Submitted URL: https://boards.memechan.gg/
Effective URL: https://boards.memechan.gg/index.html
Submission: On July 29 via api from US — Scanned from NL

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 89.110.82.138, located in Amsterdam, Netherlands and belongs to VDSINA, AE. The main domain is boards.memechan.gg.
TLS certificate: Issued by R11 on July 10th 2024. Valid for: 3 months.
This is the only time boards.memechan.gg was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 89.110.82.138 216071 (VDSINA)
8 1
Apex Domain
Subdomains
Transfer
9 memechan.gg
boards.memechan.gg
260 KB
8 1
Domain Requested by
9 boards.memechan.gg 1 redirects boards.memechan.gg
8 1

This site contains links to these domains. Also see Links.

Domain
gitgud.io
Subject Issuer Validity Valid
boards.memechan.gg
R11
2024-07-10 -
2024-10-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://boards.memechan.gg/index.html
Frame ID: C1F96C32346C380E4AE4160BC8D0755B
Requests: 8 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://boards.memechan.gg/ HTTP 302
    https://boards.memechan.gg/index.html Page URL

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

259 kB
Transfer

944 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://boards.memechan.gg/ HTTP 302
    https://boards.memechan.gg/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.html
boards.memechan.gg/
Redirect Chain
  • https://boards.memechan.gg/
  • https://boards.memechan.gg/index.html
5 KB
2 KB
Document
General
Full URL
https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
75f0abf3b2b40ef52d0b5524d4a964a959132474909f345751ff8ece0f779ca2
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control
max-age=0 public
content-encoding
gzip
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
content-type
text/html
date
Mon, 29 Jul 2024 10:21:16 GMT
etag
W/"66a76820-13c5"
expires
Mon, 29 Jul 2024 10:21:16 GMT
last-modified
Mon, 29 Jul 2024 10:00:00 GMT
referrer-policy
same-origin, strict-origin-when-cross-origin
server
nginx
x-content-type-options
nosniff
x-frame-options
sameorigin
x-xss-protection
1; mode=block

Redirect headers

cache-control
public
content-length
138
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
content-type
text/html
date
Mon, 29 Jul 2024 10:21:16 GMT
location
https://boards.memechan.gg/index.html
referrer-policy
same-origin, strict-origin-when-cross-origin
server
nginx
x-content-type-options
nosniff
x-frame-options
sameorigin
x-xss-protection
1; mode=block
style.css
boards.memechan.gg/css/
45 KB
11 KB
Stylesheet
General
Full URL
https://boards.memechan.gg/css/style.css?v=971ca9d8&ct=text
Requested by
Host: boards.memechan.gg
URL: https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
44161d24079a2fd4f134f119ed199f32c3f0175e8796491ed72c3a3fb161055a
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 21:53:09 GMT
server
nginx
content-encoding
gzip
etag
W/"668f02c5-b420"
x-frame-options
sameorigin
content-type
text/css
cache-control
max-age=604800, public
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 10:21:16 GMT
pink.css
boards.memechan.gg/css/themes/
1 KB
1 KB
Stylesheet
General
Full URL
https://boards.memechan.gg/css/themes/pink.css
Requested by
Host: boards.memechan.gg
URL: https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
759c9a4e1f2f1bda366f90ee8214d7be78a2f420892d08a72c2c855dcb678ab0
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 20:39:22 GMT
server
nginx
content-encoding
gzip
etag
W/"668ef17a-57b"
x-frame-options
sameorigin
content-type
text/css
cache-control
max-age=604800, public
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 10:21:16 GMT
ir-black.css
boards.memechan.gg/css/codethemes/
694 B
988 B
Stylesheet
General
Full URL
https://boards.memechan.gg/css/codethemes/ir-black.css
Requested by
Host: boards.memechan.gg
URL: https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
7b95aa046b9a9cee4af547c59af2f598c3a04085e7df61b9e3f4476ce771ec00
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 21:52:27 GMT
server
nginx
content-encoding
gzip
etag
W/"668f029b-2b6"
x-frame-options
sameorigin
content-type
text/css
cache-control
max-age=604800, public
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 10:21:16 GMT
en-GB.js
boards.memechan.gg/js/lang/
7 KB
3 KB
Script
General
Full URL
https://boards.memechan.gg/js/lang/en-GB.js?v=971ca9d8
Requested by
Host: boards.memechan.gg
URL: https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
5e4b9c06fc80f54f6bb8ae39211051c30c1ebc9e21af588b661a6394be4a6383
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 21:53:09 GMT
server
nginx
content-encoding
gzip
etag
W/"668f02c5-1cde"
x-frame-options
sameorigin
content-type
application/javascript
cache-control
max-age=604800, public
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 10:21:16 GMT
all.js
boards.memechan.gg/js/
847 KB
223 KB
Script
General
Full URL
https://boards.memechan.gg/js/all.js?v=971ca9d8&ct=text
Requested by
Host: boards.memechan.gg
URL: https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
e7ffdd5fa55f0b11f592fd25b47ba2d78c98ebdfaba717ee885b66edaed319a9
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 21:53:09 GMT
server
nginx
content-encoding
gzip
etag
W/"668f02c5-d3d69"
x-frame-options
sameorigin
content-type
application/javascript
cache-control
max-age=604800, public
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 10:21:16 GMT
render.js
boards.memechan.gg/js/
25 KB
8 KB
Script
General
Full URL
https://boards.memechan.gg/js/render.js?v=971ca9d8
Requested by
Host: boards.memechan.gg
URL: https://boards.memechan.gg/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
a936a3416e5589d1407c493f6b76594bfa3f500b91d99311f86fc01d42c81de2
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 20:39:22 GMT
server
nginx
content-encoding
gzip
etag
W/"668ef17a-6546"
x-frame-options
sameorigin
content-type
application/javascript
cache-control
max-age=604800, public
x-xss-protection
1; mode=block
expires
Mon, 05 Aug 2024 10:21:16 GMT
favicon.ico
boards.memechan.gg/file/
12 KB
10 KB
Other
General
Full URL
https://boards.memechan.gg/file/favicon.ico?v=971ca9d8
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.110.82.138 Amsterdam, Netherlands, ASN216071 (VDSINA, AE),
Reverse DNS
host-89-110-82-138.hosted-by-vdsina.com
Software
nginx /
Resource Hash
fc4055a9961d1cf6ef8d3f6b7b386746666a6c84bed010f6b46098a15855d679
Security Headers
Name Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://boards.memechan.gg/index.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Mon, 29 Jul 2024 10:21:16 GMT
content-security-policy
default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
referrer-policy
same-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
last-modified
Wed, 10 Jul 2024 21:52:59 GMT
server
nginx
content-encoding
gzip
etag
W/"668f02bb-2eee"
x-frame-options
sameorigin
content-type
image/x-icon
cache-control
max-age=315360000, public
x-xss-protection
1; mode=block
expires
Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| setLocalStorage function| appendLocalStorageArray function| deleteStartsWith function| setDefaultLocalStorage function| pug_attr function| pug_classes function| pug_classes_array function| pug_classes_object function| pug_escape function| pug_has_own_property object| pug_match_html function| pug_style function| modal function| pugfilters function| banmessage function| post object| TegakiStrings object| $T object| TegakiCursor object| TegakiHistory object| TegakiHistoryActions object| TegakiKeybinds object| TegakiLayers object| Tegaki object| TegakiColorPalettes object| TegakiPressure object| TegakiUI object| UZIP function| videoThumbnail function| doModal function| removeModal function| recaptchaCallback function| captchaformsection function| threadToPlaylist function| showTegakiReplay function| addReplayListeners function| toggleBoardCss function| changeTheme function| threadwatcher function| uploaditem function| watchedthread function| io function| setImmediate function| clearImmediate function| Web3 function| clearYousList function| toggleAllYous

0 Cookies

1 Console Messages

Source Level URL
Text
other verbose URL: https://boards.memechan.gg/index.html
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block