URL: https://dvprogram.state.gov/
Submission: On October 06 via manual from LA — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 169.252.24.7, located in United States and belongs to USDOS, US. The main domain is dvprogram.state.gov. The Cisco Umbrella rank of the primary domain is 400394.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on December 27th 2022. Valid for: a year.
This is the only time dvprogram.state.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 169.252.24.7 6966 (USDOS)
2 2a00:1450:400... 15169 (GOOGLE)
13 2
Apex Domain
Subdomains
Transfer
11 state.gov
dvprogram.state.gov — Cisco Umbrella Rank: 400394
352 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 42
21 KB
13 2
Domain Requested by
11 dvprogram.state.gov dvprogram.state.gov
2 www.google-analytics.com dvprogram.state.gov
www.google-analytics.com
13 2

This site contains links to these domains. Also see Links.

Domain
www.state.gov
travel.state.gov
www.usa.gov
Subject Issuer Validity Valid
dvprogram.state.gov
DigiCert TLS RSA SHA256 2020 CA1
2022-12-27 -
2024-01-05
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-09-18 -
2023-12-11
3 months crt.sh

This page contains 1 frames:

Primary Page: https://dvprogram.state.gov/
Frame ID: 323D05EDF1FF8A874D662C458B831139
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Electronic Diversity Visa Program

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <input[^>]+name="__VIEWSTATE

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

373 kB
Transfer

598 kB
Size

8
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dvprogram.state.gov/
21 KB
11 KB
Document
General
Full URL
https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
0742c4f463efa6705345029ecf68e9c25b26ff3b9ce4fb35ca2a0330305af8bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
private
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
10401
Content-Type
text/html; charset=utf-8
Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
bootstrap.min.css
dvprogram.state.gov/Content/
158 KB
43 KB
Stylesheet
General
Full URL
https://dvprogram.state.gov/Content/bootstrap.min.css
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
7d7a9043f4bed303fe2974ac4e3ba10d6b214e70f7ae549786ba2d347de05f81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:20 GMT
ETag
"0c084171ad81:0"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Accept-Ranges
bytes
bootstrap-theme.min.css
dvprogram.state.gov/jss/css/
23 KB
6 KB
Stylesheet
General
Full URL
https://dvprogram.state.gov/jss/css/bootstrap-theme.min.css
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
a3b3d435fb2cc1ae4cb06a366ec6c10d7b770e4dfd7b91759e66cfb22d4addf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
ETag
"0edb5271ad81:0"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5657
all.css
dvprogram.state.gov/jss/fonts/css/
76 KB
20 KB
Stylesheet
General
Full URL
https://dvprogram.state.gov/jss/fonts/css/all.css
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
ff45f15dbdf902cb4552a3cd125d4b7375752fbed1008000b1de2616b3156bc6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
ETag
"0edb5271ad81:0"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Accept-Ranges
bytes
edv.css
dvprogram.state.gov/jss/
5 KB
3 KB
Stylesheet
General
Full URL
https://dvprogram.state.gov/jss/edv.css
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
0ae2b288eca49122fb1ef8c09c4e903b013e5bd0da5c4b765eed044256512198
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
ETag
"0edb5271ad81:0"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2096
jquery-3.5.1.min.js
dvprogram.state.gov/Scripts/
87 KB
88 KB
Script
General
Full URL
https://dvprogram.state.gov/Scripts/jquery-3.5.1.min.js
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
f36844906ad2309877aae3121b87fb15b9e09803cb4c333adc7e1e35ac92e14b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:20 GMT
Accept-Ranges
bytes
ETag
"0c084171ad81:0"
Content-Length
89478
Content-Type
application/javascript
bootstrap.min.js
dvprogram.state.gov/Scripts/
62 KB
63 KB
Script
General
Full URL
https://dvprogram.state.gov/Scripts/bootstrap.min.js
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
a4555d8dee9f8adc976e84a97dfe87e6bf5794b579f49bb56f133fed85f7d709
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:20 GMT
Accept-Ranges
bytes
ETag
"0c084171ad81:0"
Content-Length
63473
Content-Type
application/javascript
Universal-Federated-Analytics.js
dvprogram.state.gov/jss/
29 KB
30 KB
Script
General
Full URL
https://dvprogram.state.gov/jss/Universal-Federated-Analytics.js?agency=DOS&subagency=CA
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
80f27e481df8935a6b1d7f0ccc662647701bf6466e0c49b0cb5fa70ce36f06ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
Accept-Ranges
bytes
ETag
"0edb5271ad81:0"
Content-Length
29860
Content-Type
application/javascript
Seal_of_the_United_States_Department_of_State40x40.png
dvprogram.state.gov/img/
4 KB
5 KB
Image
General
Full URL
https://dvprogram.state.gov/img/Seal_of_the_United_States_Department_of_State40x40.png
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
1b75559b000790bf5af36642427b1de101112b99bdddeeec882b106e4170cbc1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
Accept-Ranges
bytes
ETag
"0edb5271ad81:0"
Content-Length
4478
Content-Type
image/png
80px-US-GSA-USAGov-Logo.png
dvprogram.state.gov/img/
3 KB
3 KB
Image
General
Full URL
https://dvprogram.state.gov/img/80px-US-GSA-USAGov-Logo.png
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
1bdbd98dd7dd55a652646d4a0475d757466f14bc3fe934d99e6010eb6d5c3035
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
Accept-Ranges
bytes
ETag
"0edb5271ad81:0"
Content-Length
2669
Content-Type
image/png
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/jss/Universal-Federated-Analytics.js?agency=DOS&subagency=CA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dvprogram.state.gov/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 06 Oct 2023 01:49:42 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
1656
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 06 Oct 2023 03:49:42 GMT
fa-solid-900.woff2
dvprogram.state.gov/jss/fonts/webfonts/
78 KB
79 KB
Font
General
Full URL
https://dvprogram.state.gov/jss/fonts/webfonts/fa-solid-900.woff2
Requested by
Host: dvprogram.state.gov
URL: https://dvprogram.state.gov/jss/fonts/css/all.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.252.24.7 , United States, ASN6966 (USDOS, US),
Reverse DNS
Software
/
Resource Hash
cfe3b7382e477059da11be2099914b94f0e2a4f08240c60542c376957b8d9658
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://dvprogram.state.gov/jss/fonts/css/all.css
Origin
https://dvprogram.state.gov
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Date
Fri, 06 Oct 2023 02:17:16 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 04 Feb 2022 20:37:22 GMT
Accept-Ranges
bytes
ETag
"0edb5271ad81:0"
Content-Length
80148
Content-Type
application/font-woff2
collect
www.google-analytics.com/j/
3 B
211 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=1783236125&t=pageview&_s=1&dl=https%3A%2F%2Fdvprogram.state.gov%2F&dp=%2F&ul=en-us&de=UTF-8&dt=Electronic%20Diversity%20Visa%20Program&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAQABAAAAACAAo~&jid=1826921647&gjid=642558529&cid=995946618.1696558638&tid=UA-33523145-1&_gid=1604478041.1696558638&_r=1&_slc=1&cd1=DOS&cd2=DOS%20-%20CA&cd3=20150519%20v2.01%20-%20Universal%20Analytics&z=1239000061
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://dvprogram.state.gov/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 06 Oct 2023 02:17:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://dvprogram.state.gov
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| bootstrap object| oCONFIG function| _onEveryPage function| _defineCookieDomain function| _defineAgencyCDsValues function| _cleanBooleanParam function| _isValidUANum function| _cleanDimensionValue function| _updateConfig function| _sendCustomDimensions function| _sendCustomMetrics function| _sendEvent function| _sendPageview function| gas function| _URIHandler string| tObjectCheck function| createTracker function| _initAutoTracker undefined| videoArray_fed undefined| playerArray_fed undefined| _f33 undefined| _f66 undefined| _f90 undefined| tag undefined| firstScriptTag function| _initIdAssigner function| _tagClicks undefined| youtube_parser_fed undefined| IsYouTube_fed undefined| YTUrlHandler_fed undefined| _initYouTubeTracker undefined| onYouTubePlayerAPIReady undefined| onFedPlayerReady undefined| onFedPlayerStateChange string| _keyValuePair string| _key string| _value string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData

