URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Submission: On November 17 via api from GB — Scanned from GB

Summary

This website contacted 15 IPs in 1 countries across 8 domains to perform 78 HTTP transactions. The main IP is 2606:4700:20::ac43:4580, located in United States and belongs to CLOUDFLARENET, US. The main domain is scotthelme.co.uk.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 31st 2023. Valid for: a year.
This is the only time scotthelme.co.uk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
17 2606:4700:20:... 13335 (CLOUDFLAR...)
5 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 99.86.4.99 16509 (AMAZON-02)
2 199.232.196.134 54113 (FASTLY)
8 151.101.192.134 54113 (FASTLY)
26 2600:9000:205... 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 54.186.23.98 16509 (AMAZON-02)
2 2600:9000:206... 16509 (AMAZON-02)
5 199.232.194.49 54113 (FASTLY)
1 199.232.192.134 54113 (FASTLY)
1 54.201.135.255 16509 (AMAZON-02)
78 15
Apex Domain
Subdomains
Transfer
31 disquscdn.com
c.disquscdn.com — Cisco Umbrella Rank: 5610
a.disquscdn.com — Cisco Umbrella Rank: 15117
772 KB
17 scotthelme.co.uk
scotthelme.co.uk
496 KB
11 disqus.com
scotthelme.disqus.com
disqus.com — Cisco Umbrella Rank: 1282
referrer.disqus.com — Cisco Umbrella Rank: 8050
128 KB
7 stripe.com
js.stripe.com — Cisco Umbrella Rank: 1287
q.stripe.com — Cisco Umbrella Rank: 7148
m.stripe.com — Cisco Umbrella Rank: 1249
142 KB
5 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223
192 KB
3 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 899
cloudflareinsights.com — Cisco Umbrella Rank: 881
7 KB
2 stripe.network
m.stripe.network — Cisco Umbrella Rank: 1354
18 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 335
310 KB
78 8
Domain Requested by
26 c.disquscdn.com disqus.com
c.disquscdn.com
17 scotthelme.co.uk scotthelme.co.uk
cdn.jsdelivr.net
8 disqus.com scotthelme.disqus.com
c.disquscdn.com
5 a.disquscdn.com c.disquscdn.com
5 cdnjs.cloudflare.com scotthelme.co.uk
cdnjs.cloudflare.com
3 q.stripe.com scotthelme.co.uk
3 js.stripe.com scotthelme.co.uk
js.stripe.com
2 m.stripe.network js.stripe.com
m.stripe.network
2 cloudflareinsights.com static.cloudflareinsights.com
2 scotthelme.disqus.com scotthelme.co.uk
scotthelme.disqus.com
2 cdn.jsdelivr.net scotthelme.co.uk
1 m.stripe.com m.stripe.network
1 referrer.disqus.com
1 static.cloudflareinsights.com scotthelme.co.uk
78 14
Subject Issuer Validity Valid
scotthelme.co.uk
Cloudflare Inc ECC CA-3
2023-03-31 -
2024-03-30
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
a.stripecdn.com
DigiCert SHA2 Extended Validation Server CA
2023-10-30 -
2024-01-25
3 months crt.sh
*.disqus.com
Sectigo RSA Domain Validation Secure Server CA
2023-04-13 -
2024-04-20
a year crt.sh
a.disquscdn.com
Amazon RSA 2048 M01
2023-08-31 -
2024-09-27
a year crt.sh
*.stripe.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-10-09 -
2024-01-18
3 months crt.sh
*.disquscdn.com
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-07-11 -
2024-08-11
a year crt.sh
m.stripe.com
DigiCert TLS RSA SHA256 2020 CA1
2023-10-05 -
2024-01-18
3 months crt.sh

This page contains 5 frames:

Primary Page: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Frame ID: E8153063DD58B721C088BDF76FE28EBC
Requests: 29 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
Frame ID: 59647267431FF1D8C6FE0FAF07847CF5
Requests: 26 HTTP requests in this frame

Frame: https://disqus.com/recommendations/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy
Frame ID: 4FE9E45B836DDB16A171EF23221E8719
Requests: 15 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Frame ID: CC1859FD800860D100E072F44DFDCC9D
Requests: 4 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 1E7A8C0E8E2C67319AD604E113DC42C4
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

A new security header: Referrer Policy

Detected technologies

Overall confidence: 100%
Detected patterns
  • js\.stripe\.com

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

78
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

14
Subdomains

15
IPs

1
Countries

2065 kB
Transfer

4840 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

78 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
scotthelme.co.uk/a-new-security-header-referrer-policy/
37 KB
11 KB
Document
General
Full URL
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c83734254b3d948b72aa3f077c457e9dff3405f6ad3082a728aeb1515512b86c
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

age
148820
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
82760a900998dc93-LHR
content-encoding
br
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-security-policy-report-only
script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=X_jun3P9f652ng2oLejcjM.UcHHEN2FL5Lf_oOWTu28-1700203845-0-AYrTa1tOXFsNSgESHLDKM_HfLXlln7UwfckfExWDy9fcPo-sfuk6kE6FrRp4-amSuhSidUiyYpMABiCh-Y-qvA1sxrvwgidmm0S9ws3brG7XoBUj7T0YuJb4MQDAGZ7Wpo6IkhjlS0hYOenv6KoZiGWz82ZbyZdmFDcxkYMeMLw5; report-to cf-csp-endpoint
content-type
text/html; charset=utf-8
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
cross-origin-opener-policy-report-only
same-origin; report-to="default"
cross-origin-resource-policy
same-site
date
Fri, 17 Nov 2023 06:50:45 GMT
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
ghost-age
0
ghost-cache
MISS
ghost-fastly
true
nel
{"report_to":"default","max_age":10886400}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true} {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=X_jun3P9f652ng2oLejcjM.UcHHEN2FL5Lf_oOWTu28-1700203845-0-AYrTa1tOXFsNSgESHLDKM_HfLXlln7UwfckfExWDy9fcPo-sfuk6kE6FrRp4-amSuhSidUiyYpMABiCh-Y-qvA1sxrvwgidmm0S9ws3brG7XoBUj7T0YuJb4MQDAGZ7Wpo6IkhjlS0hYOenv6KoZiGWz82ZbyZdmFDcxkYMeMLw5"}],"group":"cf-csp-endpoint","max_age":86400}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Cookie, Accept-Encoding
via
1.1 varnish, 1.1 varnish
x-cache
HIT, HIT
x-cache-hits
11, 1
x-cf-worker
true
x-content-type-options
nosniff
x-served-by
cache-ams21068-AMS, cache-lcy-eglc8600039-LCY
x-timer
S1700203845.144550,VS0,VE1
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
x-xss-pwnage
<script>alert('XSS');</script>
screen.css
scotthelme.co.uk/assets/built/
55 KB
12 KB
Stylesheet
General
Full URL
https://scotthelme.co.uk/assets/built/screen.css?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ac113864dba7493879cac2a3f413862bf7e363f20e31f542af0064bba6aff56

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
143879
cf-polished
origSize=56099
x-cache
HIT, HIT
status
200 OK
alt-svc
h3=":443"; ma=86400
ghost-fastly
true
x-request-id
b64b9439-b464-4526-99f9-11263fcd2764, b64b9439-b464-4526-99f9-11263fcd2764
x-served-by
cache-ams21049-AMS, cache-lcy-eglc8600061-LCY
last-modified
Thu, 28 Sep 2023 13:52:33 GMT
cf-bgj
minify
server
cloudflare
x-timer
S1700059966.024756,VS0,VE5
etag
W/"db23-18adc100ba5"
vary
Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mMxMQA%2F9gWKC4LPzcIsIBOiNvrbU4b4LaRBD7VsgzVGAJmHmB54jFDStOzlsxs5sEJZ0IL8sfxvXV61NS4nbFDxOizq5PjK%2B%2F8dvgQZ206HZO%2FtbAAvJjiCKqr4u9PGsi32GAYKmhfzof7SWvPM%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=UTF-8
cache-control
public, max-age=31536000
ghost-cache
MISS
cf-ray
82760a9099ffdc93-LHR
x-cache-hits
1, 1
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/
57 KB
11 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://scotthelme.co.uk/
Origin
https://scotthelme.co.uk
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
785178
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
10301
last-modified
Mon, 04 May 2020 16:10:08 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e60-e4d2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JCSlTGu%2BZ8DLzr1q1zJJAQzkdBhjDjmsJs4OE1YuAMix%2FiPxiYh2BrLzSxpDJwI8eSCsmNSV4XM3WaprvcP3Uvhr8AQoENyjjaLTdwxd6bUAEy0Ey1BOnUZ2%2FYFd0k0VfdmdU8Evs%2BsLtJAygB17xeyh"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82760a911e1fdd43-LHR
expires
Wed, 06 Nov 2024 06:50:45 GMT
beacon.min.js
static.cloudflareinsights.com/
20 KB
7 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
content-encoding
gzip
last-modified
Tue, 10 Oct 2023 21:38:13 GMT
server
cloudflare
etag
W/"2023.10.0"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
82760a9129340686-LHR
portal.min.js
cdn.jsdelivr.net/ghost/portal@~2.36/umd/
1019 KB
245 KB
Script
General
Full URL
https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc0a52161fd65cb7af2c0a314f145e3851f167de2b4e633b30bfca2f04ce09f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Origin
https://scotthelme.co.uk
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
13478
x-jsd-version
2.36.2
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-eddf8230037-FRA, cache-lcy-eglc8600048-LCY
x-jsd-version-type
version
server
cloudflare
etag
W/"feca1-3lvaHAuXoZ4MwL1tu+Fy8osLLeM"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OebKd5NHgdcM6UlNtY%2B8E0b6EWW%2Beoq4uBHXOWuCO5FxQACbWId5BTc9grWlKUoyPZXxRPhHWZzmw%2Fe6%2BQLNXCgm2UzYCGheikbIGYnpaoy3cQClfkUevghbn2OFXfIW3WlczhwMlzK4hywElpk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400
timing-allow-origin
*
cf-ray
82760a913fcc4167-LHR
/
js.stripe.com/v3/
554 KB
137 KB
Script
General
Full URL
https://js.stripe.com/v3/
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-99.fra6.r.cloudfront.net
Software
Cloudfront /
Resource Hash
f27e9ca75db1b778e94c55ffb6a1f471a2fab0761034b9ce0a233bc0866e6cc2
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:04 GMT
content-encoding
br
via
1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
age
42
x-amz-cf-pop
FRA6-C1
x-cache
Hit from cloudfront
last-modified
Thu, 16 Nov 2023 22:20:54 GMT
server
Cloudfront
etag
W/"735677db1390373c37dfd0233c992727"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=60
timing-allow-origin
*
x-amz-cf-id
4cMMNP24aPvdQMdLTdGDjYxAaHMaCIQ_oZacnCiKiz0zIgI4eaM_qQ==
sodo-search.min.js
cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/
197 KB
66 KB
Script
General
Full URL
https://cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/sodo-search.min.js
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
73e90bca3350ae511b91bb029abfdc78760e164530c9cfd8f1f5e5d007a254b4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Origin
https://scotthelme.co.uk
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
39017
x-jsd-version
1.1.1
content-encoding
br
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-served-by
cache-fra-etou8220075-FRA, cache-lcy-eglc8600077-LCY
x-jsd-version-type
version
server
cloudflare
etag
W/"313b2-PGFkfSo33Bwphw9PaHfsB1kMn/Y"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2xzwO%2B2PvGKNSZMQgQeeq0W9qUfFvsjUgyO7S7XiV4GRm5k4hXa6%2F12CVhWv0jDLrSKwh7EiTCI60SctI5meYDQd2%2FVj98sh6PnwiX5uHQ2DTYXqfpqNjzC7JL0d%2FnVvvxU562iOYL2ezjVwraI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=600, s-maxage=43200, stale-while-revalidate=600, stale-if-error=86400
timing-allow-origin
*
cf-ray
82760a913fce4167-LHR
cards.min.js
scotthelme.co.uk/public/
7 KB
3 KB
Script
General
Full URL
https://scotthelme.co.uk/public/cards.min.js?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b9c762be52fed9737a319df953c29ad448a7713a31a4ba0f76ab15013512ee6
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-encoding
br
age
143879
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams21062-AMS, cache-lcy-eglc8600025-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
x-timer
S1700059966.030269,VS0,VE1
etag
W/"431228c753b74a6958600d170f921e6d"
vary
Cookie, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
ghost-cache
MISS
x-cache-hits
1, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
x-cache
HIT, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
cf-ray
82760a909a0bdc93-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
cards.min.css
scotthelme.co.uk/public/
39 KB
7 KB
Stylesheet
General
Full URL
https://scotthelme.co.uk/public/cards.min.css?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5d13af659890fd7b44075923009ed754343dbc30f6f4fc385707b9c5cd852be

