galette.abaa-asso.org Open in urlscan Pro
2001:4b98:dc0:47:216:3eff:fec8:b67f  Public Scan

Submitted URL: https://galette.abaa-asso.org/
Effective URL: https://galette.abaa-asso.org/login
Submission: On July 16 via automatic, source certstream-suspicious — Scanned from FR

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 2001:4b98:dc0:47:216:3eff:fec8:b67f, located in France and belongs to GANDI-AS Domain name registrar - www.gandi.net, FR. The main domain is galette.abaa-asso.org.
TLS certificate: Issued by R11 on July 15th 2024. Valid for: 3 months.
This is the only time galette.abaa-asso.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13 2001:4b98:dc0... 29169 (GANDI-AS ...)
12 2
Apex Domain
Subdomains
Transfer
13 abaa-asso.org
galette.abaa-asso.org
742 KB
12 1
Domain Requested by
13 galette.abaa-asso.org 1 redirects galette.abaa-asso.org
12 1

This site contains links to these domains. Also see Links.

Domain
galette.eu
doc.galette.eu
framapiaf.org
Subject Issuer Validity Valid
galette.abaa-asso.org
R11
2024-07-15 -
2024-10-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://galette.abaa-asso.org/login
Frame ID: DD0BD8EF4721EB878DBFD37E5CE2FC00
Requests: 14 HTTP requests in this frame

Screenshot

Page Title

Identification - Galette v1.0.3

Page URL History Show full URLs

  1. https://galette.abaa-asso.org/ HTTP 301
    https://galette.abaa-asso.org/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+semantic(?:\.min)\.css"
  • /semantic(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

743 kB
Transfer

2250 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://galette.abaa-asso.org/ HTTP 301
    https://galette.abaa-asso.org/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
galette.abaa-asso.org/
Redirect Chain
  • https://galette.abaa-asso.org/
  • https://galette.abaa-asso.org/login
18 KB
4 KB
Document
General
Full URL
https://galette.abaa-asso.org/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
450032e1d9652969535e7f7056f227f1e04139cd8f4a5efe3181b7ba643aee17
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
3685
content-type
text/html; charset=UTF-8
date
Tue, 16 Jul 2024 10:04:54 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-cache-status
MISS
x-content-type-options
nosniff
x-frame-options
sameorigin
x-xss-protection
1; mode=block

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 16 Jul 2024 10:04:54 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
/login
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
x-cache-status
MISS
x-content-type-options
nosniff
x-frame-options
sameorigin
x-xss-protection
1; mode=block
semantic.min.css
galette.abaa-asso.org/themes/default/ui/
1 MB
164 KB
Stylesheet
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
531896dad1f9f446dd147dc0b47860441066291f98c0a2e85e549c68755e7a2e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Fri, 01 Mar 2024 10:30:32 GMT
server
nginx
etag
"15bc1d-61296dd922200-gzip"
x-cache-status
MISS
vary
Accept-Encoding
x-frame-options
sameorigin
content-type
text/css
x-xss-protection
1; mode=block
jquery.min.js
galette.abaa-asso.org/assets/js/
85 KB
30 KB
Script
General
Full URL
https://galette.abaa-asso.org/assets/js/jquery.min.js
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Fri, 01 Mar 2024 10:29:00 GMT
server
nginx
etag
"155ed-61296d8165300-gzip"
x-cache-status
MISS
vary
Accept-Encoding
x-frame-options
sameorigin
content-type
text/javascript
accept-ranges
bytes
content-length
30362
x-xss-protection
1; mode=block
logo
galette.abaa-asso.org/
7 KB
7 KB
Image
General
Full URL
https://galette.abaa-asso.org/logo
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
3d9013333afaee22fab8e5f50a6168cdae9c183240ee33c2bd18458a0438d677
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
public
date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
server
nginx
x-cache-status
MISS
x-frame-options
sameorigin
content-type
image/png
cache-control
must-revalidate
content-transfer-encoding
binary
content-length
7300
x-xss-protection
1; mode=block
expires
0
semantic.min.js
galette.abaa-asso.org/themes/default/ui/
289 KB
79 KB
Script
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/semantic.min.js
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
89f934e45a5831bd822cc4a8f59e81874b5fcfea9e1ced7e12890d3163f0e4d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Fri, 01 Mar 2024 10:29:10 GMT
server
nginx
etag
"483fb-61296d8aee980-gzip"
x-cache-status
MISS
vary
Accept-Encoding
x-frame-options
sameorigin
content-type
text/javascript
x-xss-protection
1; mode=block
galette-main.bundle.min.js
galette.abaa-asso.org/assets/js/
6 KB
3 KB
Script
General
Full URL
https://galette.abaa-asso.org/assets/js/galette-main.bundle.min.js
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/login
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
dd6b4d49daf4b211fcd00c99f0822fdc6cadc8e8f7b8a0341943f669df40bb0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
last-modified
Fri, 01 Mar 2024 10:29:00 GMT
server
nginx
etag
"16a1-61296d8165300-gzip"
x-cache-status
MISS
vary
Accept-Encoding
x-frame-options
sameorigin
content-type
text/javascript
accept-ranges
bytes
content-length
2474
x-xss-protection
1; mode=block
bg.png
galette.abaa-asso.org/themes/default/ui/themes/galette/assets/images/
225 KB
225 KB
Image
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/themes/galette/assets/images/bg.png
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
cb26367852bf8660be96bda6e90ba54334155b3b8196efd3fb280ca8575ace37
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Fri, 01 Mar 2024 09:02:30 GMT
server
nginx
etag
"382a4-61295a2bd3580"
x-cache-status
MISS
x-frame-options
sameorigin
content-type
image/png
accept-ranges
bytes
content-length
230052
x-xss-protection
1; mode=block
LatoLatin-Regular.woff2
galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/
33 KB
33 KB
Font
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/LatoLatin-Regular.woff2
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
f1a5932ac70017fcf8343f1a8f7415b9409fb7b8441cebd5b1f2a9e9c3e7539e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Origin
https://galette.abaa-asso.org
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Fri, 01 Mar 2024 10:29:10 GMT
server
nginx
etag
"8424-61296d8aee980"
x-cache-status
MISS
x-frame-options
sameorigin
content-type
font/woff2
accept-ranges
bytes
content-length
33828
x-xss-protection
1; mode=block
icons.woff2
galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/
76 KB
77 KB
Font
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/icons.woff2
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Origin
https://galette.abaa-asso.org
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Fri, 01 Mar 2024 10:29:10 GMT
server
nginx
etag
"131bc-61296d8aee980"
x-cache-status
MISS
x-frame-options
sameorigin
content-type
font/woff2
accept-ranges
bytes
content-length
78268
x-xss-protection
1; mode=block
truncated
/
1 KB
1 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3eda0bfda6024d4e57ac7625d16d070b5912aceccb36d40336fab733a4cadf12

