clients.myibxtpaplan.com Open in urlscan Pro
2606:4700:4400::6812:245c  Public Scan

Submitted URL: https://clients.myibxtpaplan.com/
Effective URL: https://clients.myibxtpaplan.com/Public/Login/
Submission: On October 29 via manual from US — Scanned from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2606:4700:4400::6812:245c, located in United States and belongs to CLOUDFLARENET, US. The main domain is clients.myibxtpaplan.com. The Cisco Umbrella rank of the primary domain is 605561.
TLS certificate: Issued by WE1 on October 16th 2024. Valid for: 3 months.
This is the only time clients.myibxtpaplan.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 11 2606:4700:440... 13335 (CLOUDFLAR...)
9 1
Apex Domain
Subdomains
Transfer
11 myibxtpaplan.com
clients.myibxtpaplan.com — Cisco Umbrella Rank: 605561
752 KB
9 1
Domain Requested by
11 clients.myibxtpaplan.com 2 redirects clients.myibxtpaplan.com
9 1

This site contains links to these domains. Also see Links.

Domain
www.ibxtpa.com
Subject Issuer Validity Valid
myibxtpaplan.com
WE1
2024-10-16 -
2025-01-14
3 months crt.sh

This page contains 2 frames:

Primary Page: https://clients.myibxtpaplan.com/Public/Login/
Frame ID: 148DB183835002A3CE37A1CCF888FFE6
Requests: 7 HTTP requests in this frame

Frame: https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js
Frame ID: 8D9753156EE1CBBB0D23A2279DFEA732
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://clients.myibxtpaplan.com/ HTTP 302
    https://clients.myibxtpaplan.com/Public/Login/ Page URL

Page Statistics

9
Requests

89 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

751 kB
Transfer

902 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://clients.myibxtpaplan.com/ HTTP 302
    https://clients.myibxtpaplan.com/Public/Login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
clients.myibxtpaplan.com/Public/Login/
Redirect Chain
  • https://clients.myibxtpaplan.com/
  • https://clients.myibxtpaplan.com/Public/Login/
13 KB
4 KB
Document
General
Full URL
https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90d88d3a809e508041d3c4b21747ce7acd01a66a6ff08771710d23214e46d861
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
8da5be9aae545e64-EWR
Cache-Control
public
Connection
keep-alive
Content-Encoding
gzip
Content-Security-Policy
frame-ancestors 'self';
Content-Type
text/html; charset=utf-8
Date
Tue, 29 Oct 2024 19:59:10 GMT
Feature-Policy
microphone 'none'; payment 'none'
Server
cloudflare
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-OneAgent-JS-Injection
true
X-XSS-Protection
1; mode=block
X-ruxit-JS-Agent
true