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
143879
x-cache
HIT, HIT
status
200 OK
alt-svc
h3=":443"; ma=86400
ghost-fastly
true
x-request-id
5814095a-68ca-4caa-8a3e-46e99f5cf23d, 5814095a-68ca-4caa-8a3e-46e99f5cf23d
x-served-by
cache-ams12757-AMS, cache-lcy-eglc8600023-LCY
server
cloudflare
x-timer
S1700059966.022112,VS0,VE1
etag
W/"4d2a9dce76d5235785c36574664916fc"
vary
Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i2%2FhnDKaG9Ue5LJirG0Q%2B4hs%2F8%2BkDdXpgu1XBzsz2qQNFtCmrhmCrOoazHN0Q24yp8Fthh%2B9DKqxj7O%2BT8cm462Hr%2F4lM7SrsoHtprruNB7nSfqQtbc9JiSI%2B%2BYpoob98%2FoXeb6nIysEORQ67p8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
public, max-age=31536000
ghost-cache
MISS
cf-ray
82760a909a00dc93-LHR
x-cache-hits
1, 1
member-attribution.min.js
scotthelme.co.uk/public/
2 KB
1020 B
Script
General
Full URL
https://scotthelme.co.uk/public/member-attribution.min.js?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b144beb896e0d7612e0eeab489e4e682adac07cbc139924ce892bde3ccd3605
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-encoding
br
age
143879
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams21044-AMS, cache-lcy-eglc8600076-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
x-timer
S1700059966.032932,VS0,VE1
etag
W/"909b42c515ee6c2aece5a3f270049f98"
vary
Cookie, Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
ghost-cache
MISS
x-cache-hits
1, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
x-cache
HIT, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
cf-ray
82760a909a0ddc93-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
profile-pic.jpg
scotthelme.co.uk/content/images/size/w100/2023/07/
2 KB
2 KB
Image
General
Full URL
https://scotthelme.co.uk/content/images/size/w100/2023/07/profile-pic.jpg
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae9ff848064ae601e1e067cacb4080c59795536ab0d1cbee7502efd1f389a0f9

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1992769
x-cache
HIT, HIT
status
200 OK
fastly-sec-ratelimit-10s
0.000
fastly-sec-ratelimit-1s
1.000
alt-svc
h3=":443"; ma=86400
content-length
1672
fastly-sec-ratelimit
false
ghost-fastly
true
x-request-id
6322ff77-3433-4aae-9f74-9952bf1a7e53, 6322ff77-3433-4aae-9f74-9952bf1a7e53
x-served-by
cache-ams21051-AMS, cache-lcy-eglc8600066-LCY
last-modified
Wed, 19 Jul 2023 11:34:30 GMT
server
cloudflare
x-timer
S1698211077.953454,VS0,VE1
etag
W/"688-1896dee2480"
vary
Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DbzeDh7el%2B2VkcdaZEmtWn9Xqy71%2FVTy2hL0oeWEvJak3Ti%2BynUXnNPoWZfbe4duw6ulriwZQ313BE24OGxrZDLWzIO7NCcTT68kBKpimgXdTwsVfn0XV%2BDib%2F%2FKcIMz%2BelJQAqLtPImXQI2Yt4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
fastly-sec-ratelimit-60s
0.000
accept-ranges
bytes
cf-ray
82760a909a03dc93-LHR
ghost-cache
MISS
x-cache-hits
230, 1
tables-min.css
cdnjs.cloudflare.com/ajax/libs/pure/0.6.0/
1 KB
1013 B
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/pure/0.6.0/tables-min.css
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0dcd739963697a57d39b01b97048f7e7db023993265b50c68c5556ccad90d70
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
352
last-modified
Mon, 04 May 2020 16:15:40 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fac-452"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kwxy9T70QTOFinZAOCnj1ztq1M3jWqhUaxv%2BEgKRtTJy0KBk%2BF4a87RlhQpFcnqoYDV1SF424EnwjwcLoBD9thEEKDbxBuE4ax%2FqPen%2BspVHfvZUEmuWlJ24H4vMJXPRLxh7u40e7Rgl%2FNPCzsPTJ79O"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82760a912f7d4596-LHR
expires
Wed, 06 Nov 2024 06:50:45 GMT
comment.min.js
scotthelme.co.uk/assets/js/
78 B
413 B
Script
General
Full URL
https://scotthelme.co.uk/assets/js/comment.min.js?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9d6db74e1b10cdf2978365da3c24799b6b4247eff404d0d687f35e9ec74ff8a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-encoding
br
age
143879
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams21060-AMS, cache-lcy-eglc8600028-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
x-timer
S1700059966.028550,VS0,VE1
etag
W/"4e-18adc100a80"
vary
Cookie, Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
ghost-cache
MISS
x-cache-hits
0, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
x-cache
MISS, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
last-modified
Thu, 28 Sep 2023 13:52:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
cf-ray
82760a909a04dc93-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
embed.js
scotthelme.disqus.com/
78 KB
25 KB
Script
General
Full URL
https://scotthelme.disqus.com/embed.js
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.232.196.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
5b36858753063aa3d064ea9fa66d2b97014a7c68fd56a837129781f5d159b2ae
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:45 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=300; includeSubdomains
Server
openresty
Age
0
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
25554
stapler.jpg
scotthelme.co.uk/content/images/2016/10/
418 KB
419 KB
Image
General
Full URL
https://scotthelme.co.uk/content/images/2016/10/stapler.jpg
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d283837093d62fdd660da568c71b19f2cf147891c84a5c39286cb4c532225d6

