Submitted URL: http://heibox.uni-heidelberg.de/
Effective URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Submission: On October 25 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 129.206.7.113, located in Bad Schoenborn, Germany and belongs to BELWUE BelWue-Koordination, DE. The main domain is heibox.uni-heidelberg.de.
TLS certificate: Issued by DFN-Verein Global Issuing CA on October 13th 2022. Valid for: a year.
This is the only time heibox.uni-heidelberg.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 13 129.206.7.113 553 (BELWUE Be...)
11 1
Apex Domain
Subdomains
Transfer
13 uni-heidelberg.de
heibox.uni-heidelberg.de
160 KB
11 1
Domain Requested by
13 heibox.uni-heidelberg.de 2 redirects heibox.uni-heidelberg.de
11 1

This site contains no links.

Subject Issuer Validity Valid
heibox.uni-heidelberg.de
DFN-Verein Global Issuing CA
2022-10-13 -
2023-11-13
a year crt.sh

This page contains 1 frames:

Primary Page: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Frame ID: 18A1A9EFC4172CB67DAD47404903830B
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Anmelden - heiBOX

Page URL History Show full URLs

  1. http://heibox.uni-heidelberg.de/ HTTP 301
    https://heibox.uni-heidelberg.de/ HTTP 302
    https://heibox.uni-heidelberg.de/accounts/login/?next=/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

160 kB
Transfer

594 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://heibox.uni-heidelberg.de/ HTTP 301
    https://heibox.uni-heidelberg.de/ HTTP 302
    https://heibox.uni-heidelberg.de/accounts/login/?next=/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
heibox.uni-heidelberg.de/accounts/login/
Redirect Chain
  • http://heibox.uni-heidelberg.de/
  • https://heibox.uni-heidelberg.de/
  • https://heibox.uni-heidelberg.de/accounts/login/?next=/
12 KB
4 KB
Document
General
Full URL
https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
e01181133d72e84662f4bf412830a9c58f3d518bc40a3cba00b97d368356a4a3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store, must-revalidate
content-encoding
gzip
content-language
de
content-length
3646
content-type
text/html; charset=utf-8
date
Wed, 25 Oct 2023 10:05:28 GMT
expires
Wed, 25 Oct 2023 10:05:28 GMT
heibox-webserver
heibox-web03
referrer-policy
origin-when-cross-origin
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
vary
Cookie,Accept-Language,Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

