URL: https://empleado.grupofernandez.es/
Submission: On August 11 via automatic, source certstream-suspicious — Scanned from ES

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 213.151.117.220, located in Terrassa, Spain and belongs to ASALPI Barcelona SPAIN, ES. The main domain is empleado.grupofernandez.es.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 15th 2021. Valid for: a year.
This is the only time empleado.grupofernandez.es was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 213.151.117.220 12386 (ASALPI Ba...)
10 1
Apex Domain
Subdomains
Transfer
10 grupofernandez.es
empleado.grupofernandez.es
212 KB
10 1
Domain Requested by
10 empleado.grupofernandez.es empleado.grupofernandez.es
10 1

This site contains no links.

Subject Issuer Validity Valid
empleado.grupofernandez.es
DigiCert SHA2 Extended Validation Server CA
2021-07-15 -
2022-08-15
a year crt.sh

This page contains 1 frames:

Primary Page: https://empleado.grupofernandez.es/
Frame ID: 5D864F27D36CADEEFE97540D1028449D
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Inicio

Detected technologies

Overall confidence: 100%
Detected patterns
  • <input[^>]+name="__VIEWSTATE

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

212 kB
Transfer

318 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
empleado.grupofernandez.es/
9 KB
10 KB
Document
General
Full URL
https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
bec645c3124347b44f4162ed76905609d689455cbcec669df0fd35e36a13e195
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Cache-Control
no-cache, no-store, max-age=0
Content-Length
9329
Content-Security-Policy
frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Content-Type
text/html; charset=utf-8
Date
Thu, 11 Aug 2022 06:29:39 GMT
Pragma
no-cache
Server
Microsoft-IIS/8.5
Strict-Transport-Security
max-age=630720000; includeSubdomains
X-AspNet-Version
2.0.50727
X-Content-Type-Options
nosniff
X-Frame-Options
Deny
X-Powered-By
ASP.NET
X-XSS-Protection
1;mode=block
estilos.css
empleado.grupofernandez.es/
27 KB
27 KB
Stylesheet
General
Full URL
https://empleado.grupofernandez.es/estilos.css
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
439516e5aaac5f8e4fbe927934837b245f6e5cd9ee9202fa5c5d7849574e0d6f

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Thu, 11 Aug 2022 06:29:39 GMT
Last-Modified
Mon, 15 Apr 2019 13:17:45 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"1b8209d8df3d41:0"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
27473
jquery-3.3.0.min.js
empleado.grupofernandez.es/js/
85 KB
85 KB
Script
General
Full URL
https://empleado.grupofernandez.es/js/jquery-3.3.0.min.js
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
453432f153a63654fa6f63c846eaf7ee9e8910165413ba3cc0f80cbeed7c302e