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
8da5be99ed705e64-EWR
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 29 Oct 2024 19:59:10 GMT
Feature-Policy
microphone 'none'; payment 'none'
Location
https://clients.myibxtpaplan.com/Public/Login/
Server
cloudflare
Transfer-Encoding
chunked
X-Frame-Options
SAMEORIGIN
ruxitagentjs_ICA7NVfgqrux_10299241001084140.js
clients.myibxtpaplan.com/
230 KB
87 KB
Script
General
Full URL
https://clients.myibxtpaplan.com/ruxitagentjs_ICA7NVfgqrux_10299241001084140.js
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c7226e66c913b14db5bba50479c2ea3748f33032055164114e986f7c0fc5fa4
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-Content-Type-Options
nosniff
Expires
Wed, 29 Oct 2025 19:59:10 GMT
Date
Tue, 29 Oct 2024 19:59:10 GMT
Content-Type
text/javascript; charset=utf-8
Feature-Policy
microphone 'none'; payment 'none'
Vary
Accept-Encoding
Last-Modified
Wed, 03 Mar 2010 07:01:40 GMT
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Cache-Control
public, max-age=31536000, immutable
Connection
keep-alive
CF-RAY
8da5be9b3f215e64-EWR
Access-Control-Allow-Origin
*
X-XSS-Protection
1; mode=block
Server
cloudflare
IA
clients.myibxtpaplan.com/Public/logo/
14 KB
14 KB
Image
General
Full URL
https://clients.myibxtpaplan.com/Public/logo/IA
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e51365681263833ca19ce971e0ca524d2c1fc2ee7591b66a0c3587858839f501
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-Content-Type-Options
nosniff
Date
Tue, 29 Oct 2024 19:59:10 GMT
Content-Type
image/jpeg
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Cache-Control
public
Connection
keep-alive
CF-RAY
8da5be9b6de93338-EWR
Content-Length
14054
X-XSS-Protection
1; mode=block
Server
cloudflare
LoginBackground.jpg
clients.myibxtpaplan.com/Public/Images/
637 KB
638 KB
Image
General
Full URL
https://clients.myibxtpaplan.com/Public/Images/LoginBackground.jpg
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
baa9f2f97f48c9679d5b9bc531f27badd0cb5b17a941fb90a0a205cfbc266d43
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
ETag
"0885efc75f2da1:0-gzip"
X-Content-Type-Options
nosniff
Date
Tue, 29 Oct 2024 19:59:10 GMT
Content-Type
image/jpeg
Feature-Policy
microphone 'none'; payment 'none'
Vary
Accept-Encoding
Last-Modified
Mon, 19 Aug 2024 20:25:52 GMT
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Cache-Control
public,public,max-age=31536000
Connection
keep-alive
CF-RAY
8da5be9b6e2c5e66-EWR
Accept-Ranges
bytes
X-XSS-Protection
1; mode=block
Server
cloudflare
main.js
clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/ Frame 8D97
Redirect Chain
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
8 KB
4 KB
Script
General
Full URL
https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/Public/Login/
Protocol
HTTP/1.1
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
82b044914c7a5bf9b9d2c5661521cc85c767a73d93be02f466e2fc6127fa06bf
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding
chunked
cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
Content-Encoding
gzip
Connection
keep-alive
x-content-type-options
nosniff
CF-RAY
8da5be9c48815e64-EWR
Date
Tue, 29 Oct 2024 19:59:10 GMT
Content-Type
application/javascript; charset=UTF-8
Server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js?
Connection
keep-alive
CF-RAY
8da5be9c18305e64-EWR
access-control-allow-origin
*
Content-Length
0
Date
Tue, 29 Oct 2024 19:59:10 GMT
Server
cloudflare
8da5be9aae545e64
clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 8D97
0
942 B
XHR
General
Full URL
https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/h/g/jsd/r/8da5be9aae545e64
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

CF-RAY
8da5be9d1f973338-EWR
Content-Length
0
Date
Tue, 29 Oct 2024 19:59:10 GMT
Content-Type
text/plain; charset=UTF-8
Connection
keep-alive
Server
cloudflare
favicon.ico
clients.myibxtpaplan.com/
630 B
1 KB
Other
General
Full URL
https://clients.myibxtpaplan.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9edac73b0257db2b19b1abc56f10a452501a41caf3ad50f87f78d384caab73da
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
X-Content-Type-Options
nosniff
X-OneAgent-JS-Injection
true
Date
Tue, 29 Oct 2024 19:59:10 GMT
Content-Type
text/html; charset=UTF-8
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
X-ruxit-JS-Agent
true
X-Frame-Options
SAMEORIGIN
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Last-Modified
Tue, 09 Nov 2021 17:10:34 GMT
Connection
keep-alive
CF-RAY
8da5be9d5fc13338-EWR
X-XSS-Protection
1; mode=block
Server
cloudflare
rb_bf18336fji
clients.myibxtpaplan.com/
123 B
668 B
Fetch
General
Full URL
https://clients.myibxtpaplan.com/rb_bf18336fji?type=js3&sn=v_4_srv_5_sn_26AC2268A9E79C5E13F95735A1CB7E24_perc_100000_ol_0_mul_1_app-3A5ab709031ecb748a_1&svrid=5&flavor=post&vi=MUHFIORCUAMRHHJHGRHCWUAAIPHRRPTS-0&modifiedSince=1730132641667&rf=https%3A%2F%2Fclients.myibxtpaplan.com%2FPublic%2FLogin%2F&bp=3&app=5ab709031ecb748a&crc=4145808084&en=pb1lulax&end=1
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/ruxitagentjs_ICA7NVfgqrux_10299241001084140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
634865c1e021e633c66dcbc4d7bf1615a02576f20b63f81b60c20f6fbca3fadb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Connection
keep-alive
X-Content-Type-Options
nosniff
CF-RAY
8da5bea3fdde3338-EWR
Content-Length
134
Date
Tue, 29 Oct 2024 19:59:12 GMT
X-XSS-Protection
1; mode=block
Content-Type
text/plain; charset=utf-8
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
Server
cloudflare
X-Frame-Options
SAMEORIGIN
rb_bf18336fji
clients.myibxtpaplan.com/
123 B
668 B
Fetch
General
Full URL
https://clients.myibxtpaplan.com/rb_bf18336fji?type=js3&sn=v_4_srv_5_sn_26AC2268A9E79C5E13F95735A1CB7E24_perc_100000_ol_0_mul_1_app-3A5ab709031ecb748a_1&svrid=5&flavor=post&vi=MUHFIORCUAMRHHJHGRHCWUAAIPHRRPTS-0&modifiedSince=1730132641667&rf=https%3A%2F%2Fclients.myibxtpaplan.com%2FPublic%2FLogin%2F&bp=3&app=5ab709031ecb748a&crc=3671813993&en=pb1lulax&end=1
Requested by
Host: clients.myibxtpaplan.com
URL: https://clients.myibxtpaplan.com/ruxitagentjs_ICA7NVfgqrux_10299241001084140.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:245c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
634865c1e021e633c66dcbc4d7bf1615a02576f20b63f81b60c20f6fbca3fadb
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://clients.myibxtpaplan.com/Public/Login/

