urlscan.io logo urlscan.io
SecurityTrails logo

wediliv.cognito.cz Open in urlscan Pro
92.119.65.136  Public Scan

Go To Rescan Add Verdict Report
URL: https://wediliv.cognito.cz/
Submission: On June 24 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 92.119.65.136, located in Czech Republic and belongs to G2SERVER, CZ. The main domain is wediliv.cognito.cz.
TLS certificate: Issued by R11 on June 23rd 2024. Valid for: 3 months.
This is the only time wediliv.cognito.cz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
9 92.119.65.136 202682 (G2SERVER)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
12 3
Apex Domain
Subdomains		 Transfer
9 cognito.cz
wediliv.cognito.cz
316 KB
3 typekit.net
use.typekit.net — Cisco Umbrella Rank: 649
p.typekit.net — Cisco Umbrella Rank: 807
55 KB
12 2
Domain Requested by
9 wediliv.cognito.cz wediliv.cognito.cz
2 use.typekit.net wediliv.cognito.cz
use.typekit.net
1 p.typekit.net use.typekit.net
12 3

This site contains links to these domains. Also see Links.

Domain
www.cognito.cz
Subject Issuer Validity Valid
wediliv.cognito.cz
R11		 2024-06-23 -
2024-09-21		 3 months crt.sh
use.typekit.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-02-01 -
2025-03-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://wediliv.cognito.cz/
Frame ID: 06D8E2BEC0EC14D05EAFE2D1AF17319B
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Rezervace svatby | Wediliv.com

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-controller
Overall confidence: 100%
Detected patterns
  • <link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

371 kB
Transfer

1002 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
wediliv.cognito.cz/ 		25 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
e63bb494383b07c7544714c6ce59fe748229c4a2b3a651ea0d8d454f06a6bc9b
Security Headers
Name Value
Content-Security-Policy default-src http://*.hotjar.com:* https://*.hotjar.com:* http://*.hotjar.io https://*.hotjar.io wss://*.hotjar.com https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
max-age=0, must-revalidate, private, s-maxage=240
content-encoding
gzip
content-security-policy
default-src http://*.hotjar.com:* https://*.hotjar.com:* http://*.hotjar.io https://*.hotjar.io wss://*.hotjar.com https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:;
content-type
text/html; charset=UTF-8
date
Mon, 24 Jun 2024 14:22:17 GMT
expires
Mon, 24 Jun 2024 14:22:17 GMT
permissions-policy
geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
referrer-policy
no-referrer-when-downgrade
strict-transport-security
max-age=15724800; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-forwarded-port
443
x-forwarded-proto
https
x-frame-options
SAMEORIGIN
x-generator
Sulu/2.5.10
x-permitted-cross-domain-policies
master-only
x-xss-protection
1; mode=block
lzv7nxx.css
use.typekit.net/ 		3 KB
951 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/lzv7nxx.css
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
4a44050e9a068eaed67828ab3e11ea54db5c2327ff900f925206d56e97d6662e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Mon, 24 Jun 2024 14:22:17 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
728
app.a4c4ea9a.css
wediliv.cognito.cz/build/ 		157 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
46be84fdb855c841d87f5fe7297b09f17b897fd44e4bd5b9850ef8b92f28d315
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
W/"667880d5-275b3"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=31536000, public
expires
Tue, 24 Jun 2025 14:22:17 GMT
runtime.a91ac323.js
wediliv.cognito.cz/build/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/runtime.a91ac323.js
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
9dea3dcdf5c2039b9884e24662d0aab5fae028f4268a35bb01f26610764f0d7d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
W/"667880d5-f2d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Tue, 24 Jun 2025 14:22:17 GMT
578.f98e5146.js
wediliv.cognito.cz/build/ 		632 KB
184 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/578.f98e5146.js
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
37c37b4b81230f5549526e1cc4f805bd7cfe637a16bdaa415582723d58d9af32
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
W/"667880d5-9dfcc"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Tue, 24 Jun 2025 14:22:17 GMT
app.b71d1739.js
wediliv.cognito.cz/build/ 		45 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/app.b71d1739.js
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
81d2eb35055474eb5b079b8a4556cc44e59a33f17cccbeda4c9c769453490602
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
content-encoding
gzip
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
W/"667880d5-b4e3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000, public
expires
Tue, 24 Jun 2025 14:22:17 GMT
p.css
p.typekit.net/ 		5 B
173 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://p.typekit.net/p.css?s=1&k=lzv7nxx&ht=tk&f=24425.24426.24427.34517&a=582817&app=typekit&e=css
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/lzv7nxx.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1495 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://use.typekit.net/lzv7nxx.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
last-modified
Sun, 19 May 2024 12:57:48 GMT
server
nginx
etag
"6649f74c-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
l
use.typekit.net/af/003616/00000000000000007735ebd7/30/ 		54 KB
54 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/003616/00000000000000007735ebd7/30/l?primer=9534f20d24153432f138f14be19fe00ed05018076afc824dd1a6f6ca76bae7c7&fvd=n7&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/lzv7nxx.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1490 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
52adf4e015c4fab80a10dc690548fdec1828231864ac9f9212187afd051f8a51