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache
HIT, HIT
status
200 OK
fastly-sec-ratelimit-10s
0.000
fastly-sec-ratelimit-1s
1.000
alt-svc
h3=":443"; ma=86400
content-length
428166
fastly-sec-ratelimit
false
ghost-fastly
true
x-request-id
a25afc6d-1b1c-422b-a698-1586e97b50e6, a25afc6d-1b1c-422b-a698-1586e97b50e6
x-served-by
cache-ams12722-AMS, cache-lcy-eglc8600068-LCY
last-modified
Wed, 09 Aug 2017 19:27:40 GMT
server
cloudflare
x-timer
S1700203845.238292,VS0,VE3
etag
W/"68886-15dc8777be0"
vary
Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DPaveYFVBVtLwE61eAZRObTZ2auEb9IGdfwVA0F6gg8reNy5kAGhQkTYd444sZp2BOUzN8IJqkIL4jv3xCy9bBMEgbx%2BnG%2FPdFlUvSKdhjep8eZVZmzEumNyWDVoCIuclD1SNz9XyWWqqbTpSNk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
fastly-sec-ratelimit-60s
0.000
accept-ranges
bytes
cf-ray
82760a909a05dc93-LHR
ghost-cache
MISS
x-cache-hits
24, 1
email-decode.min.js
scotthelme.co.uk/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://scotthelme.co.uk/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 16 Nov 2023 21:55:48 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65568fe4-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bJnc0b%2BlMX5RPo1fJIH6fiMybcHK1mNSCg5z%2FEjL2Feqp7YXznqJ74ZTVqVQxC0MQ0c00e%2FL4IO5C%2BKpgXrHKqFyaB%2F85Gx4PWtpoVh1L8wjB9BTNOwq8u4WdnFXeRtCqW%2FJxrWWSxSXFEviuCk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
82760a909a06dc93-LHR
expires
Sun, 19 Nov 2023 06:50:45 GMT
gallery.min.js
scotthelme.co.uk/assets/js/
204 B
2 KB
Script
General
Full URL
https://scotthelme.co.uk/assets/js/gallery.min.js?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15dc2da9717aa993f7123dc690407420eb835300d4c3f31b023d891c9c53ec63
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-encoding
br
age
143879
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams12726-AMS, cache-lcy-eglc8600045-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
x-timer
S1700059966.025438,VS0,VE1
etag
W/"cc-18adc100a51"
vary
Cookie, Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
ghost-cache
MISS
x-cache-hits
1, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
x-cache
HIT, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
last-modified
Thu, 28 Sep 2023 13:52:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
cf-ray
82760a909a08dc93-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/
86 KB
27 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Origin
https://scotthelme.co.uk
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1996020
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27748
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15851"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OovpRDxfpYHEx128oFJ4UiyCUEZMVTxXEAnidxW4QxeFihA75I%2FoPtniGL9ufSlAJ5q2Q8ZLZ92rqAOBcAviFNCVrR7telztr0THg8Ei6UyTLyLg3MXufG4BwQv5wSRB3W4izF3ZPa9QT0o7KrUlD3RK"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82760a911e20dd43-LHR
expires
Wed, 06 Nov 2024 06:50:45 GMT
jquery.fitvids.js
scotthelme.co.uk/assets/built/
2 KB
3 KB
Script
General
Full URL
https://scotthelme.co.uk/assets/built/jquery.fitvids.js?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1be498b1da16f5fdfed28c7c11aeb08c37295f71e1b57eb21511f765e5a8f994
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-encoding
br
age
143879
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams21080-AMS, cache-lcy-eglc8600025-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
x-timer
S1700059966.028994,VS0,VE1
etag
W/"766-18adc100c4b"
vary
Cookie, Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
ghost-cache
MISS
x-cache-hits
1, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
cf-polished
origSize=1894
x-cache
HIT, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
last-modified
Thu, 28 Sep 2023 13:52:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
cf-ray
82760a909a09dc93-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
member.min.js
scotthelme.co.uk/assets/js/
1 KB
2 KB
Script
General
Full URL
https://scotthelme.co.uk/assets/js/member.min.js?v=758dc13dde
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ada119dea6b0bf13d910e017b9e370154d15686b5c9e2ccb0cb08a0067dacc68
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
content-encoding
br
age
143879
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams12742-AMS, cache-lcy-eglc8600058-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
x-timer
S1700059966.029044,VS0,VE1
etag
W/"54e-18adc1009e8"
vary
Cookie, Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000
ghost-cache
MISS
x-cache-hits
1, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
x-cache
HIT, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
last-modified
Thu, 28 Sep 2023 13:52:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
cf-ray
82760a909a0adc93-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
grade-a-1.png
scotthelme.co.uk/content/images/size/w2000/2017/02/
25 KB
26 KB
Image
General
Full URL
https://scotthelme.co.uk/content/images/size/w2000/2017/02/grade-a-1.png
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0608b4bcf1bf6037265fa8d478103598425d2352c9ad7e7890606c6f2b2d5845

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
134519
x-cache
HIT, HIT
status
200 OK
alt-svc
h3=":443"; ma=86400
content-length
25489
ghost-fastly
true
x-request-id
f1f90197-98a5-4623-bf30-45e91c01ae84, f1f90197-98a5-4623-bf30-45e91c01ae84
x-served-by
cache-ams12738-AMS, cache-lcy-eglc8600073-LCY
last-modified
Mon, 01 Jun 2020 11:19:12 GMT
server
cloudflare
x-timer
S1700069326.312467,VS0,VE1
etag
W/"6391-1726f9b5de9"
vary
Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AfEI6hEHfuqJSAXMrDVxGAhAf%2BPVc91e7FTwQWmuceDAdE%2FKr0EHK7kFK3QqnB%2BiD%2Bc33jZjXB83lhh88bY%2BR8p94d9ql5Gb%2Bk7dcWtpIJtepvsuQOvdz2HIUem22wzzSbaWFilWr0%2FbMIy8QEg%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
82760a916d67418e-LHR
ghost-cache
MISS
x-cache-hits
7, 1
fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/
75 KB
75 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/fa-brands-400.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d66b4e8556dec780a3be1e72c2bacfac5f379f6977f2886254908e5f87db6bd6
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Origin
https://scotthelme.co.uk
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1908180
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
76612
last-modified
Mon, 04 May 2020 16:10:08 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e60-12b44"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DGzg3t2YrOcLNvcRGrXOUCj04WzTXqLAzXKwp13sVpa1O%2FUpulgWjpbdNRVkvoJYe4S3FTWpLuIuWP%2FoWThyz5541MfZ9adVyC%2FlXVik6ivWQ4slUYKozQ9XrOf2klCcmYXkGoDhMystyawYj8SNkMW8"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82760a917e52dd43-LHR
expires
Wed, 06 Nov 2024 06:50:45 GMT
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/
78 KB
78 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Origin
https://scotthelme.co.uk
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
565244
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
79444
last-modified
Mon, 04 May 2020 16:10:08 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e60-13654"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pUXgD4wVSsfX4b6zxQrwE39K9Groq%2F1d6HbHwztbiJMEfBYLDyat%2FPsF1eRRzmHSiw05MPSl4J0e7DLynbNsUoUWrJzPRoy1vTO2FxZIjb%2FibqJoz49MjVyJnZyaVLyrqhPTpEXnHi32di4gThY9Bpwb"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82760a917e53dd43-LHR
expires
Wed, 06 Nov 2024 06:50:45 GMT
/
scotthelme.co.uk/members/api/member/
0
0
Fetch
General
Full URL
https://scotthelme.co.uk/members/api/member/
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
x-cf-worker
true
content-security-policy
default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
age
148941
cross-origin-resource-policy
same-site
ghost-fastly
true
x-served-by
cache-ams21061-AMS, cache-lcy-eglc8600028-LCY
cross-origin-embedder-policy-report-only
require-corp; report-to="default"
referrer-policy
strict-origin-when-cross-origin
x-timer
S1700203846.538982,VS0,VE1
vary
Cookie, Accept-Encoding
access-control-allow-origin
*
cache-control
no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
ghost-cache
MISS
x-cache-hits
2, 1
date
Fri, 17 Nov 2023 06:50:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish
cf-cache-status
DYNAMIC
nel
{"report_to":"default","max_age":10886400}
x-content-type-options
nosniff
x-cache
HIT, HIT
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce
server
cloudflare
expect-ct
max-age=604800, report-uri="https://scotthelme.report-uri.com/r/d/ct/enforce"
report-to
{"group":"default","max_age":10886400,"endpoints":[{"url":"https://scotthelme.report-uri.com/a/d/g"}],"include_subdomains":true}
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-xss-pwnage
<script>alert('XSS');</script>
accept-ranges
bytes
cf-ray
82760a928e6b418e-LHR
cross-origin-opener-policy-report-only
same-origin; report-to="default"
/
scotthelme.co.uk/ghost/api/content/settings/
2 KB
2 KB
Fetch
General
Full URL
https://scotthelme.co.uk/ghost/api/content/settings/?key=05928c196e63cd7d49c10cd1e1&limit=all
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
760b33d22078ab5658cd8946118f499d73b8100a0d597a288ae738968bf8c86a

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
148941
content-security-policy-report-only
script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=N9kMY.vdKHNQDN2j6MxWV1m.ibGznZEJeyCHavgu5Do-1700203845-0-AYy4nRI9JjpTsAfrQQnzpYhfOFTjcJcdlECt4R_6vnf6W8XyDDDeN49RkvtfRyhEhrsuxpyrrqJlfz-N9NMJleYITtuoagsVyP5W7Pm4isr0o0tUtl4j3F-LlpdrZiBCz_qxAj570AvE2WoILx6-udwfA8CVqSzDG0Cnp0I35Z-D; report-to cf-csp-endpoint
x-cache
HIT, HIT
status
200 OK
content-version
v5.73
alt-svc
h3=":443"; ma=86400
ghost-fastly
true
x-request-id
d22872fe-a712-4ae0-98d3-39327b7d05e2, d22872fe-a712-4ae0-98d3-39327b7d05e2
x-served-by
cache-ams21033-AMS, cache-lcy-eglc8600079-LCY
server
cloudflare
x-timer
S1700203846.608440,VS0,VE1
etag
W/"704-u3fflKfIP1Tr2Nf+Zf0HQ8QO2p0"
vary
Accept-Version, Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X4cvuMeqnYszudFdthzGV1Kkk%2FA0Q0zAwJD667MMGaFfFGL3DBWCIHhyxNaMoDGe6qHX%2F%2FSO1kPHWimC3w%2Bi0g4j579EaDQwjMZJCLkeI2axom2u4%2FYodshgujfymz7FE8Ugs2ixtA9LpXCpJ6k%3D"}],"group":"cf-nel","max_age":604800}, {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=N9kMY.vdKHNQDN2j6MxWV1m.ibGznZEJeyCHavgu5Do-1700203845-0-AYy4nRI9JjpTsAfrQQnzpYhfOFTjcJcdlECt4R_6vnf6W8XyDDDeN49RkvtfRyhEhrsuxpyrrqJlfz-N9NMJleYITtuoagsVyP5W7Pm4isr0o0tUtl4j3F-LlpdrZiBCz_qxAj570AvE2WoILx6-udwfA8CVqSzDG0Cnp0I35Z-D"}],"group":"cf-csp-endpoint","max_age":86400}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0
ghost-cache
MISS
cf-ray
82760a92fed9418e-LHR
x-cache-hits
2, 1
/
scotthelme.co.uk/ghost/api/content/tiers/
1 KB
1 KB
Fetch
General
Full URL
https://scotthelme.co.uk/ghost/api/content/tiers/?key=05928c196e63cd7d49c10cd1e1&limit=all&include=monthly_price,yearly_price,benefits
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ea7ca239ac3a5289d4530062cbe9637621e780f0563ccc64536e320532e651b