8 Cookies

Domain/Path Name / Value
dvprogram.state.gov/ Name: ASP.NET_SessionId
Value: but43gmzz2gswdxcqcnpdzfm
dvprogram.state.gov/ Name: ADRUM_BTa
Value: R:0|g:dac800a0-4d5c-4b48-b8e4-12ebc0412b81|n:customer1_c7f8e237-703d-42f6-af58-71698d2b17fe
dvprogram.state.gov/ Name: SameSite
Value: None
.dvprogram.state.gov/ Name: TS01b9e0fc
Value: 0164ff4625441d9049e0fec340aaae8ba90012dfec9b773ade95b87db72c241ba47320c4b96f35d09482b2294aaf7eed4708647ea5378261b7b1efe7a5e94aaa55df3b69cd5b8e49e887cdecc29aafb9e88a5afecf05c9d55939d2e28620804df88e120902
dvprogram.state.gov/ Name: TS2b3e4ce9027
Value: 08dea6d04bab2000186741666327df1836071a6f4b7c405f4642590dc189d04fdd6eec2a63c19b1108c1fa65be1130000bc3c0d9d133e1647ebf97f794d3ebef833fccfaf4d8bd48ffbc9963a1e203d06e6204d9916b7e08e4c7ee826fe048de
.dvprogram.state.gov/ Name: _ga
Value: GA1.3.995946618.1696558638
.dvprogram.state.gov/ Name: _gid
Value: GA1.3.1604478041.1696558638
.dvprogram.state.gov/ Name: _gat_GSA_ENOR0
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains