URL: https://login.thycotic.com.au/
Submission: On July 28 via automatic, source certstream-suspicious — Scanned from AU

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 45.60.36.37, located in United States and belongs to INCAPSULA, US. The main domain is login.thycotic.com.au.
TLS certificate: Issued by R3 on May 19th 2024. Valid for: 3 months.
This is the only time login.thycotic.com.au was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 45.60.36.37 19551 (INCAPSULA)
14 1
Apex Domain
Subdomains
Transfer
14 thycotic.com.au
login.thycotic.com.au
384 KB
14 1
Domain Requested by
14 login.thycotic.com.au login.thycotic.com.au
14 1

This site contains links to these domains. Also see Links.

Domain
thycotic.com
Subject Issuer Validity Valid
*.login.thycotic.com.au
R3
2024-05-19 -
2024-08-17
3 months crt.sh

This page contains 1 frames:

Primary Page: https://login.thycotic.com.au/
Frame ID: 8B88D0D984FCE309F2F658AC8836E8F7
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Thycotic One - Thycotic One - Identity

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • /_Incapsula_Resource

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

384 kB
Transfer

690 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
login.thycotic.com.au/
3 KB
2 KB
Document
General
Full URL
https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
17cb7d5cc2604d5c84b994551da76058ae4045e7c0c735357a6a0f0a0ccf5003
Security Headers
Name Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self'; img-src * data:; connect-src 'self'; frame-ancestors 'none'; report-uri https://login.thycotic.com.au/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-security-policy
default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self'; img-src * data:; connect-src 'self'; frame-ancestors 'none'; report-uri https://login.thycotic.com.au/CspReport
content-type
text/html; charset=utf-8
date
Sun, 28 Jul 2024 11:18:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-cdn
Imperva
x-content-type-options
nosniff
x-frame-options
DENY
x-iinfo
4-16973167-16973169 NNNN CT(6 23 0) RT(1722165484145 5) q(0 0 0 0) r(0 2) U12
x-openidconnect-server
ThycoticOne/2
x-xss-protection
1; mode=block
bootstrap.min.css
login.thycotic.com.au/css/
165 KB
37 KB
Stylesheet
General
Full URL
https://login.thycotic.com.au/css/bootstrap.min.css
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
dee6f2d7e1cdafc57682571f3746e177d8f60a619869696149ce7e5227d2079d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:04 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722acb876"
content-type
text/css
x-iinfo
4-16973167-16918249 2VNN RT(1722165484145 263) q(0 0 0 -1) r(1 1)
content-length
38178
font-awesome.min.css
login.thycotic.com.au/css/
30 KB
8 KB
Stylesheet
General
Full URL
https://login.thycotic.com.au/css/font-awesome.min.css
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
820e169ce24824066d9973fd4b6561aae9dcd6dbef6435da905d5a1d6482997c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:04 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722ae531c"
content-type
text/css
x-iinfo
4-16973167-16972390 2VNN RT(1722165484145 267) q(0 0 0 -1) r(1 1)
content-length
8332
site.min.css
login.thycotic.com.au/css/
4 KB
2 KB
Stylesheet
General
Full URL
https://login.thycotic.com.au/css/site.min.css?v=_NrLOiVcm10Jf-twcRCqbVYhP5O9DB9NtQyO4bGNxec
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
fcdacb3a255c9b5d097feb707110aa6d56213f93bd0c1f4db50c8ee1b18dc5e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:04 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:50:00 GMT
x-cdn
Imperva
etag
"1da950767d252e9"
content-type
text/css
x-iinfo
4-16973167-16970571 2VNN RT(1722165484145 269) q(0 0 0 -1) r(1 1)
content-length
1413
thycotic-logo-light.png
login.thycotic.com.au/images/
30 KB
30 KB
Image
General
Full URL
https://login.thycotic.com.au/images/thycotic-logo-light.png
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
59b873bcb90fbfd168a129b4a5cfd84d95ca8388d058f47ba0af13976d8ca083
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722ae5cd9"
content-type
image/png
x-iinfo
4-16973167-16869886 2VNN RT(1722165484145 272) q(0 0 0 -1) r(1 1)
content-length
30425
thycotic_check.png
login.thycotic.com.au/images/
26 KB
26 KB
Image
General
Full URL
https://login.thycotic.com.au/images/thycotic_check.png
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6315238d02788227e7fb6b4f1d58f5c4ba6efc34852c6991b1f9bc43161bf49d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:04 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722ae437d"
content-type
image/png
x-iinfo
4-16973167-16957493 2VNN RT(1722165484145 274) q(0 0 0 -1) r(1 1)
content-length
27005
jquery-3.6.0.min.js
login.thycotic.com.au/js/
87 KB
39 KB
Script
General
Full URL
https://login.thycotic.com.au/js/jquery-3.6.0.min.js
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:04 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722af779f"
content-type
application/javascript
x-iinfo
4-16973167-16973076 2VNN RT(1722165484145 284) q(0 0 0 -1) r(1 1)
content-length
39759
bootstrap.bundle.min.js
login.thycotic.com.au/js/
81 KB
30 KB
Script
General
Full URL
https://login.thycotic.com.au/js/bootstrap.bundle.min.js
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d876b078facc7382a4c6e25565819108619ca8f61a5174e4f0b7723cb3b7d345
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:05 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722af6f3b"
content-type
application/javascript
x-iinfo
4-16973167-16973078 2VNN RT(1722165484145 287) q(0 1 1 -1) r(6 6)
content-length
30466
site.min.js
login.thycotic.com.au/js/
6 KB
2 KB
Script
General
Full URL
https://login.thycotic.com.au/js/site.min.js?v=UeKD5nRZVsA5VSxwOCcmqKeNV1luxifOLksI3tMwfBg
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
51e283e6745956c039552c70382726a8a78d57596ec627ce2e4b08ded3307c18
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:05 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:50:00 GMT
x-cdn
Imperva
etag
"1da950767d24b27"
content-type
application/javascript
x-iinfo
4-16973167-16973179 2VNN RT(1722165484145 289) q(0 1 1 -1) r(1 6)
content-length
1922
_Incapsula_Resource
login.thycotic.com.au/
67 KB
16 KB
Script
General
Full URL
https://login.thycotic.com.au/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=358334485
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
8d583af06a35f6adc299e6b9595aee1f537400d1f11ec0b31441206493d8a166
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache, no-store
content-encoding
gzip
x-robots-tag
noindex
content-length
16561
content-type
application/javascript
open-sans-v29-latin-300.woff2
login.thycotic.com.au/fonts/
16 KB
17 KB
Font
General
Full URL
https://login.thycotic.com.au/fonts/open-sans-v29-latin-300.woff2
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/css/site.min.css?v=_NrLOiVcm10Jf-twcRCqbVYhP5O9DB9NtQyO4bGNxec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
25b0bc9dda8dd671aa7cc47201a3d2b019d51deb6c6cebe10c38ec352d4a1c96
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/css/site.min.css?v=_NrLOiVcm10Jf-twcRCqbVYhP5O9DB9NtQyO4bGNxec
Origin
https://login.thycotic.com.au
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722ae6bac"
content-type
font/woff2
x-iinfo
4-16973167-16973169 PNNN RT(1722165484145 414) q(0 0 0 -1) r(8 8) U12
accept-ranges
bytes
content-length
16812
open-sans-v29-latin-regular.woff2
login.thycotic.com.au/fonts/
16 KB
16 KB
Font
General
Full URL
https://login.thycotic.com.au/fonts/open-sans-v29-latin-regular.woff2
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/css/site.min.css?v=_NrLOiVcm10Jf-twcRCqbVYhP5O9DB9NtQyO4bGNxec
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
9434dddcdf38e072b039bb92f9e90639ec0e0563e8ff51604a60d91830c29289
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/css/site.min.css?v=_NrLOiVcm10Jf-twcRCqbVYhP5O9DB9NtQyO4bGNxec
Origin
https://login.thycotic.com.au
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722ae6b50"
content-type
font/woff2
x-iinfo
4-16973167-16973182 NNNY CT(7 29 0) RT(1722165484145 416) q(0 0 0 -1) r(0 8) U12
accept-ranges
bytes
content-length
16720
CspReport
login.thycotic.com.au/
0
111 B
Other
General
Full URL
https://login.thycotic.com.au/CspReport
Requested by
Host: login.thycotic.com.au
URL: https://login.thycotic.com.au/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=358334485
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self'; img-src * data:; connect-src 'self'; frame-ancestors 'none'; report-uri https://login.thycotic.com.au/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/csp-report

