Submitted URL: https://grafana.api.au.splashback.io/
Effective URL: https://grafana.api.au.splashback.io/login
Submission Tags: krdtest
Submission: On September 07 via api from JP

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 20.53.190.246, located in Sydney, Australia and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is grafana.api.au.splashback.io.
TLS certificate: Issued by R3 on September 7th 2021. Valid for: 3 months.
This is the only time grafana.api.au.splashback.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 11 20.53.190.246 8075 (MICROSOFT...)
10 1
Apex Domain
Subdomains
Transfer
11 splashback.io
grafana.api.au.splashback.io
6 MB
10 1
Domain Requested by
11 grafana.api.au.splashback.io 1 redirects grafana.api.au.splashback.io
10 1

This site contains links to these domains. Also see Links.

Domain
grafana.com
Subject Issuer Validity Valid
grafana.api.au.splashback.io
R3
2021-09-07 -
2021-12-06
3 months crt.sh

This page contains 1 frames:

Primary Page: https://grafana.api.au.splashback.io/login
Frame ID: DD2B2A9358A32C2AAA8DA6E7FC5C3E39
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Grafana

Page URL History Show full URLs

  1. https://grafana.api.au.splashback.io/ HTTP 302
    https://grafana.api.au.splashback.io/login Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

6185 kB
Transfer

6169 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://grafana.api.au.splashback.io/ HTTP 302
    https://grafana.api.au.splashback.io/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
grafana.api.au.splashback.io/
Redirect Chain
  • https://grafana.api.au.splashback.io/
  • https://grafana.api.au.splashback.io/login
27 KB
27 KB
Document
General
Full URL
https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e7e46801f6455d4b96d546c53fcc95095e3f38aa69228f7c11944cbff86313ab
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
grafana.api.au.splashback.io
:scheme
https
:path
/login
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
redirect_to=%2F
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
content-type
text/html; charset=UTF-8
cache-control
no-cache
expires
-1
pragma
no-cache
x-content-type-options
nosniff
x-frame-options
deny
x-xss-protection
1; mode=block
strict-transport-security
max-age=15724800; includeSubDomains

Redirect headers

date
Tue, 07 Sep 2021 11:23:12 GMT
content-type
text/html; charset=utf-8
content-length
29
cache-control
no-cache
expires
-1
location
/login
pragma
no-cache
set-cookie
redirect_to=%2F; Path=/; HttpOnly; SameSite=Lax
x-content-type-options
nosniff
x-frame-options
deny
x-xss-protection
1; mode=block
strict-transport-security
max-age=15724800; includeSubDomains
RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2
grafana.api.au.splashback.io/public/fonts/roboto/
14 KB
15 KB
Font
General
Full URL
https://grafana.api.au.splashback.io/public/fonts/roboto/RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
266b4cce701b1c27f1c62a9bd5b6ab64fcf74859400e6fabac2d7e11f96103d0
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-fetch-mode
cors
origin
https://grafana.api.au.splashback.io
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
redirect_to=%2F
:path
/public/fonts/roboto/RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://grafana.api.au.splashback.io
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=3600
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
14748
strict-transport-security
max-age=15724800; includeSubDomains
content-type
font/woff2
grafana.dark.d7cfb4e56c8be9229275.css
grafana.api.au.splashback.io/public/build/
226 KB
227 KB
Stylesheet
General
Full URL
https://grafana.api.au.splashback.io/public/build/grafana.dark.d7cfb4e56c8be9229275.css
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
38dabb0acfc27edd9b87e589170afe1d63e42896f8cad21c9c255ba783f7f94d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/build/grafana.dark.d7cfb4e56c8be9229275.css
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
231409
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/css; charset=utf-8
runtime.d7cfb4e56c8be9229275.js
grafana.api.au.splashback.io/public/build/
4 KB
4 KB
Script
General
Full URL
https://grafana.api.au.splashback.io/public/build/runtime.d7cfb4e56c8be9229275.js
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
35c480cfd689b380642137e967509c580737c1c975dba72ad0936dc30bdb41ab
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/build/runtime.d7cfb4e56c8be9229275.js
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
4349
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/javascript; charset=utf-8
angular~app.d7cfb4e56c8be9229275.js
grafana.api.au.splashback.io/public/build/
181 KB
182 KB
Script
General
Full URL
https://grafana.api.au.splashback.io/public/build/angular~app.d7cfb4e56c8be9229275.js
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b3615776878efe168d5edb7c038f39c675fbeeecb09b3a838b9d4e3fa1d8f6b6
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/build/angular~app.d7cfb4e56c8be9229275.js
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
185386
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/javascript; charset=utf-8
app.d7cfb4e56c8be9229275.js
grafana.api.au.splashback.io/public/build/
3 MB
3 MB
Script
General
Full URL
https://grafana.api.au.splashback.io/public/build/app.d7cfb4e56c8be9229275.js
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
b84551890643ab9e0a5de129b20a639835df6a9c29b0941c5770a9c335eb1e3a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/build/app.d7cfb4e56c8be9229275.js
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
2657645
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/javascript; charset=utf-8
moment~app.d7cfb4e56c8be9229275.js
grafana.api.au.splashback.io/public/build/
286 KB
287 KB
Script
General
Full URL
https://grafana.api.au.splashback.io/public/build/moment~app.d7cfb4e56c8be9229275.js
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a1a362941f6c872783d50381fbf7360ef06f905a1bd0001d48acbf74b8efd589
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/build/moment~app.d7cfb4e56c8be9229275.js
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
292676
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/javascript; charset=utf-8
vendors~app.d7cfb4e56c8be9229275.js
grafana.api.au.splashback.io/public/build/
3 MB
3 MB
Script
General
Full URL
https://grafana.api.au.splashback.io/public/build/vendors~app.d7cfb4e56c8be9229275.js
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ba1360541cdb340b35dc51205b2765fa7d5e0ab0ff0c47639507cf5ceccf4fc1
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/build/vendors~app.d7cfb4e56c8be9229275.js
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:13 GMT
cache-control
public, max-age=31536000
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
2883154
strict-transport-security
max-age=15724800; includeSubDomains
content-type
text/javascript; charset=utf-8
grafana_icon.svg
grafana.api.au.splashback.io/public/img/
6 KB
6 KB
Image
General
Full URL
https://grafana.api.au.splashback.io/public/img/grafana_icon.svg
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
50806d5a65779e79f746398570e0fc322d5de55e19f0be87a275963f0947bb5e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

