Submitted URL: https://univar-sds.thewercs.com/
Effective URL: https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Submission: On July 03 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 66.18.116.130, located in United States and belongs to ASN-FLEXENTIAL, US. The main domain is univar-sds.thewercs.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on May 20th 2024. Valid for: a year.
This is the only time univar-sds.thewercs.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 8 66.18.116.130 13649 (ASN-FLEXE...)
5 1
Apex Domain
Subdomains
Transfer
8 thewercs.com
univar-sds.thewercs.com
442 KB
5 1
Domain Requested by
8 univar-sds.thewercs.com 3 redirects univar-sds.thewercs.com
5 1

This site contains no links.

Subject Issuer Validity Valid
*.thewercs.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-05-20 -
2025-06-20
a year crt.sh

This page contains 1 frames:

Primary Page: https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Frame ID: A9ED02EA7AF684ED4AAC773CD3931F17
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Log In

Page URL History Show full URLs

  1. https://univar-sds.thewercs.com/ HTTP 302
    https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F Page URL

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

441 kB
Transfer

1176 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://univar-sds.thewercs.com/ HTTP 302
    https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://univar-sds.thewercs.com/favicon.ico HTTP 302
  • https://univar-sds.thewercs.com/Error/NotFound?aspxerrorpath=/favicon.ico HTTP 302
  • https://univar-sds.thewercs.com/Error/SendNotFound?error=1

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request LogIn
univar-sds.thewercs.com/LogIn/
Redirect Chain
  • https://univar-sds.thewercs.com/
  • https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
6 KB
3 KB
Document
General
Full URL
https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.18.116.130 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
unk.ulworkplace.com
Software
UL /
Resource Hash
60584e48231d8bd90c9211ec905bc0554f76ca101065b7f2ab5419cb82454343
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
null
cache-control
private
content-encoding
gzip
content-length
2618
content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
content-type
text/html; charset=utf-8
date
Wed, 03 Jul 2024 18:57:20 GMT
referrer-policy
strict-origin-when-cross-origin
robots
noindex, nofollow, noimageindex
server
UL
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-robots-tag
noindex, nofollow, noimageindex

Redirect headers

access-control-allow-origin
null
cache-control
private
content-length
143
content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
content-type
text/html; charset=utf-8
date
Wed, 03 Jul 2024 18:57:19 GMT
location
/LogIn/LogIn?ReturnUrl=%2F
referrer-policy
strict-origin-when-cross-origin
robots
noindex, nofollow, noimageindex
server
UL
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-robots-tag
noindex, nofollow, noimageindex
Univar_Logo.png
univar-sds.thewercs.com/Areas/WebViewer/Content/images/
17 KB
17 KB
Image
General
Full URL
https://univar-sds.thewercs.com/Areas/WebViewer/Content/images/Univar_Logo.png
Requested by
Host: univar-sds.thewercs.com
URL: https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.18.116.130 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
unk.ulworkplace.com
Software
UL /
Resource Hash
492933e975e701fe6d253cc99e119a9189dbef68592909661ff05bf295a80e88
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 19 Jun 2023 07:44:44 GMT
server
UL
robots
noindex, nofollow, noimageindex
etag
"07ebbe981a2d91:0"
date
Wed, 03 Jul 2024 18:57:20 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
null
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
content-length
17332
wvLibJS.js
univar-sds.thewercs.com/assets/Bundles/
753 KB
297 KB
Script
General
Full URL
https://univar-sds.thewercs.com/assets/Bundles/wvLibJS.js?WSWVersion=03.28.23
Requested by
Host: univar-sds.thewercs.com
URL: https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.18.116.130 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
unk.ulworkplace.com
Software
UL /
Resource Hash
f44701479c3a8fbbec4e4d5f351c196ee9df85168081cb443cb109cb268e3c2c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
robots
noindex, nofollow, noimageindex
date
Wed, 03 Jul 2024 18:57:20 GMT
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 03 Jul 2024 18:57:21 GMT
server
UL
vary
User-Agent,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
null
cache-control
public
x-robots-tag
noindex, nofollow, noimageindex
expires
Thu, 03 Jul 2025 18:57:21 GMT
wvAppJS.js
univar-sds.thewercs.com/assets/Bundles/
399 KB
124 KB
Script
General
Full URL
https://univar-sds.thewercs.com/assets/Bundles/wvAppJS.js?WSWVersion=03.28.23
Requested by
Host: univar-sds.thewercs.com
URL: https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.18.116.130 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
unk.ulworkplace.com
Software
UL /
Resource Hash
c14dafe3b750ca1738eda5ade5c3d16ebb1b4ab5219519fd41f6f53e81a69a3b
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
robots
noindex, nofollow, noimageindex
date
Wed, 03 Jul 2024 18:57:20 GMT
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 03 Jul 2024 18:57:21 GMT
server
UL
vary
User-Agent,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
null
cache-control
public
x-robots-tag
noindex, nofollow, noimageindex
expires
Thu, 03 Jul 2025 18:57:21 GMT
SendNotFound
univar-sds.thewercs.com/Error/
Redirect Chain
  • https://univar-sds.thewercs.com/favicon.ico
  • https://univar-sds.thewercs.com/Error/NotFound?aspxerrorpath=/favicon.ico
  • https://univar-sds.thewercs.com/Error/SendNotFound?error=1
362 B
480 B
Other
General
Full URL
https://univar-sds.thewercs.com/Error/SendNotFound?error=1
Protocol
H2
Server
66.18.116.130 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
unk.ulworkplace.com
Software
UL /
Resource Hash
c2b2d95162deacbdb09b8070ae9b86a9f28cfc512900ad82d4505217d92f82d6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://univar-sds.thewercs.com/LogIn/LogIn?ReturnUrl=%2F
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
date
Wed, 03 Jul 2024 18:57:23 GMT
robots
noindex, nofollow, noimageindex
content-length
362
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 03 Jul 2024 18:57:23 GMT
server
UL
vary
*
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
access-control-allow-origin
null
cache-control
public, no-store, max-age=0
x-robots-tag
noindex, nofollow, noimageindex
expires
Wed, 03 Jul 2024 18:57:23 GMT