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Thu, 11 Aug 2022 06:29:39 GMT
Last-Modified
Mon, 15 Apr 2019 13:17:45 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"af726a9d8df3d41:0"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
86927
WebResource.axd
empleado.grupofernandez.es/
20 KB
21 KB
Script
General
Full URL
https://empleado.grupofernandez.es/WebResource.axd?d=dN7cMQ814U0DZ4v2PGmesq_Ld1JoxI_i69_9rxQh6KyZiWBbGh-q_sSNVzqGwRiEq0U96aJP7Fg8YDP-T7Hqg82tzIQ1&t=637899251183851734
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
0ba2f6756001669bdf934f9d79e8fd1ccf2028130c33a0510279581ec9dfd73a
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=630720000; includeSubdomains
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 Jun 2022 05:38:38 GMT
Server
Microsoft-IIS/8.5
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
X-Frame-Options
Deny
Content-Type
application/x-javascript
Cache-Control
public
Date
Thu, 11 Aug 2022 06:29:39 GMT
Content-Security-Policy
frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Content-Length
20794
X-XSS-Protection
1;mode=block
Expires
Fri, 11 Aug 2023 06:29:40 GMT
ScriptResource.axd
empleado.grupofernandez.es/
21 KB
5 KB
Script
General
Full URL
https://empleado.grupofernandez.es/ScriptResource.axd?d=2OKUJoPPTEp2q9ttG0YBtX3bsExbhqelL6RNVdj0ZfEj6n4oU7iMwJziRu8uLtA8PLB5ZHuenXNjLJpLI5TtSzi36Le0z_eP-V96_gsxyIRO7tpokpcVBc060sKmFJ7RmE1_TpJtGJjO6EWlKo5p4lE6Z5s1&t=661887c8
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
f407eaaca7adb84344e02cd92e043ef70373783fd2fb562f7acc154eb0ecee02
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Strict-Transport-Security
max-age=630720000; includeSubdomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Content-Length
4828
X-XSS-Protection
1;mode=block
Pragma
no-cache
Last-Modified
Thu, 11 Aug 2022 06:29:40 GMT
Server
Microsoft-IIS/8.5
Date
Thu, 11 Aug 2022 06:29:39 GMT
X-Frame-Options
Deny
Content-Type
application/x-javascript
Cache-Control
public
Content-Security-Policy
frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Expires
Fri, 11 Aug 2023 06:29:40 GMT
ScriptResource.axd
empleado.grupofernandez.es/
98 KB
28 KB
Script
General
Full URL
https://empleado.grupofernandez.es/ScriptResource.axd?d=FLIg75SzzFQkbMqUOoYBPkh85W5UMFxi5CpEMfelb2asjzF-vcsjxGv7E6_GjEVkbe2T9JAWIRIOSnfNgc2lkr0mM4ppktwXv1c3V6cKfq8kyLvAzsOaHG46tRm3igCKbsssXPNuVOUq8SxmE1oJxoFOtGfjC7j6OPfl2uAHQQq7YVDG0&t=3f4a792d
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
480a3e45f9ddef64ba0104b4c5eee83425ee1e367488111c9fedaf458eabe587
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Strict-Transport-Security
max-age=630720000; includeSubdomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Content-Length
27838
X-XSS-Protection
1;mode=block
Pragma
no-cache
Last-Modified
Thu, 11 Aug 2022 06:29:40 GMT
Server
Microsoft-IIS/8.5
Date
Thu, 11 Aug 2022 06:29:39 GMT
X-Frame-Options
Deny
Content-Type
application/x-javascript
Cache-Control
public
Content-Security-Policy
frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Expires
Fri, 11 Aug 2023 06:29:40 GMT
ScriptResource.axd
empleado.grupofernandez.es/
32 KB
9 KB
Script
General
Full URL
https://empleado.grupofernandez.es/ScriptResource.axd?d=FAqMLpFWj8Nj0Ohsc_A0N8-qNl_rVH22QRwjzIVQhTtrumcFJkP3hlndE6aWXFAzJH6g4L5FjF1uW4pgKI5zBzj_is-J40a3QAGq-R97FWQ0ZJVkmPgeA8gJkVgCehEVn8t3H02jiqmuWQToh_t7KbFPjBbo6GakXbS1e59bihMTiL8w0&t=3f4a792d
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
61784e2c4f15ee66cf7ea6ffdae08b841c2c6ea1303f027504bad1e852fb70d2
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Strict-Transport-Security
max-age=630720000; includeSubdomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
Content-Length
8907
X-XSS-Protection
1;mode=block
Pragma
no-cache
Last-Modified
Thu, 11 Aug 2022 06:29:40 GMT
Server
Microsoft-IIS/8.5
Date
Thu, 11 Aug 2022 06:29:39 GMT
X-Frame-Options
Deny
Content-Type
application/x-javascript
Cache-Control
public
Content-Security-Policy
frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Expires
Fri, 11 Aug 2023 06:29:40 GMT
WebResource.axd
empleado.grupofernandez.es/
3 KB
3 KB
Script
General
Full URL
https://empleado.grupofernandez.es/WebResource.axd?d=GX4Ltdpz-63WuB5UrpG2eujy0jjUbJWQBVMJnTN0HUNYXGPM0Fsi8B08ACHBGOjEYgkyB7HaB28yj2u5sCEO8dpGYxg1&t=637899251183851734
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
144524233f795d6a425b76f7ae5c0bb622b5f67e2e6ae73532ad526528ca07cf
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=630720000; includeSubdomains
X-Content-Type-Options
nosniff
Last-Modified
Sat, 04 Jun 2022 05:38:38 GMT
Server
Microsoft-IIS/8.5
X-AspNet-Version
2.0.50727
X-Powered-By
ASP.NET
X-Frame-Options
Deny
Content-Type
application/x-javascript
Cache-Control
public
Date
Thu, 11 Aug 2022 06:29:39 GMT
Content-Security-Policy
frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Content-Length
3005
X-XSS-Protection
1;mode=block
Expires
Fri, 11 Aug 2023 06:29:40 GMT
img-logotipo.jpg
empleado.grupofernandez.es/Imagenes/
22 KB
22 KB
Image
General
Full URL
https://empleado.grupofernandez.es/Imagenes/img-logotipo.jpg
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
ada2d1f97a2fb1408c69beff4044e552a2fbfaa659ee38fdb1ffc7b60dc2465b

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Thu, 11 Aug 2022 06:29:39 GMT
Last-Modified
Mon, 25 May 2020 08:53:38 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"a21c88fb7132d61:0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
22304
bg2.gif
empleado.grupofernandez.es/Imagenes/
1 KB
1 KB
Image
General
Full URL
https://empleado.grupofernandez.es/Imagenes/bg2.gif
Requested by
Host: empleado.grupofernandez.es
URL: https://empleado.grupofernandez.es/estilos.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
213.151.117.220 Terrassa, Spain, ASN12386 (ASALPI Barcelona SPAIN, ES),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
11b7f069affec0f21641ae699aea1a8a22ff0d18267c0dec3fc11adce3e47cbc

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://empleado.grupofernandez.es/estilos.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Thu, 11 Aug 2022 06:29:40 GMT
Last-Modified
Tue, 15 May 2018 07:01:50 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"8aa7d1981aecd31:0"
Content-Type
image/gif
Accept-Ranges
bytes
Content-Length
1100

Verdicts & Comments Add Verdict or Comment

106 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY string| Page_ValidationVer boolean| Page_IsValid boolean| Page_BlockSubmit object| Page_InvalidControlToBeFocused function| ValidatorUpdateDisplay function| ValidatorUpdateIsValid function| AllValidatorsValid function| ValidatorHookupControlID function| ValidatorHookupControl function| ValidatorHookupEvent function| ValidatorGetValue function| ValidatorGetValueRecursive function| Page_ClientValidate function| ValidatorCommonOnSubmit function| ValidatorEnable function| ValidatorOnChange function| ValidatedTextBoxOnKeyPress function| ValidatedControlOnBlur function| ValidatorValidate function| ValidatorSetFocus function| IsInVisibleContainer function| IsValidationGroupMatch function| ValidatorOnLoad function| ValidatorConvert function| ValidatorCompare function| CompareValidatorEvaluateIsValid function| CustomValidatorEvaluateIsValid function| RegularExpressionValidatorEvaluateIsValid function| ValidatorTrim function| RequiredFieldValidatorEvaluateIsValid function| RangeValidatorEvaluateIsValid function| ValidationSummaryOnSubmit function| Sys$Enum$parse function| Sys$Enum$toString function| Sys$Component$_setProperties function| Sys$Component$_setReferences function| $create function| $addHandler function| $addHandlers function| $clearHandlers function| $removeHandler function| $get function| $find string| __cultureInfo function| Type object| Sys object| _events function| WebForm_FindFirstFocusableChild function| WebForm_AutoFocus function| WebForm_CanFocus function| WebForm_IsFocusableTag function| WebForm_IsInVisibleContainer function| WebForm_OnSubmit object| Page_Validators object| rfVTxtUser boolean| Page_ValidationActive function| ValidatorOnSubmit

1 Cookies

Domain/Path Name / Value
empleado.grupofernandez.es/ Name: YODADemoApp
Value: bpulfg45uuxrs4jyt0vhc1z3

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'none'; base-uri 'self'; form-action 'self'
Strict-Transport-Security max-age=630720000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options Deny
X-Xss-Protection 1;mode=block