351cf49f3196ee3eb5bef6fe234e98077f6b447419ee6d102a75db75ec2d4
44beeee5122983409ccd274c152f020a953c769cfaf3bd13a31eb276abf5ec55
45512d9190b06b08f5bf539745d388ea399690fb8c28986800de83fd3bf6b76e
45de21369d153b74b8fa4768c8faa42f6e8b3344899e78092afe897cee91c300
53d3b023092e049484c4e39ce6f50d1b8dd10074795e66da06e1140792a91d9a
66bf051c02926d6a928217c001ac52b239880dd7ae5c73346d946876274f04be
66e272083c6fe269aeb97379f488a1d380f87b3c76e223dc9b00a38e3ffcbe4b
78834b11897ddc090a4776c6a4a63d3edbe6eeb999ff10685834b3c14432d65f
7d1b23f8a47d2603cae545df2f5e0d6a410531f9c2d3349080c7c875c2e751bb
7d515c0862c758debefe4dfbae52305d10a9c253035c12ae1e9904a943bb4233
8565a2bb056746aea663c4d9a0a4a85e431f07bb9d70533c6f025e44948fa458
85a4805934ba775aa7e17fa33654f9459271e437473172ff347adca3c9d9225a
889850c939bd8424253a67211f9eda5d2939ca0126d93814bd904e0dc09538a9
8902e5836a324eae0ab281a9be7d62683e025d503ce6778cce6768fb908c1089
8ceca610985a049a717ff0935525de51ff966681b61d730d17f0ec7298956472
9b27f88df0096830f8202207b01da2f55e7aa8a221afac11c125705fd2b130ec
a2396036f7419d686ba86e291d3166b71b9f4fa52640cd224d119b16da1da24c
b8ccdf0e45f181fc04f0d202779fff71aa76f27f0428a792e0e6f13fe1d0b085
cbe2121765e2f3e921a42bcb9b0c78635b68cee1dccd1b1ec31089b9382ff514
cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e7ff87211a6a1e788fdea117ba81b8676bd41189423ebde72ed7fe19447acdf5
ea313025ebfe6e5677fceab5f9bfa510ec1f4da1312358339f00b0d26f45a447
ea7b775f0f003a40ed003d5f8a9c125a9baf76d3738ccf3046f46579fce1cca4
ecf51e84a6ff11c64d16a98dab511416dd10ff44a76cdcd4e05443e223779d33
ef6559103903953e244a5ffee1101b36faff6d5bd378d44a4514944b643434de
f46950820ce4e5032d2519c3b0c2a73f48b64071b5efd95b7f52d3755f69d3ce
fec084f5786c0a8718738f088745b13664eff7b553264ee615131abe2467b886

owasp.org Open in urlscan Pro 2606:4700:10::6816:1a4d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

38 Requests

100 %HTTPS

67 %IPv6

5 Domains

6 Subdomains

6 IPs

2 Countries

798 kBTransfer

1216 kBSize

0 Cookies

304 Outgoing links

Redirected requests

38 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

owasp.org Open in urlscan Pro
2606:4700:10::6816:1a4d Public Scan

Screenshot
Live screenshot

Full Image

38
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

798 kB
Transfer

1216 kB
Size

0
Cookies

38 HTTP transactions
0 data transactions