Submitted URL: https://customers.us.staging.immersivelabs.com/
Effective URL: https://errors.origin.immersivelabs.team/maintenance.html
Submission: On December 07 via automatic, source certstream-suspicious — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 13.249.190.108, located in United States and belongs to AMAZON-02, US. The main domain is errors.origin.immersivelabs.team.
TLS certificate: Issued by Amazon on October 2nd 2022. Valid for: a year.
This is the only time errors.origin.immersivelabs.team was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 13.35.73.13 16509 (AMAZON-02)
7 13.249.190.108 16509 (AMAZON-02)
1 65.8.191.181 16509 (AMAZON-02)
8 2
Domain Requested by
7 errors.origin.immersivelabs.team errors.origin.immersivelabs.team
1 d3e54v103j8qbb.cloudfront.net errors.origin.immersivelabs.team
1 customers.us.staging.immersivelabs.com 1 redirects
8 3

This site contains no links.

Subject Issuer Validity Valid
errors.origin.immersivelabs.team
Amazon
2022-10-02 -
2023-10-31
a year crt.sh
*.cloudfront.net
Amazon
2022-02-01 -
2023-01-31
a year crt.sh

This page contains 1 frames:

Primary Page: https://errors.origin.immersivelabs.team/maintenance.html
Frame ID: 2C6DE48CEEC1C01766B2E7FBCFF5124A
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Scheduled Maintenance

Page URL History Show full URLs

  1. https://customers.us.staging.immersivelabs.com/ HTTP 302
    https://errors.origin.immersivelabs.team/maintenance.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

444 kB
Transfer

558 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://customers.us.staging.immersivelabs.com/ HTTP 302
    https://errors.origin.immersivelabs.team/maintenance.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request maintenance.html
errors.origin.immersivelabs.team/
Redirect Chain
  • https://customers.us.staging.immersivelabs.com/
  • https://errors.origin.immersivelabs.team/maintenance.html
2 KB
2 KB
Document
General
Full URL
https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bdc1e9a003d01b10afd886fd79aa329b92a58990894f75c837073df938c76375
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

age
17119
content-encoding
gzip
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
content-type
text/html
date
Wed, 07 Dec 2022 04:09:09 GMT
etag
W/"33a976416368920ad1b7820604392036"
last-modified
Tue, 29 Nov 2022 11:09:22 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
x-amz-cf-id
lAale75sy5tNqBcU7Gi1TcmdJX25on-0Uj2vyfVxKbE7LmB-8Dx9Bw==
x-amz-cf-pop
BOS50-C2
x-amz-server-side-encryption
AES256
x-amz-version-id
bhs0vAVZZNFJ2_0u1of1B2lWuLbNBX.W
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

content-length
0
content-security-policy
frame-ancestors https://us.staging.immersivelabs.com https://*.us.staging.immersivelabs.com https://labforge.immersivelabs.online; report-uri https://api.immersivelabs.online/csp_reports
date
Wed, 07 Dec 2022 08:54:27 GMT
location
https://errors.origin.immersivelabs.team/maintenance.html
permissions-policy
accelerometer=*, ambient-light-sensor=*, autoplay=*, battery=*, camera=*, cross-origin-isolated=*, display-capture=*, document-domain=*, encrypted-media=*, execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=*, geolocation=*, gyroscope=*, keyboard-map=*, magnetometer=*, microphone=*, midi=*, navigation-override=*, payment=*, picture-in-picture=*, publickey-credentials-get=*, screen-wake-lock=*, sync-xhr=*, usb=*, web-share=*, xr-spatial-tracking=*
referrer-policy
strict-origin-when-cross-origin
server
CloudFront
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
via
1.1 11f2bbe039270ef0eb740fa197800162.cloudfront.net (CloudFront)
x-amz-cf-id
MIFJHo7Bpf4X4Av6RUN70ZR0ajloGO7zO7ePZy_y8gevN7ycEuXYYQ==
x-amz-cf-pop
BOS50-C1
x-cache
Error from cloudfront
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
normalize.css
errors.origin.immersivelabs.team/css/
8 KB
3 KB
Stylesheet
General
Full URL
https://errors.origin.immersivelabs.team/css/normalize.css
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5c4a6fe64efc5d07833c35af9630d0f9b3d4d09a63f9358e441374e9102c9e81
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://errors.origin.immersivelabs.team/maintenance.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

x-amz-version-id
94FkdegduaoiWFLPyFKeiKE3Mkcr3KRZ
content-encoding
br
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
date
Wed, 07 Dec 2022 04:52:07 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
x-amz-cf-pop
BOS50-C2
age
14541
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 02 Oct 2022 12:23:43 GMT
server
AmazonS3
etag
W/"4951cc88307c632cf285d3ba988ab283"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
x-amz-cf-id
yweXrBCgFx-SXoCuUds2XpzkrMgXjd_Ypz4iYVvnC2R9nfIPcu4PKQ==
webflow.css
errors.origin.immersivelabs.team/css/
38 KB
10 KB
Stylesheet
General
Full URL
https://errors.origin.immersivelabs.team/css/webflow.css
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7deeee24b8c80bcca6c1c3ba09aaf3811aa99f88028732f2fce9e31e83a435f6
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://errors.origin.immersivelabs.team/maintenance.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Wed, 07 Dec 2022 08:06:44 GMT
x-amz-version-id
kEIb9dn9A4buiX95AISgVMxRfqsZLl9b
content-encoding
gzip
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
BOS50-C2
age
2864
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 02 Oct 2022 12:23:43 GMT
server
AmazonS3
etag
W/"1abf187626b86686f4810b05cc0e2433"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
x-amz-cf-id
tmBrrPO1ULhHiyyGR3k2IcXIlP69jLjrqBzUD6XGoeJeqJHfRkVoiw==
error-state.webflow.css
errors.origin.immersivelabs.team/css/
2 KB
1 KB
Stylesheet
General
Full URL
https://errors.origin.immersivelabs.team/css/error-state.webflow.css
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
aafa94c232f68dcbb2474742d929b28778f0721b0ba6b200e6296acacd51c020
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://errors.origin.immersivelabs.team/maintenance.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

x-amz-version-id
ehp_iRhFKRarxGsKz.seeaMLBXEJiAXg
content-encoding
br
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
date
Wed, 07 Dec 2022 04:52:07 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
x-amz-cf-pop
BOS50-C2
age
14541
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 02 Oct 2022 12:23:43 GMT
server
AmazonS3
etag
W/"d117967d444a677f50ffd90c163034ac"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css
x-amz-cf-id
aSxbshmOJTcpQR2GVXoQJJtoP4cYtgb09vEA3N2MC8irRxY1wREt9A==
jquery-3.5.1.min.dc5e7f18c8.js
d3e54v103j8qbb.cloudfront.net/js/
87 KB
30 KB
Script
General
Full URL
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=5faa72bcb0428a78e7cb6015
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.8.191.181 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-8-191-181.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
https://errors.origin.immersivelabs.team/
Origin
https://errors.origin.immersivelabs.team
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Tue, 06 Dec 2022 23:14:22 GMT
content-encoding
br
via
1.1 53a0c837da247a6d49f09ae6de51454e.cloudfront.net (CloudFront)
age
34806
x-amz-cf-pop
BOS50-C3
x-cache
Hit from cloudfront
last-modified
Mon, 20 Jul 2020 17:53:02 GMT
server
AmazonS3
etag
W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=84600, must-revalidate
vary
Accept-Encoding
x-amz-cf-id
bbFobXsBBbV1YIDM0FDoYr40lxjdptz-ywSP4-eB05TZyRHi3fvgow==
webflow.js
errors.origin.immersivelabs.team/js/
39 KB
14 KB
Script
General
Full URL
https://errors.origin.immersivelabs.team/js/webflow.js
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
87a55e3d601867a8335203bba762f76df6332d058c97cb0aa0f82a8396260091
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://errors.origin.immersivelabs.team/maintenance.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

x-amz-version-id
.EfbSF9c9UvraPDHPDzNOVg3rffVWb29
content-encoding
br
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
date
Wed, 07 Dec 2022 04:52:07 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
x-amz-cf-pop
BOS50-C2
age
14541
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-cache
Hit from cloudfront
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 02 Oct 2022 12:23:43 GMT
server
AmazonS3
etag
W/"219edb7af3f5985c9f7bfe9b70d6cb35"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript
x-amz-cf-id
wFWm_Vl9OYggULZlJOjizjJZrHc3aSTm4eGCoOnDm_3eVp5o7qNsfw==
Bg-3.png
errors.origin.immersivelabs.team/images/
382 KB
384 KB
Image
General
Full URL
https://errors.origin.immersivelabs.team/images/Bg-3.png
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/css/error-state.webflow.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
952648f8ff003878c8fcffccdb6c67b64645c755300803b67c82623a94947544
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://errors.origin.immersivelabs.team/css/error-state.webflow.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

date
Wed, 07 Dec 2022 08:06:46 GMT
x-amz-version-id
Mru1xXzbsoQ2q2be49LbuAZS0SqaRRLV
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
BOS50-C2
age
2862
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
391455
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 02 Oct 2022 12:23:44 GMT
server
AmazonS3
etag
"bf6403ce1789d5051058ce92a522c284"
x-frame-options
SAMEORIGIN
content-type
image/png
accept-ranges
bytes
x-amz-cf-id
E1CtJUbo7puOkZEi3p48BCvTYen9-cd8Q9TBEB57hGmm7BTjMiftdg==
Block-Logo.svg
errors.origin.immersivelabs.team/images/
364 B
1 KB
Image
General
Full URL
https://errors.origin.immersivelabs.team/images/Block-Logo.svg
Requested by
Host: errors.origin.immersivelabs.team
URL: https://errors.origin.immersivelabs.team/maintenance.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.190.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-249-190-108.bos50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bc156a9f3be756078f37d72016292ec7ed8f2d171a18a9c0d5ebc343d6004eec
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://errors.origin.immersivelabs.team/maintenance.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.94 Safari/537.36

Response headers

x-amz-version-id
sRvHw3VophuGx_zGqoni12kVs0nIVqBK
date
Wed, 07 Dec 2022 04:52:07 GMT
via
1.1 4da69145f7e1fe6a8bdcb04dc7af89e8.cloudfront.net (CloudFront)
content-security-policy
frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-amz-cf-pop
BOS50-C2
age
14541
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
364
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 02 Oct 2022 12:23:43 GMT
server
AmazonS3
etag
"09658df64471ad794d5d8472b7bc2650"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
accept-ranges
bytes
x-amz-cf-id
Kvulp7D07t6FjUDtTRxXMLMtpPlaw27Fpwhf2pF_-_XJM_OgUn76oA==

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| tram object| Webflow

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors https://origin.immersivelabs.team https://*.origin.immersivelabs.team; report-uri https://api.immersivelabs.online/csp_reports
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block