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
148941
x-cache
HIT, HIT
status
200 OK
content-version
v5.73
alt-svc
h3=":443"; ma=86400
ghost-fastly
true
x-request-id
e24bc63c-37bf-4299-b003-52daa69297e8, e24bc63c-37bf-4299-b003-52daa69297e8
x-served-by
cache-ams12758-AMS, cache-lcy-eglc8600041-LCY
server
cloudflare
x-timer
S1700203846.609858,VS0,VE1
etag
W/"5f3-CMuf3pQ1oERp5/eCwVpg2/pXiYk"
vary
Accept-Version, Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2wsuloZUVFweHwjdgV8VAbAySyhurhvXCz9h5WdejhCMBR18Ys%2FrOERfaMk2GkHntas%2BoB2u1LrC8cOKShKgz8FO%2BZDdbuVvfelwpvbC0g%2F2I%2F2FkqVXR7XFwOG1cKfB1%2FZLftoL3q%2Fpr8x%2BAIE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0
ghost-cache
MISS
cf-ray
82760a92feda418e-LHR
x-cache-hits
2, 1
/
scotthelme.co.uk/ghost/api/content/newsletters/
620 B
1 KB
Fetch
General
Full URL
https://scotthelme.co.uk/ghost/api/content/newsletters/?key=05928c196e63cd7d49c10cd1e1&limit=all
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::ac43:4580 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c166d53e28e811901c3b5dc54e78db3dce8c74f16391377ba65c6716201fd95b

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

ghost-age
0
date
Fri, 17 Nov 2023 06:50:45 GMT
via
1.1 varnish, 1.1 varnish
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
148941
x-cache
HIT, HIT
status
200 OK
content-version
v5.73
alt-svc
h3=":443"; ma=86400
ghost-fastly
true
x-request-id
3b28be58-6b58-456a-95c5-2fa38b69e76f, 3b28be58-6b58-456a-95c5-2fa38b69e76f
x-served-by
cache-ams21072-AMS, cache-lcy-eglc8600077-LCY
server
cloudflare
x-timer
S1700203846.609106,VS0,VE1
etag
W/"26c-D2TUdLmK+KojB10h0XpgT9G7av0"
vary
Accept-Version, Cookie, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wifFsPoKUVvnQ7nyn8hrgaC%2BxyuFOijZJwErVm%2FLtb05sQOMUdGL9U%2BlL5j1ps6NjLFhSk4dx1CO8B1B0Chs82Amv6cVV7g%2FcNNor%2B%2FDzbATs%2BVMQB6nMA%2F6p69RnHPr%2FsR2Ar%2FHtLQyZanq3D8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0
ghost-cache
MISS
cf-ray
82760a92fedb418e-LHR
x-cache-hits
2, 1
recommendations.js
scotthelme.disqus.com/
64 KB
22 KB
Script
General
Full URL
https://scotthelme.disqus.com/recommendations.js
Requested by
Host: scotthelme.disqus.com
URL: https://scotthelme.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.232.196.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
e75af9dc5cf8a23089f5bb701cfb62c33b42ba3749916729f8e1c02a6c1776c7
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:45 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=300; includeSubdomains
Server
openresty
Age
0
Vary
Accept-Encoding, Accept, Accept-Encoding, X-Forwarded-Proto, X-Disqus-Shortname, X-Disqus-Device, X-Disqus-Experiment, X-Disqus-Is-Private, X-Disqus-Development-Base
Content-Type
application/javascript; charset=utf-8
Cache-Control
stale-while-revalidate=60, public, stale-if-error=86400, max-age=60
X-Service
router
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
21372
/
disqus.com/embed/comments/ Frame 5964
113 KB
22 KB
Document
General
Full URL
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
Requested by
Host: scotthelme.disqus.com
URL: https://scotthelme.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
801e1cc38c802b8890caff1836070506bd7e498d9635182623669dfb52e2dd4e
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Age
0
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
Connection
keep-alive
Content-Encoding
gzip
Content-Length
21127
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type
text/html; charset=utf-8
Cross-Origin-Resource-Policy
cross-origin
Date
Fri, 17 Nov 2023 06:50:46 GMT
ETag
W/"lounge:view:5362682736.2edb5bf39b3ebfa33c43f703451be2f9.2"
Last-Modified
Thu, 09 Nov 2023 19:49:54 GMT
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Referrer-Policy
no-referrer-when-downgrade
Server
nginx
Strict-Transport-Security
max-age=300; includeSubdomains
Timing-Allow-Origin
*
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
/
disqus.com/recommendations/ Frame 4FE9
5 KB
3 KB
Document
General
Full URL
https://disqus.com/recommendations/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy
Requested by
Host: scotthelme.disqus.com
URL: https://scotthelme.disqus.com/recommendations.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b85fa58b4a5d59a48505b4a76f9fc68b083e8763d77bc921984d421c4a28d2ea
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Age
0
Cache-Control
stale-while-revalidate=30, no-cache, must-revalidate, stale-if-error=3600, public
Connection
keep-alive
Content-Encoding
gzip
Content-Length
2306
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://com-disqus.netmng.com:* 'unsafe-inline' https://referrer.disqus.com/juggler/ https://connect.facebook.net/en_US/sdk.js https://cdn.syndication.twimg.com/tweets.json https://apis.google.com https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Content-Type
text/html; charset=utf-8
Cross-Origin-Resource-Policy
cross-origin
Date
Fri, 17 Nov 2023 06:50:46 GMT
Last-Modified
Fri, 21 Jul 2023 16:13:01 GMT
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Server
nginx
Strict-Transport-Security
max-age=300; includeSubdomains
Timing-Allow-Origin
*
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
recommendations.load.6f9045c469ff6ff394e03c781e2a4d12.js
c.disquscdn.com/next/recommendations/ Frame 4FE9
923 B
1 KB
Script
General
Full URL
https://c.disquscdn.com/next/recommendations/recommendations.load.6f9045c469ff6ff394e03c781e2a4d12.js
Requested by
Host: disqus.com
URL: https://disqus.com/recommendations/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ff615e0555532d90883c0d3b64510249db528fd65a201d5345ca3ccfaf21c264
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 08 Nov 2023 17:25:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
739490
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
448
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 08 Nov 2023 16:20:23 GMT
server
nginx
etag
"654bb547-1c0"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
Dnm156VFNivJm4MAAMQBH9UMCEM9cQ4pRVSdmaiBrV3d_wCMIgTTOA==
expires
Thu, 07 Nov 2024 17:25:56 GMT
lounge.load.95c5f54d652b3a9f59f3cb30d7904a9e.js
c.disquscdn.com/next/embed/ Frame 5964
1 KB
1 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/lounge.load.95c5f54d652b3a9f59f3cb30d7904a9e.js
Requested by
Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
10a6ac1700dc75a5cb688da008860c245f8ff2c591ac95c3bdd8093e3ef68633
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 15 Nov 2023 20:42:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
122889
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
630
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Wed, 15 Nov 2023 20:36:05 GMT
server
nginx
etag
"65552bb5-276"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
LvCdRFVKqmPIofNEL-g6shKdLpAQ1VHFGwEcbQyHcs1lq-JAvsZX1w==
expires
Thu, 14 Nov 2024 20:42:36 GMT
common.bundle.333ad30e1f1c9323d996f231c4aca879.js
c.disquscdn.com/next/recommendations/ Frame 4FE9
262 KB
88 KB
Script
General
Full URL
https://c.disquscdn.com/next/recommendations/common.bundle.333ad30e1f1c9323d996f231c4aca879.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/recommendations.load.6f9045c469ff6ff394e03c781e2a4d12.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
7a421bb42bfbe4db5583d302d106d6249448998407ca50ee806fb9c2babc4a5e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 08 Nov 2023 17:25:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
739490
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
88923
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Wed, 08 Nov 2023 16:20:23 GMT
server
nginx
etag
"654bb547-15b5b"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
BcEERWGyeeMSm1iuUO7WcOUBy9Y7ArHMg5Na-3ncbU9PpcaT6F_Zqg==
expires
Thu, 07 Nov 2024 17:25:56 GMT
common.bundle.830e49a0658a776869ead04c9a88a6fc.js
c.disquscdn.com/next/embed/ Frame 5964
280 KB
93 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/common.bundle.830e49a0658a776869ead04c9a88a6fc.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.95c5f54d652b3a9f59f3cb30d7904a9e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
8505d8233b3c79b966130e48a46181cc2c26a8a82c2ffc92be25c37360cfe6f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 08 Nov 2023 17:26:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
739484
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
94211
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 08 Nov 2023 16:20:23 GMT
server
nginx
etag
"654bb547-17003"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
JYs94YPcNtJ-uEs08bCPWKCSBxzCw8csFrmnanY8sNx99wIA26IqJA==
expires
Thu, 07 Nov 2024 17:26:02 GMT
recommendations.10022a97346f1c6e3798931bbd8e4bb5.css
c.disquscdn.com/next/recommendations/styles/ Frame 4FE9
14 KB
3 KB
Stylesheet
General
Full URL
https://c.disquscdn.com/next/recommendations/styles/recommendations.10022a97346f1c6e3798931bbd8e4bb5.css
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.333ad30e1f1c9323d996f231c4aca879.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ad59b3c437a380375b4205e22d9bf50856690b094d2fa425ae90971f5b58758e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Sun, 08 Oct 2023 22:54:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
3398206
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2968
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 03 Oct 2023 15:33:15 GMT
server
nginx
etag
"651c343b-b98"
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
9TMMYYemhQUDbM1s9Ix3LAv4lrUMWl5x--tGlyXJzhKmqNy-jAIFtw==
expires
Mon, 07 Oct 2024 22:54:00 GMT
m-outer-27c67c0d52761104439bb051c7856ab1.html
js.stripe.com/v3/ Frame CC18
200 B
1 KB
Document
General
Full URL
https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-99.fra6.r.cloudfront.net
Software
Cloudfront /
Resource Hash
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
2091
cache-control
max-age=31536000
content-length
200
content-security-policy
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 17 Nov 2023 06:15:59 GMT
etag
"27c67c0d52761104439bb051c7856ab1"
last-modified
Mon, 13 Nov 2023 21:03:31 GMT
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
x-amz-cf-id
GSnXzkV6pYSnnz6kQ5TShWy5C4wcpo6QhQ-tHlJZNt_GybgtRTaRMw==
x-amz-cf-pop
FRA6-C1
x-cache
Hit from cloudfront
x-content-type-options
nosniff
recommendations.bundle.b1d305f840327c58f4ac9b236b8cd735.js
c.disquscdn.com/next/recommendations/ Frame 4FE9
66 KB
21 KB
Script
General
Full URL
https://c.disquscdn.com/next/recommendations/recommendations.bundle.b1d305f840327c58f4ac9b236b8cd735.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.333ad30e1f1c9323d996f231c4aca879.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
47d4cc8f41a50c8835c9f83a13ab174866b9f82a24ea590b854574a6773a071a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 31 Oct 2023 14:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
1442988
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
20373
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 31 Oct 2023 13:53:35 GMT
server
nginx
etag
"654106df-4f95"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
dOkNgBV2Ys7y78dGON8ci3ce4BFrpSrWV95Wbh7D90TuzAZLBDPlew==
expires
Wed, 30 Oct 2024 14:00:58 GMT
config.js
disqus.com/next/ Frame 4FE9
19 KB
19 KB
Script
General
Full URL
https://disqus.com/next/config.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.333ad30e1f1c9323d996f231c4aca879.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
26b75ee0a8e70853f95d8b82a28685da1f33a140e3e2a1920a07b0d739b33b11
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/recommendations/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:46 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
14
X-Frame-Options
SAMEORIGIN
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
19190
X-XSS-Protection
1; mode=block
rum
cloudflareinsights.com/cdn-cgi/ Frame
0
0
Preflight
General
Full URL
https://cloudflareinsights.com/cdn-cgi/rum
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://scotthelme.co.uk
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://scotthelme.co.uk
access-control-max-age
86400
cf-ray
82760a9a7f503dac-LHR
content-encoding
gzip
content-type
text/plain
date
Fri, 17 Nov 2023 06:50:46 GMT
server
cloudflare
vary
Origin
x-content-type-options
nosniff
x-frame-options
DENY
rum
cloudflareinsights.com/cdn-cgi/
0
37 B
XHR
General
Full URL
https://cloudflareinsights.com/cdn-cgi/rum
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