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://use.typekit.net/lzv7nxx.css
Origin
https://wediliv.cognito.cz
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:18 GMT
server
nginx
etag
"f28a355e0f8ff7ef74f1ba14e125f41ba2b81833"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
54796
CabinetGrotesk-Regular.36628114.woff2
wediliv.cognito.cz/build/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/fonts/CabinetGrotesk-Regular.36628114.woff2
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
90ef3ec3532a1ba9c6809fe97bb991d90fa0466e56697ba28370209410fd7e3d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Origin
https://wediliv.cognito.cz
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
"667880d5-4f6c"
content-type
font/woff2
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
20332
expires
Tue, 24 Jun 2025 14:22:18 GMT
CabinetGrotesk-Variable.625aff7c.woff2
wediliv.cognito.cz/build/fonts/ 		41 KB
41 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/fonts/CabinetGrotesk-Variable.625aff7c.woff2
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
8d5d1213c3913508dcf8b2c76c8c0a91a559529736fab33ad89a5c7030a1d8d9
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Origin
https://wediliv.cognito.cz
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
"667880d5-a3c0"
content-type
font/woff2
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
41920
expires
Tue, 24 Jun 2025 14:22:18 GMT
CabinetGrotesk-Medium.467bcdaa.woff2
wediliv.cognito.cz/build/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/build/fonts/CabinetGrotesk-Medium.467bcdaa.woff2
Requested by
Host: wediliv.cognito.cz
URL: https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
b641ecaaeda27cf0d560bf26058e9bc9997ac7bfdc58414f9df2d4d58a32c34b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/build/app.a4c4ea9a.css
Origin
https://wediliv.cognito.cz
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:17 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Sun, 23 Jun 2024 20:08:53 GMT
etag
"667880d5-4f24"
content-type
font/woff2
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
20260
expires
Tue, 24 Jun 2025 14:22:18 GMT
favicon-32x32.png
wediliv.cognito.cz/images/favicon/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://wediliv.cognito.cz/images/favicon/favicon-32x32.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.119.65.136 , Czech Republic, ASN202682 (G2SERVER, CZ),
Reverse DNS
Software
/
Resource Hash
3741d9dd433f01139d71e287215c63d6c7a9536ef568c75311c34f4c1c9cbeec
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://wediliv.cognito.cz/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 14:22:18 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Wed, 03 Apr 2024 13:16:02 GMT
etag
"660d5692-4fc"
content-type
image/png
cache-control
max-age=31536000, public
accept-ranges
bytes
content-length
1276
expires
Tue, 24 Jun 2025 14:22:18 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| webpackChunk function| hotkeys function| Inputmask function| _ function| SimpleLightbox

1 Cookies

Domain/Path Name / Value
wediliv.cognito.cz/ Name: SULUSESSID
Value: 6986edc570544dfa74f35de084351456

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src http://*.hotjar.com:* https://*.hotjar.com:* http://*.hotjar.io https://*.hotjar.io wss://*.hotjar.com https: data: 'unsafe-inline' 'unsafe-eval'; img-src 'self' data: https:;
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block