content-language
de
content-length
0
content-type
text/html; charset=utf-8
date
Wed, 25 Oct 2023 10:05:28 GMT
heibox-webserver
heibox-web03
location
/accounts/login/?next=/
referrer-policy
origin-when-cross-origin
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
vary
Accept-Language,Cookie
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
seafile-ui.css
heibox.uni-heidelberg.de/media/css/
276 KB
42 KB
Stylesheet
General
Full URL
https://heibox.uni-heidelberg.de/media/css/seafile-ui.css
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
6092029fecc148c5d2c3ec3c3e1d4a7f9fa47d655fbd1fb22ed22596816adc14
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:17:20 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
text/css
x-xss-protection
1; mode=block
seahub.css
heibox.uni-heidelberg.de/media/css/
43 KB
10 KB
Stylesheet
General
Full URL
https://heibox.uni-heidelberg.de/media/css/seahub.css?t=1398068110
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
99bd69196807e72c2fe544d2772c185fe66df28676d167b50b7a8e668df1f3c5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:22:03 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
text/css
x-xss-protection
1; mode=block
iconfont.css
heibox.uni-heidelberg.de/media/css/sf_font3/
4 KB
3 KB
Stylesheet
General
Full URL
https://heibox.uni-heidelberg.de/media/css/sf_font3/iconfont.css
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
00433b92f8d09981b08fa8ca1bc0f42b0069ea985f105084f1d51dabbed13c47
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:22:03 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
text/css
content-length
2846
x-xss-protection
1; mode=block
urz.css
heibox.uni-heidelberg.de/media/custom/
74 KB
5 KB
Stylesheet
General
Full URL
https://heibox.uni-heidelberg.de/media/custom/urz.css
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
ab47d6cbea58b5ba307766191d196e0317b14a721affddd6e618f3b7a3ddc52c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Mon, 22 Aug 2022 15:31:46 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
text/css
content-length
5260
x-xss-protection
1; mode=block
heibox_logo.png
heibox.uni-heidelberg.de/media/custom/img/
8 KB
8 KB
Image
General
Full URL
https://heibox.uni-heidelberg.de/media/custom/img/heibox_logo.png
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
c6ee13cc74f57af51dc28882c22b2bff2b4969c55ddf283f5fa722bf37008264
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
strict-transport-security
max-age=15768000; includeSubDomains
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Mon, 22 Aug 2022 15:32:00 GMT
server
Apache
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie
content-language
de
content-type
image/png
content-length
8013
x-xss-protection
1; mode=block
jquery.min.dc5e7f18c8d3.js
heibox.uni-heidelberg.de/media/assets/scripts/lib/
87 KB
30 KB
Script
General
Full URL
https://heibox.uni-heidelberg.de/media/assets/scripts/lib/jquery.min.dc5e7f18c8d3.js
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:22:03 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
application/javascript
x-xss-protection
1; mode=block
jquery.simplemodal.55150926fcd1.js
heibox.uni-heidelberg.de/media/assets/scripts/lib/
22 KB
7 KB
Script
General
Full URL
https://heibox.uni-heidelberg.de/media/assets/scripts/lib/jquery.simplemodal.55150926fcd1.js
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
4411f89daf89f2875d22fe6a9d9dd52a679561e486f345fac29f4ce350b13a83
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:22:03 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
application/javascript
content-length
6942
x-xss-protection
1; mode=block
jq.min.js
heibox.uni-heidelberg.de/media/js/
3 KB
1 KB
Script
General
Full URL
https://heibox.uni-heidelberg.de/media/js/jq.min.js
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
0137f974c07f8e235137eed648e5a4c8a443633957acbf98346c433dc0617675
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:17:20 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
application/javascript
x-xss-protection
1; mode=block
base.js
heibox.uni-heidelberg.de/media/js/
21 KB
6 KB
Script
General
Full URL
https://heibox.uni-heidelberg.de/media/js/base.js?t=1536127546642
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/accounts/login/?next=/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
f1947dee4410728028aac0d03e4d1a85171b0d172911449bab630ab006a11ee3
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://heibox.uni-heidelberg.de/accounts/login/?next=/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:17:20 GMT
server
Apache
strict-transport-security
max-age=15768000; includeSubDomains
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie,Accept-Encoding
content-language
de
content-type
application/javascript
content-length
6515
x-xss-protection
1; mode=block
fontawesome-webfont.woff
heibox.uni-heidelberg.de/media/css/font/
43 KB
43 KB
Font
General
Full URL
https://heibox.uni-heidelberg.de/media/css/font/fontawesome-webfont.woff?v=3.0.1
Requested by
Host: heibox.uni-heidelberg.de
URL: https://heibox.uni-heidelberg.de/media/css/seahub.css?t=1398068110
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
129.206.7.113 Bad Schoenborn, Germany, ASN553 (BELWUE BelWue-Koordination, DE),
Reverse DNS
heibox.uni-heidelberg.de
Software
Apache /
Resource Hash
18e6b5ff511b90edf098e62ac45ed9d6673a3eee10165d0de4164d4d02a3a77f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://heibox.uni-heidelberg.de/media/css/seahub.css?t=1398068110
Origin
https://heibox.uni-heidelberg.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date
Wed, 25 Oct 2023 10:05:28 GMT
strict-transport-security
max-age=15768000; includeSubDomains
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
last-modified
Thu, 18 Mar 2021 07:17:20 GMT
server
Apache
heibox-webserver
heibox-web03
x-frame-options
SAMEORIGIN
vary
Accept-Language,Cookie
content-language
de
content-type
font/woff
content-length
43572
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| SEAFILE_GLOBAL object| app function| $ function| jQuery function| addConfirmTo function| showConfirm function| addFormPost function| getCaretPos function| setCaretPos function| filesizeformat function| e function| getCookie function| prepareCSRFToken function| apply_form_error function| feedback function| disable function| enable function| trimFilename function| addAnchorsToHeaders function| HTMLescape function| userInputOPtionsForSelect2 object| FileTree function| quotaSizeFormat function| encodePath function| prepareAjaxErrorMsg function| ajaxErrorHandler object| $el number| elHeight number| wdHeight function| setCaptchaInputWidth

2 Cookies

Domain/Path Name / Value
heibox.uni-heidelberg.de/ Name: sfcsrftoken
Value: 8Gv3VcIMaGSP8ku2xL3Y1AcFutd7vv62W84pCosVEvmW4NMkUgRJdi7GNMvlvqok
heibox.uni-heidelberg.de/ Name: sessionid
Value: a2j6mdlyi7sq4tyn5czq76j6o52hu6vc

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block