Submitted URL: http://ipsilon-project.org/
Effective URL: https://ipsilon-project.org/
Submission: On February 29 via manual from US — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 9 HTTP transactions. The main IP is 38.145.60.20, located in Chandler, United States and belongs to REDHAT-3, US. The main domain is ipsilon-project.org.
TLS certificate: Issued by R3 on January 24th 2024. Valid for: 3 months.
This is the only time ipsilon-project.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 38.145.60.20 21785 (REDHAT-3)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a04:4e42:400... 54113 (FASTLY)
1 151.101.65.55 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
9 4
Apex Domain
Subdomains
Transfer
6 ipsilon-project.org
ipsilon-project.org
28 KB
1 gstatic.com
fonts.gstatic.com
48 KB
1 bestpractices.dev
www.bestpractices.dev — Cisco Umbrella Rank: 637125
2 KB
1 coreinfrastructure.org
bestpractices.coreinfrastructure.org — Cisco Umbrella Rank: 746787
187 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28
1012 B
9 5
Domain Requested by
6 ipsilon-project.org ipsilon-project.org
1 fonts.gstatic.com fonts.googleapis.com
1 www.bestpractices.dev ipsilon-project.org
1 bestpractices.coreinfrastructure.org 1 redirects
1 fonts.googleapis.com ipsilon-project.org
9 5

This site contains links to these domains. Also see Links.

Domain
pagure.io
releases.pagure.org
bestpractices.coreinfrastructure.org
Subject Issuer Validity Valid
ipsilon-project.org
R3
2024-01-24 -
2024-04-23
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2024-02-05 -
2024-04-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ipsilon-project.org/
Frame ID: 91A103DF04391F0D07CAE10D11EA29BC
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Ipsilon

Page URL History Show full URLs

  1. http://ipsilon-project.org/ HTTP 307
    https://ipsilon-project.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

9
Requests

89 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

79 kB
Transfer

80 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ipsilon-project.org/ HTTP 307
    https://ipsilon-project.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://bestpractices.coreinfrastructure.org/projects/1183/badge HTTP 302
  • https://www.bestpractices.dev/projects/1183/badge

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ipsilon-project.org/
Redirect Chain
  • http://ipsilon-project.org/
  • https://ipsilon-project.org/
3 KB
3 KB
Document
General
Full URL
https://ipsilon-project.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
38.145.60.20 Chandler, United States, ASN21785 (REDHAT-3, US),
Reverse DNS
proxy-iad01.fedoraproject.org
Software
nginx/1.23.1 /
Resource Hash
b82a790d887ec9c579a3c847c89f357c0cc837353c9da35b9da1a6264c40359a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
apptime
D=6219
cache-control
private
content-length
3044
content-type
text/html
date
Thu, 29 Feb 2024 17:15:55 GMT
etag
"62fb6906-be4"
last-modified
Tue, 16 Aug 2022 09:53:10 GMT
referrer-policy
same-origin
server
nginx/1.23.1
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
x-fedora-proxyserver
proxy01.iad2.fedoraproject.org
x-fedora-requestid
ZeC7y3dCq6T8Z334pOrHCAAIwhg
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://ipsilon-project.org/
Non-Authoritative-Reason
HSTS
css
fonts.googleapis.com/
5 KB
1012 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway:400,300,600
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0404510d163cb8dcc630114be446eb7ddc3d9b969822cb6328443e97cada3089
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 29 Feb 2024 17:15:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 29 Feb 2024 17:15:55 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 29 Feb 2024 17:15:55 GMT
normalize.css
ipsilon-project.org/css/
8 KB
8 KB
Stylesheet
General
Full URL
https://ipsilon-project.org/css/normalize.css
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
38.145.60.20 Chandler, United States, ASN21785 (REDHAT-3, US),
Reverse DNS
proxy-iad01.fedoraproject.org
Software
nginx/1.23.1 /
Resource Hash
f4d7e8250f8f124f8b7d087e5e260766a34b079fddc43e7b20d8c18ca1e92e51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipsilon-project.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 29 Feb 2024 17:15:55 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Tue, 16 Aug 2022 09:52:52 GMT
server
nginx/1.23.1
apptime
D=9322
etag
"62fb68f4-1e75"
x-frame-options
SAMEORIGIN
content-type
text/css
x-fedora-proxyserver
proxy01.iad2.fedoraproject.org
x-fedora-requestid
ZeC7y3dCq6T8Z334pOrHDAAIywE
accept-ranges
bytes
content-length
7797
x-xss-protection
1; mode=block
skeleton.css
ipsilon-project.org/css/
11 KB
11 KB
Stylesheet
General
Full URL
https://ipsilon-project.org/css/skeleton.css
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
38.145.60.20 Chandler, United States, ASN21785 (REDHAT-3, US),
Reverse DNS
proxy-iad01.fedoraproject.org
Software
nginx/1.23.1 /
Resource Hash
10207d6db44e2c69bcc0ea046c77074719478331aa6290ed3538034f20f3d308
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipsilon-project.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 29 Feb 2024 17:15:55 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Tue, 16 Aug 2022 09:52:52 GMT
server
nginx/1.23.1
apptime
D=10846
etag
"62fb68f4-2cbc"
x-frame-options
SAMEORIGIN
content-type
text/css
x-fedora-proxyserver
proxy01.iad2.fedoraproject.org
x-fedora-requestid
ZeC7y3dCq6T8Z334pOrHDQAIywI
accept-ranges
bytes
content-length
11452
x-xss-protection
1; mode=block
ipsilon.css
ipsilon-project.org/css/
1 KB
1 KB
Stylesheet
General
Full URL
https://ipsilon-project.org/css/ipsilon.css
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
38.145.60.20 Chandler, United States, ASN21785 (REDHAT-3, US),
Reverse DNS
proxy-iad01.fedoraproject.org
Software
nginx/1.23.1 /
Resource Hash
04534b2d8051ae6e6005184607a187457247fe2ca8643c7f49894bc19ce90616
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipsilon-project.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 29 Feb 2024 17:15:55 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Tue, 16 Aug 2022 09:52:52 GMT
server
nginx/1.23.1
apptime
D=9113
etag
"62fb68f4-4b9"
x-frame-options
SAMEORIGIN
content-type
text/css
x-fedora-proxyserver
proxy01.iad2.fedoraproject.org
x-fedora-requestid
ZeC7y3dCq6T8Z334pOrHDgAIywM
accept-ranges
bytes
content-length
1209
x-xss-protection
1; mode=block
ipsilon.png
ipsilon-project.org/images/
4 KB
4 KB
Image
General
Full URL
https://ipsilon-project.org/images/ipsilon.png
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
38.145.60.20 Chandler, United States, ASN21785 (REDHAT-3, US),
Reverse DNS
proxy-iad01.fedoraproject.org
Software
nginx/1.23.1 /
Resource Hash
e87c7b0a0db1dfcb6321a6600fa2e5e6cc651ee82929a702bba6719efb1e9ed4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipsilon-project.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 29 Feb 2024 17:15:55 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Tue, 16 Aug 2022 09:52:52 GMT
server
nginx/1.23.1
apptime
D=12110
etag
"62fb68f4-e91"
x-frame-options
SAMEORIGIN
content-type
image/png
x-fedora-proxyserver
proxy01.iad2.fedoraproject.org
x-fedora-requestid
ZeC7y3dCq6T8Z334pOrHDwAIywU
accept-ranges
bytes
content-length
3729
x-xss-protection
1; mode=block
badge
www.bestpractices.dev/projects/1183/
Redirect Chain
  • https://bestpractices.coreinfrastructure.org/projects/1183/badge
  • https://www.bestpractices.dev/projects/1183/badge
1 KB
2 KB
Image
General
Full URL
https://www.bestpractices.dev/projects/1183/badge
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/
Protocol
H2
Server
151.101.65.55 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cowboy /
Resource Hash
4d26a51ecd7a6289979656f59e6647b91cbabae4183f5ff38f7af7a5a7d4fa76
Security Headers
Name Value
Content-Security-Policy default-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev; base-uri 'self'; block-all-mixed-content; form-action 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev; frame-ancestors 'none'; img-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev secure.gravatar.com avatars.githubusercontent.com; object-src 'none'; script-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev; style-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy
default-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev; base-uri 'self'; block-all-mixed-content; form-action 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev; frame-ancestors 'none'; img-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev secure.gravatar.com avatars.githubusercontent.com; object-src 'none'; script-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev; style-src 'self' www.bestpractices.dev.global.ssl.fastly.net bestpractices.coreinfrastructure.org.global.ssl.fastly.net bestpractices.coreinfrastructure.org www.bestpractices.dev
content-encoding
gzip
x-permitted-cross-domain-policies
none
age
43805
content-disposition
inline
reporting-endpoints
heroku-nel=https://nel.heroku.com/reports?ts=1709183151&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=fYdHbAYWJrDGv650bHfpU3SYvRE25t5EPIW9P8r%2Fyag%3D
x-served-by
cache-fra-eddf8230084-FRA
referrer-policy
no-referrer-when-downgrade
x-timer
S1709226956.862429,VS0,VE1
etag
W/"e8eab829b993b92d7b1c5664ba64f387"
x-frame-options
DENY
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, no-cache
feature-policy
fullscreen 'none'; geolocation 'none'; midi 'none';notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none';camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none';vibrate 'none'; payment 'none'
x-cache-hits
1
date
Thu, 29 Feb 2024 17:15:55 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
nel
{"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
via
1.1 vegur, 1.1 varnish
x-cache
HIT
content-transfer-encoding
binary
content-length
512
x-xss-protection
1; mode=block
x-request-id
1d229f30-3502-4c78-9fa1-96492fa171ac
x-runtime
0.006969
server
Cowboy
x-download-options
noopen
report-to
{"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1709183151&sid=af571f24-03ee-46d1-9f90-ab9030c2c74c&s=fYdHbAYWJrDGv650bHfpU3SYvRE25t5EPIW9P8r%2Fyag%3D"}]}
permissions-policy
fullscreen=(), geolocation=(), midi=(), notifications=(), push=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), speaker=(), vibrate=(), payment=()
accept-ranges
bytes