date
Fri, 17 Nov 2023 06:50:46 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://scotthelme.co.uk
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
82760a9acf943dac-LHR
lounge.dbc47866f009f9d6f1556cd58214d9a3.css
c.disquscdn.com/next/embed/styles/ Frame 5964
233 KB
33 KB
Stylesheet
General
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.830e49a0658a776869ead04c9a88a6fc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
61779c74768b5eb298860ceb7d7cf06f2b228fdc53df72b530490a792a5b8a59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 30 May 2023 18:53:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
14731046
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
33282
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 30 May 2023 18:28:53 GMT
server
nginx
etag
"64764065-8202"
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
bfQZf_6Wo-Q99gR8AX2T19HhZJ2ALddHqWpo_ehOjsNXFEE9-JQecw==
expires
Wed, 29 May 2024 18:53:20 GMT
lounge.bundle.914359974b527f0f97c1fcffe6572f2f.js
c.disquscdn.com/next/embed/ Frame 5964
513 KB
129 KB
Script
General
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.914359974b527f0f97c1fcffe6572f2f.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.830e49a0658a776869ead04c9a88a6fc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2b7331e32e23eebe9dd30f184d2f2a4174ac4fbe0bd2e19b0e5b39b46d335f83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 15 Nov 2023 20:42:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
122879
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
131026
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 15 Nov 2023 20:36:05 GMT
server
nginx
etag
"65552bb5-1ffd2"
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
timing-allow-origin
*
x-amz-cf-id
XHX4IhIUIV9pxBlt_G4dVcSt60OsGCHNYbrwJgR2fARweUvVohQL-Q==
expires
Thu, 14 Nov 2024 20:42:47 GMT
config.js
disqus.com/next/ Frame 5964
19 KB
19 KB
Script
General
Full URL
https://disqus.com/next/config.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.830e49a0658a776869ead04c9a88a6fc.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
26b75ee0a8e70853f95d8b82a28685da1f33a140e3e2a1920a07b0d739b33b11
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:46 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
15
X-Frame-Options
SAMEORIGIN
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Content-Type
application/javascript; charset=UTF-8
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
19190
X-XSS-Protection
1; mode=block
m-outer-6576085ca35ee42f2f484cda6763e4aa.js
js.stripe.com/v3/fingerprinted/js/ Frame CC18
631 B
1 KB
Script
General
Full URL
https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-4-99.fra6.r.cloudfront.net
Software
Cloudfront /
Resource Hash
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:32:16 GMT
via
1.1 f0a97a8c56cd2bb79a1739863489ed4c.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31556926; includeSubDomains; preload
age
2288
x-amz-cf-pop
FRA6-C1
x-cache
Hit from cloudfront
content-length
631
last-modified
Fri, 03 Nov 2023 20:07:01 GMT
server
Cloudfront
etag
"70cacf09ae81711ac6dcbc5ee59750c4"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
-uIM5SM3SduZfB-2fvtaXbd9KOMelSlS2HT4-md_Z2TV84fqq05_7g==
csp-report
q.stripe.com/ Frame CC18
0
716 B
Other
General
Full URL
https://q.stripe.com/csp-report
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700203847270661
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms
1
access-control-allow-origin
https://js.stripe.com
x-stripe-client-envoy-start-time-us
1700203847270207
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers
Server, Range, Content-Type
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
csp-report
q.stripe.com/ Frame CC18
0
715 B
Other
General
Full URL
https://q.stripe.com/csp-report
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700203847270571
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms
0
access-control-allow-origin
https://js.stripe.com
x-stripe-client-envoy-start-time-us
1700203847270186
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers
Server, Range, Content-Type
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
details
disqus.com/api/3.0/forums/ Frame 4FE9
3 KB
3 KB
XHR
General
Full URL
https://disqus.com/api/3.0/forums/details?forum=scotthelme&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.333ad30e1f1c9323d996f231c4aca879.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
98bf3eaae823398902ec770c0f05a7521f94d3e2b867f481d46e3d3a08ac719e
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/recommendations/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy
X-Requested-With
XMLHttpRequest
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:46 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Vary
Origin, Cookie
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type
application/json
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
3039
X-XSS-Protection
1; mode=block
details
disqus.com/api/3.0/forums/ Frame 5964
3 KB
3 KB
XHR
General
Full URL
https://disqus.com/api/3.0/forums/details?forum=scotthelme&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.830e49a0658a776869ead04c9a88a6fc.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
98bf3eaae823398902ec770c0f05a7521f94d3e2b867f481d46e3d3a08ac719e
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
X-Requested-With
XMLHttpRequest
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:46 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Vary
Origin, Cookie
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type
application/json
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
3039
X-XSS-Protection
1; mode=block
inner.html
m.stripe.network/ Frame 1E7A
930 B
2 KB
Document
General
Full URL
https://m.stripe.network/inner.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8200:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Cloudfront /
Resource Hash
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

