urlscan.io logo urlscan.io
SecurityTrails logo

status.r2d2.top Open in urlscan Pro
87.89.2.125  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://status.r2d2.top/
Effective URL: https://status.r2d2.top/status/1
Submission: On June 17 via api from US — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 87.89.2.125, located in La Croix-en-Touraine, France and belongs to BOUYGTEL-ISP, FR. The main domain is status.r2d2.top.
TLS certificate: Issued by R10 on June 16th 2024. Valid for: 3 months.
This is the only time status.r2d2.top was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 10 87.89.2.125 5410 (BOUYGTEL-ISP)
13 2
Apex Domain
Subdomains		 Transfer
10 r2d2.top
status.r2d2.top
571 KB
13 1
Domain Requested by
10 status.r2d2.top 1 redirects status.r2d2.top
13 1

This site contains no links.

Subject Issuer Validity Valid
status.r2d2.top
R10		 2024-06-16 -
2024-09-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://status.r2d2.top/status/1
Frame ID: B0ABF6F12727CF8F40E1F831D26E6A52
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Status page 1

Page URL History Show full URLs

  1. https://status.r2d2.top/ HTTP 302
    https://status.r2d2.top/status/1 Page URL

Page Statistics

13
Requests

69 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

571 kB
Transfer

2051 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://status.r2d2.top/ HTTP 302
    https://status.r2d2.top/status/1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 1
status.r2d2.top/status/
Redirect Chain
  • https://status.r2d2.top/
  • https://status.r2d2.top/status/1
4 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
fa24d34f791e2c5601dde4a0a21dc7b0a1eaa736045612599be73abdec7c2ae9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
fr-FR,fr;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-cache
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=utf-8
date
Mon, 17 Jun 2024 05:12:22 GMT
permissions-policy
interest-cohort=()
server
nginx
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-sso-wat
You've just been SSOed
x-xss-protection
1; mode=block

