Submitted URL: https://demoeu-direct.oktopay.eu/
Effective URL: https://demoeu-direct.oktopay.eu/merchant
Submission: On December 22 via api from US — Scanned from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 18.195.221.92, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is demoeu-direct.oktopay.eu.
TLS certificate: Issued by Amazon RSA 2048 M03 on November 22nd 2023. Valid for: a year.
This is the only time demoeu-direct.oktopay.eu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 18.195.221.92 16509 (AMAZON-02)
12 1
Apex Domain
Subdomains
Transfer
12 oktopay.eu
demoeu-direct.oktopay.eu
1 MB
12 1
Domain Requested by
12 demoeu-direct.oktopay.eu demoeu-direct.oktopay.eu
12 1

This site contains no links.

Subject Issuer Validity Valid
demoeu-direct.oktopay.eu
Amazon RSA 2048 M03
2023-11-22 -
2024-12-20
a year crt.sh

This page contains 1 frames:

Primary Page: https://demoeu-direct.oktopay.eu/merchant
Frame ID: A180C99235538EBEC2D99E8FEC2EF8DB
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

OKTOPAY - Merchant App

Page URL History Show full URLs

  1. https://demoeu-direct.oktopay.eu/ Page URL
  2. https://demoeu-direct.oktopay.eu/merchant Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

1072 kB
Transfer

2150 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://demoeu-direct.oktopay.eu/ Page URL
  2. https://demoeu-direct.oktopay.eu/merchant Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
demoeu-direct.oktopay.eu/
727 B
1006 B
Document
General
Full URL
https://demoeu-direct.oktopay.eu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
727
content-type
text/html;charset=UTF-8
date
Fri, 22 Dec 2023 15:07:44 GMT
expires
0
pragma
no-cache
referrer-policy
no-referrer
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
x-xss-protection
1 ; mode=block
Primary Request merchant
demoeu-direct.oktopay.eu/
8 KB
3 KB
Document
General
Full URL
https://demoeu-direct.oktopay.eu/merchant
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
f9e401e58d60c9d08b9e90029281e6fcadb99d517117bed5fde98c41ced2ecb0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-type
text/html
date
Fri, 22 Dec 2023 15:07:44 GMT
expires
0
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
pragma
no-cache
referrer-policy
no-referrer
strict-transport-security
max-age=31536000 ; includeSubDomains
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers origin,access-control-request-method,access-control-request-headers,accept-encoding
x-content-type-options
nosniff
x-xss-protection
1 ; mode=block
googleapis.icon.Material-Icons.css
demoeu-direct.oktopay.eu/merchant/css/
436 B
873 B
Stylesheet
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/css/googleapis.icon.Material-Icons.css
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
caf19ab4cf27c2968f41ce3c880c08ac51a5663af51f8f677b4276b8f5769951
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:44 GMT
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
referrer-policy
no-referrer
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
436
x-xss-protection
1 ; mode=block
expires
0
googleapis.Source-Sans-Pro.300-400-600-700.swap.greek.css
demoeu-direct.oktopay.eu/merchant/css/
772 B
1 KB
Stylesheet
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/css/googleapis.Source-Sans-Pro.300-400-600-700.swap.greek.css
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
5ac6acea5d39b04c858b5eefb896f55f6ad2b8a19a4d8ae79290c5b0081033d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:44 GMT
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
referrer-policy
no-referrer
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
772
x-xss-protection
1 ; mode=block
expires
0
53.24bf1742.chunk.css
demoeu-direct.oktopay.eu/merchant/static/css/
2 KB
2 KB
Stylesheet
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/css/53.24bf1742.chunk.css
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
ad458028c20d64810079a1bd6ae2d28d4e36e22fa912c9971040bda5a6b30a46
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:44 GMT
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
referrer-policy
no-referrer
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
1833
x-xss-protection
1 ; mode=block
expires
0
main.ccc2552e.chunk.css
demoeu-direct.oktopay.eu/merchant/static/css/
67 KB
16 KB
Stylesheet
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/css/main.ccc2552e.chunk.css
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a5c0aaf4f8c1b0f19f84f63a480697ed31d3bf9bb602189995c1c026ed66e54f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
referrer-policy
no-referrer
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type
text/css
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
x-xss-protection
1 ; mode=block
expires
0
53.bf1fa55a.chunk.js
demoeu-direct.oktopay.eu/merchant/static/js/
394 KB
119 KB
Script
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/js/53.bf1fa55a.chunk.js
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
d31be1a17c008432f786927f609cbdf1ac7e100ae20eb63656b585273ffc35ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
referrer-policy
no-referrer
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type
application/javascript
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
x-xss-protection
1 ; mode=block
expires
0
main.5ad93b60.chunk.js
demoeu-direct.oktopay.eu/merchant/static/js/
2 MB
833 KB
Script
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/js/main.5ad93b60.chunk.js
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
a0f69545c156506c87c43c1bbfbb0a7cfc45f4fe540bb277b96ab46dac279371
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
referrer-policy
no-referrer
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type
application/javascript
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
x-xss-protection
1 ; mode=block
expires
0
StartRoute.a81ec733.chunk.js
demoeu-direct.oktopay.eu/merchant/static/js/
8 KB
3 KB
Script
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/js/StartRoute.a81ec733.chunk.js
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
306a50da064f6e843e2a63f4072822e499847ff3c01ab72cc7c3825780af82a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
referrer-policy
no-referrer
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type
application/javascript
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
x-xss-protection
1 ; mode=block
expires
0
6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67g.ttf
demoeu-direct.oktopay.eu/merchant/font/
56 KB
57 KB
Font
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/font/6xK3dSBYKcSV-LCoeQqfX1RYOo3qO67g.ttf
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant/css/googleapis.Source-Sans-Pro.300-400-600-700.swap.greek.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
6da1ee01935d5e68563f58cbc2af81a7e8db56b7b594240c12ad39cd70f41441
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

Referer
Origin
https://demoeu-direct.oktopay.eu
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:45 GMT
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
referrer-policy
no-referrer
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
application/x-font-ttf
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
57668
x-xss-protection
1 ; mode=block
expires
0
okto-logo-white.3d77c556.svg
demoeu-direct.oktopay.eu/merchant/static/media/
2 KB
2 KB
Image
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/media/okto-logo-white.3d77c556.svg
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
2428f30c5edccc014249030c903f16013e31b4418a89bcc2671ba1143730eedf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:45 GMT
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
referrer-policy
no-referrer
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
image/svg+xml
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
1645
x-xss-protection
1 ; mode=block
expires
0
start-bg-desktop.84b04343.png
demoeu-direct.oktopay.eu/merchant/static/media/
33 KB
33 KB
Image
General
Full URL
https://demoeu-direct.oktopay.eu/merchant/static/media/start-bg-desktop.84b04343.png
Requested by
Host: demoeu-direct.oktopay.eu
URL: https://demoeu-direct.oktopay.eu/merchant/static/css/main.ccc2552e.chunk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.195.221.92 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-221-92.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
6163f373387ec86cbeb1b20c652495eaf8f2026e3c0b5b318eedd3077a640816
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 22 Dec 2023 15:07:45 GMT
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
referrer-policy
no-referrer
last-modified
Thu, 21 Dec 2023 12:08:52 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
image/png
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
content-length
33748
x-xss-protection
1 ; mode=block
expires
0

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| webpackJsonpocto-web-app number| 2f1acc6c3a606b082e5eef5e54414ffb

1 Cookies

Domain/Path Name / Value
demoeu-direct.oktopay.eu/ Name: locale
Value: en

1 Console Messages

Source Level URL
Text
network error URL: https://demoeu-direct.oktopay.eu/
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1 ; mode=block