accept-ranges
bytes
age
47
cache-control
max-age=300, public
content-length
930
content-security-policy
base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 17 Nov 2023 06:50:01 GMT
etag
"06bfcd88af438673a8bf9b845a11aa6e"
last-modified
Fri, 30 Jun 2023 14:32:28 GMT
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
Accept-Encoding, Origin
via
1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront)
x-amz-cf-id
Y0eg9o__36vC7whp6a0kTyF8Q8j9RIpgomgNVHyZYWzECnf_Juyk8A==
x-amz-cf-pop
FRA56-C1
x-cache
Hit from cloudfront
x-content-type-options
nosniff
listRecommendations.json
disqus.com/api/3.0/discovery/ Frame 4FE9
7 KB
7 KB
XHR
General
Full URL
https://disqus.com/api/3.0/discovery/listRecommendations.json?forum=scotthelme&thread=ident%3A5ad2388a6eb7640022c300f0&limit=8&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/recommendations/common.bundle.333ad30e1f1c9323d996f231c4aca879.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b8ce2ae760e9cf5b5dd2dca7b04ff552009c4079a9acd26df68ba2d045344285
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://disqus.com/recommendations/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy
X-Requested-With
XMLHttpRequest
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:46 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
1494
X-Frame-Options
SAMEORIGIN
Vary
Origin
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type
application/json
Cache-Control
stale-while-revalidate=450, public, max-age=1800
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
6815
X-XSS-Protection
1; mode=block
details.json
disqus.com/api/3.0/posts/ Frame 5964
2 KB
2 KB
XHR
General
Full URL
https://disqus.com/api/3.0/posts/details.json?post=3160597843&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.830e49a0658a776869ead04c9a88a6fc.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
62a703387b6adf63d3ad1372fe5431bda60c2095b18c8d0de09530035763f006
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
X-Requested-With
XMLHttpRequest
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:46 GMT
Strict-Transport-Security
max-age=300; includeSubdomains
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Vary
Origin, Cookie
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Content-Type
application/json
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
1991
X-XSS-Protection
1; mode=block
truncated
/ Frame 5964
37 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type
image/gif
svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
13 KB
13 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Thu, 21 Sep 2023 06:33:56 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
4925810
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
13079
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 20 Sep 2023 10:55:07 GMT
server
nginx
etag
"650acf8b-3317"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
ZSncsXiL7wv442Up3VKzE-jN0wNAa15C5ukYH95bCLny12DpvpKFtQ==
expires
Fri, 20 Sep 2024 06:33:56 GMT
loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 5964
3 KB
3 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Thu, 12 Jan 2023 03:03:01 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
26711265
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2971
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Fri, 06 Jan 2023 19:06:43 GMT
server
nginx
etag
"63b87143-b9b"
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
M_FBTc-wJ8sng7Al--hFZ5bYg0pOZjzd0n9SOfNteyu7CLLUc3ZpkA==
expires
Fri, 12 Jan 2024 03:03:01 GMT
email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
840 B
1 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/email.727e30eb9b6c1e85cb010b9c8eb04c7e.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 19 Apr 2023 18:37:18 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
18274408
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
840
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 18 Apr 2023 23:42:29 GMT
server
nginx
etag
"643f2ae5-348"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
-Ljk4RAjm_BMJhhsPqwKyIu9xRQUUuzTt1_kOnmo0ftwn0DQ54qkdg==
expires
Thu, 18 Apr 2024 18:37:18 GMT
privacy.8c96be6b50de1c3fab838c5f050e0be5.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
891 B
1 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/privacy.8c96be6b50de1c3fab838c5f050e0be5.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 26 Jul 2023 18:48:11 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
9806555
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
891
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 26 Jul 2023 16:31:55 GMT
server
nginx
etag
"64c14a7b-37b"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
R-bB_D_toyOBX0eD7ZUzw90OGXYmGOFiu3jM6L0l3ryIyONh1v-I1A==
expires
Thu, 25 Jul 2024 18:48:11 GMT
warning.3bc0b4bff6c268a4ceaf404014b9be42.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
605 B
1 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/warning.3bc0b4bff6c268a4ceaf404014b9be42.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Mon, 18 Sep 2023 00:48:06 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
5205759
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
605
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 13 Sep 2023 20:48:30 GMT
server
nginx
etag
"6502201e-25d"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
yVBhhBQ7O_KkYHVnGb2CwsvTkdvq0qaELXNtiuvi4sDseLuiJwmqcQ==
expires
Tue, 17 Sep 2024 00:48:06 GMT
sprite.ad630a07080a45451f139a7487853ff8.png
c.disquscdn.com/next/embed/assets/img/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/sprite.ad630a07080a45451f139a7487853ff8.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 17 Jan 2023 06:16:10 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
26267676
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1763
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Thu, 12 Jan 2023 21:51:05 GMT
server
nginx
etag
"63c080c9-6e3"
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
-1hegVvd2NDJkj098cpg2NMcphgwK8CluBwE37j0av9J4iZgXFdOig==
expires
Wed, 17 Jan 2024 06:16:10 GMT
icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 5964
8 KB
8 KB
Font
General
Full URL
https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Sat, 22 Jul 2023 02:00:22 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
10212624
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
7900
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 12 Jul 2023 14:04:56 GMT
server
nginx
etag
"64aeb308-1edc"
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
jxyt5Gr0vW-WOOdCiRDnGi2PrQNPoICl8fIA6HbtHXqqU4Bl4js6EA==
expires
Sun, 21 Jul 2024 02:00:22 GMT
noavatar92.png
a.disquscdn.com/1698341030/images/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://a.disquscdn.com/1698341030/images/noavatar92.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=300; includeSubdomains
x-content-type-options
nosniff
last-modified
Fri, 26 Feb 2021 20:50:09 GMT
server
nginx
x-amz-cf-pop
LHR50-P7
age
1515182
etag
"60395f01-66c"
content-type
image/png
cache-control
max-age=2592000
cross-origin-resource-policy
cross-origin
content-length
1644
x-amz-cf-id
heYJ7n7vnkDsZJ8z24WupQDGW5VKUy_cbt6EOXk2oR3AF08Lpfc3EA==
x-xss-protection
1; mode=block
expires
Wed, 29 Nov 2023 17:57:44 GMT
event.gif
referrer.disqus.com/juggler/ Frame 5964
43 B
339 B
Image
General
Full URL
https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&load_time=234&event=init_embed&thread=5362682736&forum=scotthelme&forum_id=2541595&imp=4kkb172nidhqh&thread_slug=a_new_security_header_referrer_policy&user_type=anon&referrer=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&theme=next&dnt=0&tracking_enabled=0&experiment=prebidbidisrequired_hidden&variant=active&service=dynamic&promoted_enabled=false&max_enabled=false
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
199.232.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Fri, 17 Nov 2023 06:50:47 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Content-Type
image/gif
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
get
c.disquscdn.com/ Frame 4FE9
90 KB
91 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2023%2F11%2Fec.png&key=YCPkideXD6tmeMIp47brRg&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
32e701fa9d47112c7727631c34ed8e29d30d4d5a0589a206598bd2a51a2200e4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Wed, 08 Nov 2023 11:32:19 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
830206
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
91877
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-2
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGpF5rO%2BvzlRQYSJbBgji4pVl6zVugNlkVFQWnxLYSC9FyeWAHU64QvvMZV4pPKdpSj5gZfiCXIYgopJLQqKmnitUjkfWY%2BNLBLka5wD5jRkTA1tZTJieReXAHyCY4lFs74%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
zUaIkDQjHQlX3rYFWG7Ryi7RVaSj6lnOIe3adZf_NTQp3DwRQZZUoA==
expires
Fri, 08 Dec 2023 11:32:19 GMT
get
c.disquscdn.com/ Frame 4FE9
9 KB
10 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2017%2F12%2FHTTPS_icon.png&key=7CSEPxpg9oogmZ0yvKYzUw&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
6b0687b6ffac02815214e08887a1446ef2dd4589cb219e615648ac3fc8c8b7a8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Wed, 15 Nov 2023 05:58:11 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
175956
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
9543
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-2
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TzAZumQVny4187MYawEVkmXEXEPVQ7gdCBsmt6sJ4kEW0%2FiUECstwpFmTRGHiXfEp5AkhfZVMBgIrmVlhQD4rezB4lLbG6DY46G2zROUa3H4F1oWFAVGC6qO3qF2Zh2x%2F7s%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
Vfo_nmy1gh_UBOBVJEz-3vjK70f1OzyJSuBUpidkRMeZKftrhc1YKw==
expires
Fri, 15 Dec 2023 05:58:11 GMT
get
c.disquscdn.com/ Frame 4FE9
8 KB
9 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2020%2F06%2Fblog-cover-image.jpg&key=6XjQ9ymB1Gfgh3slvyGKMg&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2249acd7b489ced259c5ae55814d95d4b0eb3c8c3b6427bc4e2c0c8ca34a0c93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Wed, 15 Nov 2023 05:58:11 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
208644
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
8666
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-1
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8GWnR1IgpA8iUDnl6xtrbveKGp6DsBNH3YUzBHEWA%2FjJy72Mk%2BsdZ%2F8%2F7L%2FTsHeOAaLdyvy%2FW2euYwhsr9tzr4W8AFBY%2Br4jellGMF400JHNCvCBCjePSD1xUmc3a937KgM%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
dW0CCKKMEuR2lHhyK1QkCpThp8YOKWID_XM3mZqBuUmyE8OSs3zILg==
expires
Fri, 15 Dec 2023 05:58:11 GMT
get
c.disquscdn.com/ Frame 4FE9
136 KB
137 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2023%2F11%2Fbanner-1.png&key=HLjguOp76LxKx8ujqA095Q&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
09dcddb3866d4fb1dcaa90bf39ee9301753653ca441a8a3166e6216cc91fdfcd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Wed, 15 Nov 2023 05:11:35 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
178752
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
139513
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-2
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KVxSpq6off8fg6brQ2qRHUQnjJ%2FVd6oWiuAyAuOl9QsDRkYZePRXlrOgJEFf%2BeBCYCb%2FB7GQ3CPlPsJfK6mCgwL6SeNZRbr%2FFT7l39WKQ0%2B6T5LbCMCgRbhfHkW%2FjXkg2z0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
T4u8o924qNs80whv4wRegFekEuVRcI8aSq2luv_XfG-q0LSnT1FRVg==
expires
Fri, 15 Dec 2023 05:11:35 GMT
get
c.disquscdn.com/ Frame 4FE9
85 KB
86 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2023%2F10%2Fbackground-backlog.png&key=8K-V8X2yDy91IJ6ZPXecOQ&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
52e3578c25a70e348674f5b5419768318c8b60ab024eb3fff82c811a82137a36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Wed, 15 Nov 2023 05:11:35 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
178752
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
87440
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-1
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VVuZ5iZfHF%2F19HMzcs%2B1dn2kDmjtakpSIHwv7Rhkr8ig7miy3Owv7cmWG24FJGsdAL5mcf9X%2BWe%2BU6sjeziZaWQk4wdvEKIjY1%2BF56YW%2BgXDfdAgQnfj5Tq%2FS6aw9JSeEc4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
c6UKbWnN4C4iHT8Hls-vCFOd2rvf7B4j8jwehoMztvfupb-Y4XAQQQ==
expires
Fri, 15 Dec 2023 05:11:35 GMT
get
c.disquscdn.com/ Frame 4FE9
8 KB
9 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2023%2F10%2FIMG_6162.jpeg&key=XP05LJouO9s6JxZdWXuzSw&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
f2c7361778d94f0d8700a3d07c6517436a83f287577bbc2ba53c52a85e316fe0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Wed, 01 Nov 2023 18:54:46 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
1426965
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
8355
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-1
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YRQB%2F2hDkK%2Fqp1LtNu0wdDsHGGwMg9rM5NoLLiM%2F25v2jS3vRD6hjSCG3bC46Mhqi6L2mHfGhhX%2BL98pzI%2FTkxUnNZpqMP%2BLFfsmte1oEFWllTE2jlknkl8Iz0qoKWEZhJM%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
j-thXcBEA6o-vLGuGTnL0G92LMBXueyoWHct12DsvBfUNCjROyC2iA==
expires
Fri, 01 Dec 2023 18:54:46 GMT
get
c.disquscdn.com/ Frame 4FE9
10 KB
11 KB
Image
General
Full URL
https://c.disquscdn.com/get?url=https%3A%2F%2Fscotthelme.co.uk%2Fcontent%2Fimages%2F2023%2F07%2Fvalidity-period.png&key=XYq_-xU7KzaldIFAFmRLMQ&h=200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2a699e143113c8ec6f1a170714b9bafeb038e8c4a59ffdf950dc81ec6997e758
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