Redirect headers

x-served-by
cache-fra-eddf8230120-FRA
date
Thu, 29 Feb 2024 17:15:55 GMT
via
1.1 varnish
server
Varnish
x-timer
S1709226956.805279,VS0,VE0
x-cache
HIT
location
https://www.bestpractices.dev/projects/1183/badge
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
dark_matter.png
ipsilon-project.org/images/
166 B
273 B
Image
General
Full URL
https://ipsilon-project.org/images/dark_matter.png
Requested by
Host: ipsilon-project.org
URL: https://ipsilon-project.org/css/ipsilon.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
38.145.60.20 Chandler, United States, ASN21785 (REDHAT-3, US),
Reverse DNS
proxy-iad01.fedoraproject.org
Software
nginx/1.23.1 /
Resource Hash
2f170202ab4e0f4deac3149ee0ca5a326a5efad16dd9c896d96fef1965647e95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipsilon-project.org/css/ipsilon.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 29 Feb 2024 17:15:56 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
last-modified
Tue, 16 Aug 2022 09:52:52 GMT
server
nginx/1.23.1
apptime
D=10797
etag
"62fb68f4-a6"
x-frame-options
SAMEORIGIN
content-type
image/png
x-fedora-proxyserver
proxy01.iad2.fedoraproject.org
x-fedora-requestid
ZeC7zHdCq6T8Z334pOrHFgAIzgg
accept-ranges
bytes
content-length
166
x-xss-protection
1; mode=block
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v29/
47 KB
48 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v29/1Ptug8zYS_SKggPNyC0ITw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:400,300,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8cbc049ddbd7ca67068451ce754401833499959c4c6ed7b98f664d42e0597808
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://ipsilon-project.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Tue, 27 Feb 2024 09:00:16 GMT
x-content-type-options
nosniff
age
202539
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48208
x-xss-protection
0
last-modified
Wed, 13 Sep 2023 23:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 26 Feb 2025 09:00:16 GMT

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
ipsilon-project.org/ Name: 151d354d9c50a3cd685caf03de3925d6
Value: 16134ac346e9e206c10a957fb8f9a97b

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block