:path
/public/img/grafana_icon.svg
pragma
no-cache
cookie
redirect_to=%2F
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/login
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://grafana.api.au.splashback.io/login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:14 GMT
cache-control
public, max-age=3600
last-modified
Thu, 05 Aug 2021 13:33:07 GMT
accept-ranges
bytes
content-length
5690
strict-transport-security
max-age=15724800; includeSubDomains
content-type
image/svg+xml
CWB0XYA8bzo0kSThX0UTuA.woff2
grafana.api.au.splashback.io/public/fonts/roboto/
14 KB
14 KB
Font
General
Full URL
https://grafana.api.au.splashback.io/public/fonts/roboto/CWB0XYA8bzo0kSThX0UTuA.woff2
Requested by
Host: grafana.api.au.splashback.io
URL: https://grafana.api.au.splashback.io/public/build/grafana.dark.d7cfb4e56c8be9229275.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.53.190.246 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
db44c6b7985f942465865cfe688770803ab464ec35fb9aefaeccc052e9b74b2a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-fetch-mode
cors
origin
https://grafana.api.au.splashback.io
accept-encoding
gzip, deflate, br
accept-language
en-US
sec-fetch-dest
font
cookie
redirect_to=%2F
:path
/public/fonts/roboto/CWB0XYA8bzo0kSThX0UTuA.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
grafana.api.au.splashback.io
referer
https://grafana.api.au.splashback.io/public/build/grafana.dark.d7cfb4e56c8be9229275.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Origin
https://grafana.api.au.splashback.io
Referer
https://grafana.api.au.splashback.io/public/build/grafana.dark.d7cfb4e56c8be9229275.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 11:23:14 GMT
cache-control
public, max-age=3600
last-modified
Thu, 05 Aug 2021 13:33:06 GMT
accept-ranges
bytes
content-length
14600
strict-transport-security
max-age=15724800; includeSubDomains
content-type
font/woff2

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| checkBrowserCompatibility object| grafanaBootData object| webpackJsonp function| setImmediate function| clearImmediate function| saveAs function| $ function| jQuery function| _ function| filterCSS function| filterXSS object| Prism object| __SENTRY__ object| regeneratorRuntime object| System object| SystemJS object| angular object| grafanaStreamingPerf function| Mousetrap

1 Cookies

Domain/Path Name / Value
grafana.api.au.splashback.io/ Name: redirect_to
Value: %2F

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15724800; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block