Request headers

Referer
Origin
https://galette.abaa-asso.org
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/font-woff
LatoLatin-Bold.woff2
galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/
33 KB
33 KB
Font
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/LatoLatin-Bold.woff2
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
d952174432302829bdc762952b19b7865f62b6310959c83e99d742252d7e1791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Origin
https://galette.abaa-asso.org
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Fri, 01 Mar 2024 10:29:10 GMT
server
nginx
etag
"8350-61296d8aee980"
x-cache-status
MISS
x-frame-options
sameorigin
content-type
font/woff2
accept-ranges
bytes
content-length
33616
x-xss-protection
1; mode=block
brand-icons.woff2
galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/
75 KB
75 KB
Font
General
Full URL
https://galette.abaa-asso.org/themes/default/ui/themes/default/assets/fonts/brand-icons.woff2
Requested by
Host: galette.abaa-asso.org
URL: https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/themes/default/ui/semantic.min.css
Origin
https://galette.abaa-asso.org
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Fri, 01 Mar 2024 10:29:10 GMT
server
nginx
etag
"12bc0-61296d8aee980"
x-cache-status
MISS
x-frame-options
sameorigin
content-type
font/woff2
accept-ranges
bytes
content-length
76736
x-xss-protection
1; mode=block
truncated
/
1 KB
1 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3fdb91ad98ebc7f691c8d757b8cfbc94f1762a105aaa8aea636759c95bf5e58e

Request headers

Referer
Origin
https://galette.abaa-asso.org
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
application/font-woff
favicon.png
galette.abaa-asso.org/themes/default/images/
9 KB
10 KB
Other
General
Full URL
https://galette.abaa-asso.org/themes/default/images/favicon.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:4b98:dc0:47:216:3eff:fec8:b67f , France, ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR),
Reverse DNS
Software
nginx /
Resource Hash
c4d3c2e59119564022e39cd0c9996b438ebdea6f5cb8bb045dc676aed53a3a48
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://galette.abaa-asso.org/login
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 16 Jul 2024 10:04:55 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
last-modified
Fri, 01 Mar 2024 09:02:30 GMT
server
nginx
etag
"25de-61295a2bd3580"
x-cache-status
MISS
x-frame-options
sameorigin
content-type
image/png
accept-ranges
bytes
content-length
9694
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| _bindFomanticComponents function| _keyboardNavigation function| _bindDropdownsAutosubmit function| _bind_check function| _bind_legend object| Cookies function| csrfSafeMethod

2 Cookies

Domain/Path Name / Value
galette.abaa-asso.org/ Name: show_galette_dashboard
Value: 1
galette.abaa-asso.org/ Name: galette_galette__abaa_gt3_v1_0_3
Value: sn0s5rkpm6s08dtp8mt6bs5om9

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://galette.abaa-asso.org/login
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block