ghost-age
0
date
Sun, 22 Oct 2023 23:17:54 GMT
via
1.1 varnish, 1.1 varnish, 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-cache-hits
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop
FRA6-C1
age
2187173
x-cache
Hit from cloudfront
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
status
200 OK
cross-origin-resource-policy
cross-origin, cross-origin, cross-origin
content-length
10040
ghost-fastly
true
x-xss-protection
1; mode=block
x-served-by
static-web-1
server
nginx
vary
Cookie,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sFicJS0Sqtzx6nxDfxQ418Ma2cASmf15ug4ip%2BCOIj1qLmKWw6RsIwB1vJAuBRCXStnh3IBboR%2Btr4MGf%2FTm09rh0WH2OgGcu0AkeRx%2BJ2dsOG9fY8lA%2FhZtjR2B6C9nQxE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=2592000
ghost-cache
MISS
accept-ranges
bytes
x-amz-cf-id
cu6AAg5l6NVpX41LoKJefay9bLSFMl3KZdkE1Fz5PBUGaOg_YTRfHA==
expires
Tue, 21 Nov 2023 23:17:54 GMT
pin.8357c3e8734b95d157afe368a2fbb6c8.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
2 KB
3 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/pin.8357c3e8734b95d157afe368a2fbb6c8.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
b573dec0fabeb95375c268432b00c7d3d0a24e679e4c3d7b56772d7c53f4c359
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 23 Aug 2023 07:34:09 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
7427798
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2407
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Mon, 21 Aug 2023 16:02:52 GMT
server
nginx
etag
"64e38aac-967"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
IPMbehnR4MUSqDONHJZCGI-PjBjiHVO0UEYIOghiwEkAS-F4qFJg7Q==
expires
Thu, 22 Aug 2024 07:34:09 GMT
follow-v2.411b1215980cdde315e43cc006cfbea6.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/follow-v2.411b1215980cdde315e43cc006cfbea6.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5ab9af97734b7a1b76e65a6aff767898e4dd763725c46ee56d340a5fd116e6a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Wed, 26 Jul 2023 00:34:16 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
9872191
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1557
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Tue, 25 Jul 2023 21:40:14 GMT
server
nginx
etag
"64c0413e-615"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
T-7EiU6s8tWI3pSTXHZkjPfZVAXd9SaMVYC8t4bmjiRNwR64hlILmw==
expires
Thu, 25 Jul 2024 00:34:16 GMT
like.855606fb4e3a7a6448e6c782f3f54e5a.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/like.855606fb4e3a7a6448e6c782f3f54e5a.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
3b8a8d998dd7dc014bdb52a01adea8ec1be82193e7e7c6e0c7067a58435b7c28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Sat, 21 Jan 2023 03:02:48 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
25933679
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1655
x-xss-protection
1; mode=block
x-served-by
static-web-2
surrogate-key
next
last-modified
Fri, 20 Jan 2023 22:02:55 GMT
server
nginx
etag
"63cb0f8f-677"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
2fSiBcLwSDDwb49Dy2VAr8RbwKah4uGNHxJeL5nbs2ntNfXwUfy20Q==
expires
Sun, 21 Jan 2024 03:02:48 GMT
dislike.612d8ba98928c381e4c789c1b309cda1.svg
c.disquscdn.com/next/embed/assets/img/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://c.disquscdn.com/next/embed/assets/img/dislike.612d8ba98928c381e4c789c1b309cda1.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:b600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
8bd3068a31f037d3d198e40d59ae6acf610e3550c11ebff7b6c66bdf8e8b2e3f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.dbc47866f009f9d6f1556cd58214d9a3.css
Origin
https://disqus.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-cache-hits
0
date
Sun, 23 Jul 2023 06:26:42 GMT
via
1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA6-C1
age
10110245
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
1796
x-xss-protection
1; mode=block
x-served-by
static-web-1
surrogate-key
next
last-modified
Wed, 12 Jul 2023 14:04:56 GMT
server
nginx
etag
"64aeb308-704"
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
utnQfV4pDwX9VuNXES5lK0A7zzTSqViyKd2jIThrIK6xXKEIQxGJ5A==
expires
Mon, 22 Jul 2024 06:26:42 GMT
noavatar92.png
a.disquscdn.com/1698341030/images/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://a.disquscdn.com/1698341030/images/noavatar92.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.914359974b527f0f97c1fcffe6572f2f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=300; includeSubdomains
x-content-type-options
nosniff
last-modified
Fri, 26 Feb 2021 20:50:09 GMT
server
nginx
x-amz-cf-pop
LHR50-P7
age
1515182
etag
"60395f01-66c"
content-type
image/png
cache-control
max-age=2592000
cross-origin-resource-policy
cross-origin
content-length
1644
x-amz-cf-id
heYJ7n7vnkDsZJ8z24WupQDGW5VKUy_cbt6EOXk2oR3AF08Lpfc3EA==
x-xss-protection
1; mode=block
expires
Wed, 29 Nov 2023 17:57:44 GMT
csp-report
q.stripe.com/ Frame 1E7A
0
490 B
Other
General
Full URL
https://q.stripe.com/csp-report
Requested by
Host: scotthelme.co.uk
URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700203847270856
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
x-stripe-server-envoy-upstream-service-time-ms
1
x-stripe-client-envoy-start-time-us
1700203847270195
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-robots-tag
none
expires
0
out-4.5.43.js
m.stripe.network/ Frame 1E7A
87 KB
16 KB
Script
General
Full URL
https://m.stripe.network/out-4.5.43.js
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/inner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:8200:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Cloudfront /
Resource Hash
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://m.stripe.network/inner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:48:49 GMT
content-encoding
gzip
via
1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront)
strict-transport-security
max-age=31556926; includeSubDomains; preload
last-modified
Fri, 30 Jun 2023 14:32:28 GMT
server
Cloudfront
age
119
x-content-type-options
nosniff
etag
W/"69cb7809b5011312e716f29b3d19dce6"
x-amz-cf-pop
FRA56-C1
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
cache-control
max-age=300, public
x-amz-cf-id
Ho9bEeRfvyvPuM66V6rk1TBeSP_v24S_OqM7y0u-EYXvj_wQJ9D2Bw==
noavatar92.png
a.disquscdn.com/1698341030/images/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://a.disquscdn.com/1698341030/images/noavatar92.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.914359974b527f0f97c1fcffe6572f2f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=300; includeSubdomains
x-content-type-options
nosniff
last-modified
Fri, 26 Feb 2021 20:50:09 GMT
server
nginx
x-amz-cf-pop
LHR50-P7
age
1515182
etag
"60395f01-66c"
content-type
image/png
cache-control
max-age=2592000
cross-origin-resource-policy
cross-origin
content-length
1644
x-amz-cf-id
heYJ7n7vnkDsZJ8z24WupQDGW5VKUy_cbt6EOXk2oR3AF08Lpfc3EA==
x-xss-protection
1; mode=block
expires
Wed, 29 Nov 2023 17:57:44 GMT
noavatar92.png
a.disquscdn.com/1698341030/images/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://a.disquscdn.com/1698341030/images/noavatar92.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.914359974b527f0f97c1fcffe6572f2f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=300; includeSubdomains
x-content-type-options
nosniff
last-modified
Fri, 26 Feb 2021 20:50:09 GMT
server
nginx
x-amz-cf-pop
LHR50-P7
age
1515182
etag
"60395f01-66c"
content-type
image/png
cache-control
max-age=2592000
cross-origin-resource-policy
cross-origin
content-length
1644
x-amz-cf-id
heYJ7n7vnkDsZJ8z24WupQDGW5VKUy_cbt6EOXk2oR3AF08Lpfc3EA==
x-xss-protection
1; mode=block
expires
Wed, 29 Nov 2023 17:57:44 GMT
noavatar92.png
a.disquscdn.com/1698341030/images/ Frame 5964
2 KB
2 KB
Image
General
Full URL
https://a.disquscdn.com/1698341030/images/noavatar92.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.914359974b527f0f97c1fcffe6572f2f.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://disqus.com/embed/comments/?base=default&f=scotthelme&t_i=5ad2388a6eb7640022c300f0&t_u=https%3A%2F%2Fscotthelme.co.uk%2Fa-new-security-header-referrer-policy%2F&t_d=A%20new%20security%20header%3A%20Referrer%20Policy&t_t=A%20new%20security%20header%3A%20Referrer%20Policy&s_o=default
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 06:50:47 GMT
strict-transport-security
max-age=300; includeSubdomains
x-content-type-options
nosniff
last-modified
Fri, 26 Feb 2021 20:50:09 GMT
server
nginx
x-amz-cf-pop
LHR50-P7
age
1515182
etag
"60395f01-66c"
content-type
image/png
cache-control
max-age=2592000
cross-origin-resource-policy
cross-origin
content-length
1644
x-amz-cf-id
heYJ7n7vnkDsZJ8z24WupQDGW5VKUy_cbt6EOXk2oR3AF08Lpfc3EA==
x-xss-protection
1; mode=block
expires
Wed, 29 Nov 2023 17:57:44 GMT
6
m.stripe.com/ Frame 1E7A
156 B
670 B
XHR
General
Full URL
https://m.stripe.com/6
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.201.135.255 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-201-135-255.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b57cd1f4b98a63cf3f2d00636ea9ab3a3fb7aacd30eda3514a5488eb60dfc379
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color
green
date
Fri, 17 Nov 2023 06:50:48 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700203848184903
server
nginx
content-type
application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms
2
access-control-allow-origin
https://m.stripe.network
x-stripe-client-envoy-start-time-us
1700203848184600
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
156

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| documentPictureInPicture string| disqus_identifier object| images function| $ function| jQuery function| getParameterByName object| action object| stripe object| __cfBeacon function| CE function| $E function| J function| qt function| Kt function| zt function| Yt function| Ft function| Nt object| webpackChunkStripeJSouter function| noop function| Stripe function| disqus_config object| DISQUS function| disqus_recommendations_config object| DISQUS_RECOMMENDATIONS

3 Cookies

Domain/Path Name / Value
m.stripe.com/ Name: m
Value: 9f4e67e7-84cc-424b-9db4-cfb9c48f95e15348f2
.scotthelme.co.uk/ Name: __stripe_mid
Value: b0051758-bf0f-494e-ae8a-f012a014378e70b871
.scotthelme.co.uk/ Name: __stripe_sid
Value: 684dcec3-c445-4966-81b7-48bca1bbcf46e41b9f

28 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://static.cloudflareinsights.com/beacon.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://js.stripe.com/v3/' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://cdn.jsdelivr.net/ghost/sodo-search@~1.1/umd/sodo-search.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/public/cards.min.js?v=758dc13dde' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/public/member-attribution.min.js?v=758dc13dde' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/assets/js/comment.min.js?v=758dc13dde' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.disqus.com/embed.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/assets/js/gallery.min.js?v=758dc13dde' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/assets/built/jquery.fitvids.js?v=758dc13dde' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://scotthelme.co.uk/a-new-security-header-referrer-policy/
Message:
[Report Only] Refused to load the script 'https://scotthelme.co.uk/assets/js/member.min.js?v=758dc13dde' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/members/api/member/' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/members/api/member/' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/ghost/api/content/settings/?key=05928c196e63cd7d49c10cd1e1&limit=all' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/ghost/api/content/settings/?key=05928c196e63cd7d49c10cd1e1&limit=all' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/ghost/api/content/tiers/?key=05928c196e63cd7d49c10cd1e1&limit=all&include=monthly_price,yearly_price,benefits' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/ghost/api/content/tiers/?key=05928c196e63cd7d49c10cd1e1&limit=all&include=monthly_price,yearly_price,benefits' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/ghost/api/content/newsletters/?key=05928c196e63cd7d49c10cd1e1&limit=all' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error URL: https://cdn.jsdelivr.net/ghost/portal@~2.36/umd/portal.min.js(Line 1837)
Message:
[Report Only] Refused to connect to 'https://scotthelme.co.uk/ghost/api/content/newsletters/?key=05928c196e63cd7d49c10cd1e1&limit=all' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security error URL: https://scotthelme.disqus.com/embed.js(Line 50)
Message:
[Report Only] Refused to load the script 'https://scotthelme.disqus.com/recommendations.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security error URL: https://static.cloudflareinsights.com/beacon.min.js
Message:
[Report Only] Refused to connect to 'https://cloudflareinsights.com/cdn-cgi/rum' because it violates the following Content Security Policy directive: "connect-src 'none'".
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; script-src 'self' 'report-sample' disqus.com c.disquscdn.com platform.instagram.com cdnjs.cloudflare.com scotthelme.disqus.com a.disquscdn.com go.disqus.com platform.twitter.com cdn.syndication.twimg.com syndication.twitter.com gist.github.com/ScottHelme/ static.cloudflareinsights.com js.stripe.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/ *.privacymanager.io; style-src 'self' 'report-sample' 'unsafe-inline' c.disquscdn.com a.disquscdn.com fonts.googleapis.com cdnjs.cloudflare.com platform.twitter.com assets-cdn.github.com github.githubassets.com unpkg.com/@tryghost/ cdn.jsdelivr.net/ghost/; img-src 'self' data: www.gravatar.com links.services.disqus.com referrer.disqus.com c.disquscdn.com cdn.syndication.twimg.com syndication.twitter.com pbs.twimg.com platform.twitter.com abs.twimg.com www.google-analytics.com; child-src www.instagram.com twitter.com fusiontables.googleusercontent.com fusiontables.google.com www.google.com disqus.com www.youtube.com syndication.twitter.com platform.twitter.com www.youtube-nocookie.com js.stripe.com https://drive.google.com/file/; connect-src 'self' syndication.twitter.com links.services.disqus.com scotthelme.ghost.io cloudflareinsights.com *.privacymanager.io; font-src 'self' cdnjs.cloudflare.com fonts.gstatic.com fonts.googleapis.com; form-action 'self' syndication.twitter.com; frame-ancestors 'none'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests; report-uri https://scotthelme.report-uri.com/r/d/csp/enforce; report-to default
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://scotthelme.report-uri.com/r/d/xss/enforce

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.disquscdn.com
c.disquscdn.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
cloudflareinsights.com
disqus.com
js.stripe.com
m.stripe.com
m.stripe.network
q.stripe.com
referrer.disqus.com
scotthelme.co.uk
scotthelme.disqus.com
static.cloudflareinsights.com
151.101.192.134
199.232.192.134
199.232.194.49
199.232.196.134
2600:9000:2057:b600:6:8656:f5c0:93a1
2600:9000:206f:8200:19:7d10:bd80:93a1
2606:4700:20::ac43:4580
2606:4700::6810:3865
2606:4700::6810:3965
2606:4700::6810:5914
2606:4700::6811:180e
54.186.23.98
54.201.135.255
99.86.4.99
0589c5845288117448d7aa710af60618b151d78efd1a2653f89a0b57f7eb3de8
0608b4bcf1bf6037265fa8d478103598425d2352c9ad7e7890606c6f2b2d5845
068753b8f09b32ad8a3283199c7252090d0076a56924df724dda72828ae31b95
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
09dcddb3866d4fb1dcaa90bf39ee9301753653ca441a8a3166e6216cc91fdfcd
0b144beb896e0d7612e0eeab489e4e682adac07cbc139924ce892bde3ccd3605
10a6ac1700dc75a5cb688da008860c245f8ff2c591ac95c3bdd8093e3ef68633
15dc2da9717aa993f7123dc690407420eb835300d4c3f31b023d891c9c53ec63
1ac113864dba7493879cac2a3f413862bf7e363f20e31f542af0064bba6aff56
1be498b1da16f5fdfed28c7c11aeb08c37295f71e1b57eb21511f765e5a8f994
2249acd7b489ced259c5ae55814d95d4b0eb3c8c3b6427bc4e2c0c8ca34a0c93
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26b75ee0a8e70853f95d8b82a28685da1f33a140e3e2a1920a07b0d739b33b11
2a699e143113c8ec6f1a170714b9bafeb038e8c4a59ffdf950dc81ec6997e758
2b7331e32e23eebe9dd30f184d2f2a4174ac4fbe0bd2e19b0e5b39b46d335f83
2ea7ca239ac3a5289d4530062cbe9637621e780f0563ccc64536e320532e651b
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
32e701fa9d47112c7727631c34ed8e29d30d4d5a0589a206598bd2a51a2200e4
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
3b8a8d998dd7dc014bdb52a01adea8ec1be82193e7e7c6e0c7067a58435b7c28
47d4cc8f41a50c8835c9f83a13ab174866b9f82a24ea590b854574a6773a071a
4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
52e3578c25a70e348674f5b5419768318c8b60ab024eb3fff82c811a82137a36
5ab9af97734b7a1b76e65a6aff767898e4dd763725c46ee56d340a5fd116e6a3
5b36858753063aa3d064ea9fa66d2b97014a7c68fd56a837129781f5d159b2ae
5d283837093d62fdd660da568c71b19f2cf147891c84a5c39286cb4c532225d6
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
61779c74768b5eb298860ceb7d7cf06f2b228fdc53df72b530490a792a5b8a59
62a703387b6adf63d3ad1372fe5431bda60c2095b18c8d0de09530035763f006
6b0687b6ffac02815214e08887a1446ef2dd4589cb219e615648ac3fc8c8b7a8
73e90bca3350ae511b91bb029abfdc78760e164530c9cfd8f1f5e5d007a254b4
760b33d22078ab5658cd8946118f499d73b8100a0d597a288ae738968bf8c86a
7a421bb42bfbe4db5583d302d106d6249448998407ca50ee806fb9c2babc4a5e
7b9c762be52fed9737a319df953c29ad448a7713a31a4ba0f76ab15013512ee6
801e1cc38c802b8890caff1836070506bd7e498d9635182623669dfb52e2dd4e
8505d8233b3c79b966130e48a46181cc2c26a8a82c2ffc92be25c37360cfe6f4
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
8bd3068a31f037d3d198e40d59ae6acf610e3550c11ebff7b6c66bdf8e8b2e3f
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
9714221c828961b20f45a782c3281c0596f6652cfe1299bee18097f98e8fb7b3
98bf3eaae823398902ec770c0f05a7521f94d3e2b867f481d46e3d3a08ac719e
a657bedd3bc0c106f7cfa5fe6556a0b7e175870d33bd7da9ef67ffcffbafda69
ad59b3c437a380375b4205e22d9bf50856690b094d2fa425ae90971f5b58758e
ada119dea6b0bf13d910e017b9e370154d15686b5c9e2ccb0cb08a0067dacc68
ae9ff848064ae601e1e067cacb4080c59795536ab0d1cbee7502efd1f389a0f9
b573dec0fabeb95375c268432b00c7d3d0a24e679e4c3d7b56772d7c53f4c359
b57cd1f4b98a63cf3f2d00636ea9ab3a3fb7aacd30eda3514a5488eb60dfc379
b85fa58b4a5d59a48505b4a76f9fc68b083e8763d77bc921984d421c4a28d2ea
b8ce2ae760e9cf5b5dd2dca7b04ff552009c4079a9acd26df68ba2d045344285
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c166d53e28e811901c3b5dc54e78db3dce8c74f16391377ba65c6716201fd95b
c5d13af659890fd7b44075923009ed754343dbc30f6f4fc385707b9c5cd852be
c83734254b3d948b72aa3f077c457e9dff3405f6ad3082a728aeb1515512b86c
c9d6db74e1b10cdf2978365da3c24799b6b4247eff404d0d687f35e9ec74ff8a
cc0a52161fd65cb7af2c0a314f145e3851f167de2b4e633b30bfca2f04ce09f5
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d66b4e8556dec780a3be1e72c2bacfac5f379f6977f2886254908e5f87db6bd6
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e0dcd739963697a57d39b01b97048f7e7db023993265b50c68c5556ccad90d70
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e75af9dc5cf8a23089f5bb701cfb62c33b42ba3749916729f8e1c02a6c1776c7
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
f27e9ca75db1b778e94c55ffb6a1f471a2fab0761034b9ce0a233bc0866e6cc2
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f2c7361778d94f0d8700a3d07c6517436a83f287577bbc2ba53c52a85e316fe0
ff615e0555532d90883c0d3b64510249db528fd65a201d5345ca3ccfaf21c264