Redirect headers

content-security-policy
default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
UL
robots
noindex, nofollow, noimageindex
date
Wed, 03 Jul 2024 18:57:23 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=utf-8
location
/Error/SendNotFound?error=1
access-control-allow-origin
null
cache-control
private
x-robots-tag
noindex, nofollow, noimageindex
content-length
144

Verdicts & Comments Add Verdict or Comment

159 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery object| ko function| tableToGrid object| xmlJsonClass function| Q string| _strAppRoot number| openWindowCount function| UIHelpers_Window_Open_thisWin function| UIHelpers_Window_Open function| getElement function| UIHelpers_SetDDLByValue function| UIHelper_IsControlKey function| UIHelpers_ForceTabNext function| UIHelpers_inCell function| UIHelpers_getCell function| UIHelpers_PromptF function| UIHelpers_PromptB function| UIHelpers_escClose function| UIHelper_CenterOnMouse function| UIHelper_HangOffMouse function| UIHelper_CenterInWindow function| UIHelpers_CenterWindow function| UIHelpers_AutoSizeDialog function| UIHelpers_SizeDialogToContents function| UIHelpers_CenterDialog function| UIHelpers_containerPosition function| UIHelpers_getContainerPosition object| UIHelpers_intScrollTimeout function| UIHelpers_scrollIntoView undefined| _objSmoothScroll function| UIHelpers_smoothScroll function| UIHelpers_clearClass function| UIHelpers_setClass function| UIHelpers_setDisplay function| UIHelpers_addTooltip function| UIHelpers_showFloatTip function| UIHelpers_HTMLEncode function| UIHelpers_HTMLDecode function| UIHelpers_hideFloatTip function| UIHelpers_createElement function| UIHelpers_positionFloatTip function| UIHelpers_setVisibility function| UIHelpers_GetParentNodeByTagName function| UIHelpers_GetParentNodeWithAttrib function| UIHelpers_GetAttribValue function| bodyContext boolean| _blnFilterLaunched number| _intFilterPhase object| _intFilterInterval function| cycleFilter undefined| _objBusy function| prepBusy function| showBusy function| hideBusy function| dumpArray function| dumpArrayElements function| noFeature function| UIHelpers_translate function| chr function| code2utf function| _utf8Encode function| UIHelpers_utf8Encode function| _utf8Decode function| UIHelpers_utf8Decode function| UIHelpers_GetCookie function| UIHelpers_SetCookie function| UIHelpers_CheckCheckbox function| UIHelpers_RegExprTextBox function| UIHelpers_AddUrlParameter function| UIHelpers_RadioValue function| UIHelpers_openModal function| UIHelpers_WaitCursor function| UIHelpers_ClearCursor function| UIHelpers_SetWait function| UIHelpers_toggalDisplay function| ignoreCarriageOnPaste function| ignoreCarriageKeyUpEvent function| parsexml function| HandleError function| stopProp function| UIHelpers_BindTryCloseOnEscAndEnterClass function| UIHelpers_LaunchNoAccessPage function| _addModelToWidget object| _modelsForWidget function| ucModalDialog_launch function| ucMDClassDef function| ucMD_launchModelessProt function| ucMD_launchProt function| ucMD_pbLaunch function| baseFlatten_1 function| Collection function| transformObj_1 