Response headers

x-openidconnect-server
ThycoticOne/2
date
Sun, 28 Jul 2024 11:18:06 GMT
content-security-policy
default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self'; img-src * data:; connect-src 'self'; frame-ancestors 'none'; report-uri https://login.thycotic.com.au/CspReport
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
x-cdn
Imperva
x-frame-options
DENY
x-iinfo
4-16973167-16973187 NNNY CT(7 25 0) RT(1722165484145 926) q(0 0 0 -1) r(0 5) U6
content-length
0
x-xss-protection
1; mode=block
favicon.ico
login.thycotic.com.au/
158 KB
158 KB
Other
General
Full URL
https://login.thycotic.com.au/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.36.37 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
89c140a0df6ea7b96de72cb6e25abeb268840ca43872ac05b3547a9057a8ac04
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://login.thycotic.com.au/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Sun, 28 Jul 2024 11:18:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Mon, 22 Apr 2024 22:48:04 GMT
x-cdn
Imperva
etag
"1da950722ac5332"
content-type
image/x-icon
x-iinfo
4-16973167-16973179 2VNN RT(1722165484145 1182) q(0 0 0 -1) r(2 2)
content-length
162098

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| bootstrap object| ThycoticOne object| _0x31c0 function| _0x031c

3 Cookies

Domain/Path Name / Value
.thycotic.com.au/ Name: visid_incap_1872800
Value: S4g6wSAsRpSOXdNrs3ZHzewopmYAAAAAQUIPAAAAAACsAnV+EuDfNY6u55F7YKoW
.thycotic.com.au/ Name: nlbi_1872800
Value: VDBpA8EluEi20XCBmU9iUQAAAAAhiVHhpPn07LoQpleN05si
.thycotic.com.au/ Name: incap_ses_971_1872800
Value: Po5KODKPeijrSZ7zdq95DewopmYAAAAAuQJvin+q1lbXGGBIJpj5Mw==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self'; img-src * data:; connect-src 'self'; frame-ancestors 'none'; report-uri https://login.thycotic.com.au/CspReport
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block