Redirect headers

content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=utf-8
date
Mon, 17 Jun 2024 05:12:22 GMT
location
/status/1
permissions-policy
interest-cohort=()
server
nginx
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-sso-wat
You've just been SSOed
x-xss-protection
1; mode=block
index-adc7bba6.js
status.r2d2.top/assets/ 		2 MB
476 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/assets/index-adc7bba6.js
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
c9d0da1c480d56338d09b2b6c911681fffccf213e856374c8c2ac0518cb62118
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/status/1
Origin
https://status.r2d2.top
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
486762
x-xss-protection
1; mode=block
last-modified
Sat, 30 Dec 2023 21:48:02 GMT
server
nginx
etag
W/"76d6a-18cbcb2c650"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
accept-ranges
bytes
index-fc5855ea.css
status.r2d2.top/assets/ 		299 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/assets/index-fc5855ea.css
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
fc5855eae3fb551dafd1e71a189c7dc536d3fd20c2f5a0ed65e5eb737e5d34ff
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/status/1
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
44997
x-xss-protection
1; mode=block
last-modified
Sat, 30 Dec 2023 21:48:02 GMT
server
nginx
etag
W/"afc5-18cbcb2c650"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=UTF-8
cache-control
public, max-age=0
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
accept-ranges
bytes
ynh_portal.js
status.r2d2.top/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/ynh_portal.js
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/status/1
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:22 GMT
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
server
nginx
x-permitted-cross-domain-policies
none
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
text/html
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
x-xss-protection
1; mode=block
ynh_overlay.css
status.r2d2.top/ 		0
0
custom_portal.js
status.r2d2.top/ynhtheme/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/ynhtheme/custom_portal.js
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/status/1
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:22 GMT
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
server
nginx
x-permitted-cross-domain-policies
none
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
text/html
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
x-xss-protection
1; mode=block
custom_overlay.css
status.r2d2.top/ynhtheme/ 		0
0
ynh_overlay.css
status.r2d2.top/ 		0
0
custom_overlay.css
status.r2d2.top/ynhtheme/ 		0
0
fr-FR-443ad952.js
status.r2d2.top/assets/ 		55 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/assets/fr-FR-443ad952.js
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/assets/index-adc7bba6.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
b2dd561ba02fcc47b046ead401d2b8368fda801d998b6f59c158a7c21c036940
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/assets/index-adc7bba6.js
Origin
https://status.r2d2.top
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
21130
x-xss-protection
1; mode=block
last-modified
Sat, 30 Dec 2023 21:48:02 GMT
server
nginx
etag
W/"528a-18cbcb2c650"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=0
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
accept-ranges
bytes
icon.svg
status.r2d2.top/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://status.r2d2.top/icon.svg
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
1f7b4df28ef01c74e334382dab159d96b2ff145ac835b5d2febbbc4166857831
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/status/1
Origin
https://status.r2d2.top
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-length
617
x-xss-protection
1; mode=block
last-modified
Sat, 30 Dec 2023 21:48:02 GMT
server
nginx
etag
W/"269-18cbcb2c650"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=0
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
accept-ranges
bytes
1
status.r2d2.top/api/status-page/heartbeat/ 		23 KB
23 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://status.r2d2.top/api/status-page/heartbeat/1
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/assets/index-adc7bba6.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
43dcff9e921e052db79e95ba6b40ce659806fcb4c016db25097cb6c61f02c0de
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/json, text/plain, */*
Referer
https://status.r2d2.top/status/1
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:23 GMT
content-security-policy
upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
server
nginx
x-permitted-cross-domain-policies
none
etag
W/"5a55-/0PaTgilhAxFwp12scTT65u0C00"
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
application/json; charset=utf-8
cache-control
no-cache
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
content-length
23125
x-xss-protection
1; mode=block
icon.svg
status.r2d2.top/ 		1 KB
435 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://status.r2d2.top/icon.svg
Requested by
Host: status.r2d2.top
URL: https://status.r2d2.top/status/1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.89.2.125 La Croix-en-Touraine, France, ASN5410 (BOUYGTEL-ISP, FR),
Reverse DNS
87-89-2-125.abo.bbox.fr
Software
nginx /
Resource Hash
1f7b4df28ef01c74e334382dab159d96b2ff145ac835b5d2febbbc4166857831
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://status.r2d2.top/status/1
Accept-Language
fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 05:12:23 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
gzip
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
content-length
617
x-xss-protection
1; mode=block
last-modified
Sat, 30 Dec 2023 21:48:02 GMT
server
nginx
etag
W/"269-18cbcb2c650"
x-download-options
noopen
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
public, max-age=0
permissions-policy
interest-cohort=()
x-sso-wat
You've just been SSOed
accept-ranges
bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
status.r2d2.top
URL
https://status.r2d2.top/ynh_overlay.css
Domain
status.r2d2.top
URL
https://status.r2d2.top/ynhtheme/custom_overlay.css
Domain
status.r2d2.top
URL
https://status.r2d2.top/ynh_overlay.css
Domain
status.r2d2.top
URL
https://status.r2d2.top/ynhtheme/custom_overlay.css

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| preloadData number| uidEvent object| __VUE_INSTANCE_SETTERS__ object| FontAwesomeConfig object| ___FONT_AWESOME___ object| Prism boolean| __VUE__ boolean| __vite_is_modern_browser

0 Cookies

8 Console Messages

Source Level URL
Text
security error URL: https://status.r2d2.top/status/1
Message:
Refused to apply style from 'https://status.r2d2.top/ynh_overlay.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security error URL: https://status.r2d2.top/status/1
Message:
Refused to apply style from 'https://status.r2d2.top/ynhtheme/custom_overlay.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network error URL: https://status.r2d2.top/ynh_portal.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://status.r2d2.top/ynhtheme/custom_portal.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://status.r2d2.top/status/1
Message:
Refused to execute script from 'https://status.r2d2.top/ynh_portal.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security error URL: https://status.r2d2.top/status/1
Message:
Refused to execute script from 'https://status.r2d2.top/ynhtheme/custom_portal.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security error URL: https://status.r2d2.top/status/1
Message:
Refused to apply style from 'https://status.r2d2.top/ynh_overlay.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
security error URL: https://status.r2d2.top/status/1
Message:
Refused to apply style from 'https://status.r2d2.top/ynhtheme/custom_overlay.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block