function| cloneAr_1 function| cloneObj_1 function| SelectorCache object| wercsApp function| __extends function| jqGridWrapper function| treeViewWrapper boolean| PAGELOADED function| globalResizeWindow function| windowClose function| _evalParamFunction function| OpenDialogWidget function| OpenDialogWidgetConfigurable function| SetAndUpperTitleFromTextBox function| IsEnterKey function| ucMVCSelectFSL_SetFormat function| ucMVCSelectFSL_GetFormatId function| ucMVCSelectFSL_GetSubformatId function| ucMVCSelectFSL_GetLanguageId function| ucMVCSelectFSL_GetLanguageName function| ucMVCSelectFSL_GetFormatDesc function| ucMVCSelectFSL_GetSubformatDesc function| ucMVCSelectFSL_GetFormatSubformatDesc function| ucMVCSelectFSL_GetFormatSubformatLangDesc function| ucMVCSelectFSL_SaveFormatSubformat function| ucMVCSelectSearchSubSection_ClearSelection function| ucMVCSelectUsageDDL_GetSelectedUsage function| ucMVCSelectUsageDDL_SetUsage function| ucMVCSelectUsageDDL_SetupControlWithModel function| ucMVCSelectUsageDDL_InitWithValues function| ucMVCSelectUsageDDL_SetReadOnlyControl function| ucMVCSelectRule_SetRule function| ucMVCSelectRule_Refresh function| ucMVCSelectRule_GetSelectedRuleId function| ucMVCSelectRule_GetSelectedRuleName function| ucMVCSelectRuleGroup_SetRuleGroup function| ucMVCSelectRuleGroup_Remove function| ucMVCSelectRuleGroup_GetSelectedRuleGroupId function| ucMVCSelectRuleGroup_GetSelectedRuleGroupName function| ucMVCSelectRuleGroup_InitRuleGroupWithValues function| ucMVCSelectRuleGroup_SetReadOnlyControl function| ucMVCSelectRuleStream_SetRuleStream function| ucMVCSelectRuleStream_InitRuleStreamWithValues function| ucMVCSelectRuleStream_SetReadOnlyControl function| ucMVCSelectRuleStream_Remove function| ucMVCSelectRuleStream_GetSelectedRuleStreamId function| ucMVCSelectRuleStream_GetSelectedRuleStreamName function| ucMVCMuliItemCheckboxGrid_GetSelectedObjs function| ucMVCMuliItemCheckboxGrid_GetGrid function| ucMVCMuliItemCheckboxGrid_SetGridHeight function| ucMVCMuliItemCheckboxGrid_SetGridWidth function| ucMVCSelectFormatDDL_GetSelectedFormat function| ucMVCSelectFormatDDL_SetFormat object| webViewer undefined| resultsGrid undefined| docsGrid function| LinkPopup function| HelpPopup function| onCloseWindow function| WebViewerPage function| Grid function| stripTags function| stripContent

3 Cookies

Domain/Path Name / Value
univar-sds.thewercs.com/ Name: WebViewerSessionID
Value: 2hzypjwcdtrvurytrndpwx1e
univar-sds.thewercs.com/ Name: ASP.NET_SessionId
Value:
univar-sds.thewercs.com/ Name: __RequestVerificationToken
Value: cSWsSyGvydtsw4PQXaI7rphQMiqTfmhFlNvKeDXayxDFlghGkIy4VCAJGv6bm-hoFITl9ZufJzTAQrhMnBUIbUZXjdO2usHSlvyPo4Gn5PI1

1 Console Messages

Source Level URL
Text
network error URL: https://univar-sds.thewercs.com/Error/SendNotFound?error=1
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; frame-src 'self'; frame-ancestors 'self'; style-src 'unsafe-inline' 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; connect-src 'self' 'unsafe-inline' http://*.thewercs.local; img-src 'self' data:; font-src 'self' data:
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN