URL: https://my.naati.com.au/
Submission: On July 05 via manual from AU — Scanned from AU

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 20.227.58.65, located in Sydney, Australia and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is my.naati.com.au.
TLS certificate: Issued by GeoTrust TLS RSA CA G1 on July 17th 2023. Valid for: a year.
This is the only time my.naati.com.au was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 20.227.58.65 8075 (MICROSOFT...)
2 142.250.66.232 15169 (GOOGLE)
11 3
Apex Domain
Subdomains
Transfer
8 naati.com.au
my.naati.com.au
5 MB
2 google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 745
17 KB
11 2
Domain Requested by
8 my.naati.com.au my.naati.com.au
2 ssl.google-analytics.com my.naati.com.au
11 2

This site contains no links.

Subject Issuer Validity Valid
*.naati.com.au
GeoTrust TLS RSA CA G1
2023-07-17 -
2024-08-16
a year crt.sh
*.google-analytics.com
WR2
2024-06-13 -
2024-09-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://my.naati.com.au/
Frame ID: BD6BEDACA59FF3315B0FB3B3559FEF8C
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Home Page

Detected technologies

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

11
Requests

91 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

4693 kB
Transfer

4713 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://my.naati.com.au/favicon.ico HTTP 0
  • http://my.naati.com.au/error.html

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
my.naati.com.au/
5 KB
5 KB
Document
General
Full URL
https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
45ad53fb8699597855e1150926a3a45229f3d4af3d977554e6bd81b6361d6ee5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
*
cache-control
private,no-cache,no-store, must-revalidate
content-length
4974
content-type
text/html; charset=utf-8
date
Fri, 05 Jul 2024 04:27:13 GMT
pragma
no-cache
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-aspnetmvc-version
5.2
x-content-type-options
nosniff
x-frame-options
sameorigin
x-powered-by
ASP.NET
x-xss-protection
1; mode=block
css
my.naati.com.au/Content/bootstrap-fileinput/css/
8 KB
9 KB
Stylesheet
General
Full URL
https://my.naati.com.au/Content/bootstrap-fileinput/css/css?v=MAs3EKw-3Veu932IUaxlZY4AtfZTCiQcLF5EjeHheh41
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
32885e3b26ef41d3075e7ab3668ee08963c9208f10c07b2d79c1579bda30a623
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
8362
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 05 Jul 2024 04:27:13 GMT
server
Microsoft-IIS/10.0
vary
User-Agent
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,no-cache,no-store, must-revalidate
access-control-allow-credentials
true
x-frame-options
sameorigin
access-control-allow-headers
Content-Type
expires
Sat, 05 Jul 2025 04:27:13 GMT
base
my.naati.com.au/Content/themes/base/
28 KB
29 KB
Stylesheet
General
Full URL
https://my.naati.com.au/Content/themes/base/base?v=kFoVJpUdwQWDifR2O7ZvJB4WkiYLkwf-0fPWMvcDiWk1
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d35b0292ad84078840cf2b4cccf17e74a226ed592e60896d7a1d2f326ea73e7c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
29135
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 05 Jul 2024 04:27:13 GMT
server
Microsoft-IIS/10.0
vary
User-Agent
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,no-cache,no-store, must-revalidate
access-control-allow-credentials
true
x-frame-options
sameorigin
access-control-allow-headers
Content-Type
expires
Sat, 05 Jul 2025 04:27:13 GMT
css
my.naati.com.au/Content/DataTables/css/
26 KB
27 KB
Stylesheet
General
Full URL
https://my.naati.com.au/Content/DataTables/css/css?v=Ped9yvr1YUxVl1wNvJlfGaJiOGD9RbMU1O3FGMQq9Jk1
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
f6a851ce9ed1df44f02f3a5af1de1b5845d84065c794968deb48d49eaecbca55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
26988
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 05 Jul 2024 04:27:13 GMT
server
Microsoft-IIS/10.0
vary
User-Agent
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,no-cache,no-store, must-revalidate
access-control-allow-credentials
true
x-frame-options
sameorigin
access-control-allow-headers
Content-Type
expires
Sat, 05 Jul 2025 04:27:13 GMT
Styles
my.naati.com.au/Bundles/
389 KB
390 KB
Stylesheet
General
Full URL
https://my.naati.com.au/Bundles/Styles?v=4U-rOYZW7uXQ83lxzobTw9YWKi9egcYLXqFuqYKvmts1
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
47915fc5944f0d139fb2ac3ddb042e181e17484c6c7ce9de37445f226b0bf3fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
398787
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 05 Jul 2024 04:27:13 GMT
server
Microsoft-IIS/10.0
vary
User-Agent
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public,no-cache,no-store, must-revalidate
access-control-allow-credentials
true
x-frame-options
sameorigin
access-control-allow-headers
Content-Type
expires
Sat, 05 Jul 2025 04:27:13 GMT
Scripts
my.naati.com.au/Bundles/
891 KB
892 KB
Script
General
Full URL
https://my.naati.com.au/Bundles/Scripts?v=y6iQLQpzVzHIvghDiWIUw-3_5M99Dsa7wRRq3cZTrc81
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
668f847cbb199f116ad9579e354cd0dfd960cfe57aa5680138af284db94e2a24
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-length
912120
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Fri, 05 Jul 2024 04:27:13 GMT
server
Microsoft-IIS/10.0
vary
User-Agent
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,no-cache,no-store, must-revalidate
access-control-allow-credentials
true
x-frame-options
sameorigin
access-control-allow-headers
Content-Type
expires
Sat, 05 Jul 2025 04:27:13 GMT
NAATIAltLogo.png
my.naati.com.au/Content/Images/
3 KB
4 KB
Image
General
Full URL
https://my.naati.com.au/Content/Images/NAATIAltLogo.png
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
175673f086a2eb9224fad673f7b13ce688c76e96dc1ccb271a36156695f8cf33
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-powered-by
ASP.NET
content-length
3384
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Mon, 03 Jun 2024 09:01:21 GMT
server
Microsoft-IIS/10.0
etag
"8086569a94b5da1:0"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache,no-store, must-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
Content-Type
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.66.232 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
syd15s15-in-f8.1e100.net
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 05 Jul 2024 03:33:12 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
3241
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
17168
expires
Fri, 05 Jul 2024 05:33:12 GMT
LogonBackground.png
my.naati.com.au/Content/Images/
3 MB
3 MB
Image
General
Full URL
https://my.naati.com.au/Content/Images/LogonBackground.png
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.227.58.65 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
355e46b83c9a5e81dfbc82d16e7cfe854a5d51720b1be2ea2fe9175348ec8a3c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
x-powered-by
ASP.NET
content-length
3395807
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Mon, 03 Jun 2024 09:01:22 GMT
server
Microsoft-IIS/10.0
etag
"01def9a94b5da1:0"
x-frame-options
sameorigin
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache,no-store, must-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
Content-Type
__utm.gif
ssl.google-analytics.com/r/
35 B
197 B
Image
General
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=960282291&utmhn=my.naati.com.au&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-au&utmje=0&utmfl=-&utmdt=Home%20Page&utmhid=1958415819&utmr=-&utmp=%2F&utmht=1720153633841&utmac=UA-25701862-1&utmcc=__utma%3D232134915.142572681.1720153634.1720153634.1720153634.1%3B%2B__utmz%3D232134915.1720153634.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=336796608&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: my.naati.com.au
URL: https://my.naati.com.au/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.66.232 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
syd15s15-in-f8.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://my.naati.com.au/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 05 Jul 2024 04:27:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
error.html
my.naati.com.au/
Redirect Chain
  • https://my.naati.com.au/favicon.ico
  • http://my.naati.com.au/error.html
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
my.naati.com.au
URL
http://my.naati.com.au/error.html

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery function| DP_jQuery_1720153633665 object| Handlebars function| autosize object| piexif function| KvSortable function| DOMPurify object| toastr function| Color function| Chart object| _gaq object| _gat object| gaGlobal

5 Cookies

Domain/Path Name / Value
.my.naati.com.au/ Name: __utma
Value: 232134915.142572681.1720153634.1720153634.1720153634.1
.my.naati.com.au/ Name: __utmc
Value: 232134915
.my.naati.com.au/ Name: __utmz
Value: 232134915.1720153634.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.my.naati.com.au/ Name: __utmt
Value: 1
.my.naati.com.au/ Name: __utmb
Value: 232134915.1.10.1720153634

2 Console Messages

Source Level URL
Text
recommendation verbose URL: https://my.naati.com.au/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
security error URL: https://my.naati.com.au/
Message:
Mixed Content: The page at 'https://my.naati.com.au/' was loaded over HTTPS, but requested an insecure favicon 'http://my.naati.com.au/error.html'. This request has been blocked; the content must be served over HTTPS.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block