urlscan.io logo urlscan.io
SecurityTrails logo

arcade.my Open in urlscan Pro
2a03:b0c0:3:d0::d23:d001  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://arcade.my/
Effective URL: https://arcade.my/
Submission: On March 09 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 2a03:b0c0:3:d0::d23:d001, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is arcade.my.
TLS certificate: Issued by R3 on March 9th 2022. Valid for: 3 months.
This is the only time arcade.my was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 11 2a03:b0c0:3:d... 14061 (DIGITALOC...)
10 1
Apex Domain
Subdomains		 Transfer
11 arcade.my
arcade.my
45 KB
10 1
Domain Requested by
11 arcade.my 1 redirects arcade.my
10 1

This site contains no links.

Subject Issuer Validity Valid
*.arcade.com.my
R3		 2022-03-09 -
2022-06-07		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://arcade.my/
Frame ID: 2FDC7322F6A3F964FFD832D3E30527DE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Welcome

Page URL History Show full URLs

  1. http://arcade.my/ HTTP 301
    https://arcade.my/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Page Statistics

10
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

44 kB
Transfer

134 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://arcade.my/ HTTP 301
    https://arcade.my/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
arcade.my/
Redirect Chain
  • http://arcade.my/
  • https://arcade.my/
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
12ea51d5c1cb9c6f566b13dc8ed61aed6f94e6852da34a28d032f2e17661397c
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

age
0
cache-control
public, max-age=0, must-revalidate
content-encoding
br
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
content-type
text/html; charset=UTF-8
date
Wed, 09 Mar 2022 14:22:58 GMT
etag
"0d0f580906d89f12626735fa20d6f0ad-ssl-df"
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
referrer-policy
no-referrer-when-downgrade
server
Netlify
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-bb-except
Cookie=__prerender_bypass,__next_preview_data
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-nf-request-id
01FXQGZH75F486YPCEYGSJ2E2P
x-xss-protection
1; mode=block

Redirect headers

Age
0
Cache-Control
public, max-age=0, must-revalidate
Content-Length
33
Content-Security-Policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Content-Type
text/plain
Date
Wed, 09 Mar 2022 14:22:58 GMT
Location
https://arcade.my/
Permissions-Policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Referrer-Policy
no-referrer-when-downgrade
Server
Netlify
X-Bb-Except
Cookie=__prerender_bypass,__next_preview_data
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Nf-Request-Id
01FXQGZGX5JANZHJS484V25RHE
X-Xss-Protection
1; mode=block
752127aeafd8da2d.css
arcade.my/_next/static/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/css/752127aeafd8da2d.css
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDT7M7A96T9GCE1SFVB
date
Wed, 09 Mar 2022 14:23:01 GMT
server
Netlify
age
2
content-length
62
content-type
text/plain; charset=utf-8
webpack-514908bffb652963.js
arcade.my/_next/static/chunks/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/chunks/webpack-514908bffb652963.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDTDHSS81BYESTCM516
date
Wed, 09 Mar 2022 14:23:01 GMT
server
Netlify
age
2
content-length
62
content-type
text/plain; charset=utf-8
framework-91d7f78b5b4003c8.js
arcade.my/_next/static/chunks/ 		127 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/chunks/framework-91d7f78b5b4003c8.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
ce3783d4091c989beac6560ce4ba0032d52339854010ac19358dfb702f226167
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDWWSVEPH2DMVRT2YB3
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
content-encoding
br
etag
"5da182a07bba2469db4dc376d970c229-ssl-df"
age
0
strict-transport-security
max-age=31536000; includeSubDomains
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
Netlify
x-frame-options
SAMEORIGIN
date
Wed, 09 Mar 2022 14:22:59 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
accept-ranges
bytes
x-content-type-options
nosniff
main-d98b4a7f39fdfc80.js
arcade.my/_next/static/chunks/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/chunks/main-d98b4a7f39fdfc80.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDW1PTYS62BJ93G52KC
date
Wed, 09 Mar 2022 14:23:01 GMT
server
Netlify
age
2
content-length
62
content-type
text/plain; charset=utf-8
_app-68b0fc886313373e.js
arcade.my/_next/static/chunks/pages/ 		989 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/chunks/pages/_app-68b0fc886313373e.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
cec5011a8dfa71bda223fbfc0cd864bfda6fe40964a29bc9abefb8cd1a695b78
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDW04K8PT6ND5C666JY
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
x-content-type-options
nosniff
age
0
content-length
989
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
Netlify
x-frame-options
SAMEORIGIN
date
Wed, 09 Mar 2022 14:22:59 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
etag
"6a4a80f2ee17485824fc4d0ad13daf19-ssl"
accept-ranges
bytes
index-4a2048c5b7d2fbfb.js
arcade.my/_next/static/chunks/pages/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/chunks/pages/index-4a2048c5b7d2fbfb.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
8565442bc15eeb2ba0912892c6b25588cd1e4f4cdf668207c79f90d82c030881
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDXXR4DHMWDZ5YZSDRT
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
content-encoding
br
etag
"7dacd5d6ad36761c69ae98b7c26c8a26-ssl-df"
age
0
strict-transport-security
max-age=31536000; includeSubDomains
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
Netlify
x-frame-options
SAMEORIGIN
date
Wed, 09 Mar 2022 14:22:59 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
accept-ranges
bytes
x-content-type-options
nosniff
_buildManifest.js
arcade.my/_next/static/Ze9XxIXsUANq4S-NYBzjN/ 		436 B
528 B 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/Ze9XxIXsUANq4S-NYBzjN/_buildManifest.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
a8328fde667856c3c12a04a4ec2202075b72d37017eef4c12249661b8bfedd1c
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDYA8SPZDA9SEPW2RJS
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
x-content-type-options
nosniff
age
0
content-length
436
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
Netlify
x-frame-options
SAMEORIGIN
date
Wed, 09 Mar 2022 14:22:59 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
etag
"0f81d88055cb6d88a2362327b5177bac-ssl"
accept-ranges
bytes
_ssgManifest.js
arcade.my/_next/static/Ze9XxIXsUANq4S-NYBzjN/ 		77 B
168 B 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/Ze9XxIXsUANq4S-NYBzjN/_ssgManifest.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDYJK05MV8DG5EXT4D9
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
x-content-type-options
nosniff
age
0
content-length
77
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
Netlify
x-frame-options
SAMEORIGIN
date
Wed, 09 Mar 2022 14:22:59 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
etag
"681ec6f7febee1fe25a6fba78c3b4360-ssl"
accept-ranges
bytes
_middlewareManifest.js
arcade.my/_next/static/Ze9XxIXsUANq4S-NYBzjN/ 		92 B
183 B 		Script
General
Check archive.org
Download Go to
Full URL
https://arcade.my/_next/static/Ze9XxIXsUANq4S-NYBzjN/_middlewareManifest.js
Requested by
Host: arcade.my
URL: https://arcade.my/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:b0c0:3:d0::d23:d001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Netlify /
Resource Hash
de5341313a4dc5d982ca50ae4a491e84bc5e80b0f439d87f05fc3973c1b7e59a
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://arcade.my/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nf-request-id
01FXQGZHDYPW1HVD0S8JGA0Z08
content-security-policy
script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
x-content-type-options
nosniff
age
0
content-length
92
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
Netlify
x-frame-options
SAMEORIGIN
date
Wed, 09 Mar 2022 14:22:59 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0, must-revalidate
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
etag
"56191f1d05b1700681bbd84be67710c2-ssl"
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored object| webpackChunk_N_E object| __BUILD_MANIFEST object| __SSG_MANIFEST object| __MIDDLEWARE_MANIFEST

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://arcade.my/_next/static/css/752127aeafd8da2d.css
Message:
Failed to load resource: the server responded with a status of 500 ()
network error URL: https://arcade.my/_next/static/chunks/webpack-514908bffb652963.js
Message:
Failed to load resource: the server responded with a status of 500 ()
network error URL: https://arcade.my/_next/static/chunks/main-d98b4a7f39fdfc80.js
Message:
Failed to load resource: the server responded with a status of 500 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'self' 'unsafe-eval' https://cdn.usefathom.com https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com; object-src 'none'; base-uri 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block