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Security-Policy
frame-ancestors 'self';
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Connection
keep-alive
X-Content-Type-Options
nosniff
CF-RAY
8da5beb09aa63338-EWR
Content-Length
134
Date
Tue, 29 Oct 2024 19:59:14 GMT
X-XSS-Protection
1; mode=block
Content-Type
text/plain; charset=utf-8
Vary
Accept-Encoding
Feature-Policy
microphone 'none'; payment 'none'
Server
cloudflare
X-Frame-Options
SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| dT_ object| dtrum object| dynatrace function| onBodyLoad function| onLoginBtnClick function| submitform function| setFocusOnElement function| getParameterByName function| updateErrorMessage function| getErrorMessage

8 Cookies

Domain/Path Name / Value
.myibxtpaplan.com/ Name: dtCookie
Value: v_4_srv_5_sn_26AC2268A9E79C5E13F95735A1CB7E24_perc_100000_ol_0_mul_1_app-3A5ab709031ecb748a_1
.clients.myibxtpaplan.com/ Name: TS01ca4261
Value: 0128776a835718b428d24f72380638646c14ab2c820b4e1074bf9650a5c2b5fc0156010fbdf5f1f32a5a0b12c28085413bd632c303
.myibxtpaplan.com/ Name: __cf_bm
Value: xfnmk9E0gfjwIwcqRcVLRtH6oCDulUAigKnn5PPuk78-1730231950-1.0.1.1-ka4.Z_5_xWNjuCG7vq8kJ2Yh5ZMT_h8xu9TFhWIEsk57XenB9kzrktwxbaTa7_8mG3PdUb0y5moUMbAjb9tiaw
.myibxtpaplan.com/ Name: rxVisitor
Value: 1730231950684JR7I9NFV5PO5VO7BEOQSCIUBPT9FTL66
.myibxtpaplan.com/ Name: dtSa
Value: -
.myibxtpaplan.com/ Name: rxvt
Value: 1730233750906|1730231950685
.myibxtpaplan.com/ Name: dtPC
Value: 5$431950682_944h-vMUHFIORCUAMRHHJHGRHCWUAAIPHRRPTS-0e0
.myibxtpaplan.com/ Name: cf_clearance
Value: otW2_mNPuZyN.Kf4OqtVLWezcW_mTA2IbWAexNkcTdc-1730231950-1.2.1.1-wmA13Haw18GAXzabUhipSPnU1.KigfMv5C_jVcl2NZ6lUQ48cPjWnNgdo5R3.MKzl5zlftbbAhTPZxUDO7tSgtmjpFmf8vfWY9rpTXZaVVWHZ5XlGPOJC1jWF4AbVw.n.ZffAqXG39PgUm8YmBNAiBnNRuTfik0V51.1C_lldDzS.Xo9F7FVodK7zgsY3zBbSwI1P3jPUrIJ0Y5M21ccNWRvDtgT2uItqLqkXG79hIO4nfDe7pvZdUb9btiFNeaOLvYr83XMA6bSXk_TZmhYZGKH5pPXXEvov9.Ic_bkoSxOz3ESsfA8DfRCkEiptNeHDg2pUScbli2WHehk.4LEXzQ4cVAorb63yWmrYz0ASH1FGrN2Ep4ZytwgYzoRRyEE

1 Console Messages

Source Level URL
Text
network error URL: https://clients.myibxtpaplan.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block