urlscan.io logo urlscan.io
SecurityTrails logo

heroclick.io Open in urlscan Pro
72.52.161.142  Public Scan

Go To Rescan Add Verdict Report
URL: https://heroclick.io/
Submission: On November 12 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 72.52.161.142, located in United States and belongs to LIQUIDWEB, US. The main domain is heroclick.io.
TLS certificate: Issued by R11 on November 7th 2024. Valid for: 3 months.
This is the only time heroclick.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 12 72.52.161.142 32244 (LIQUIDWEB)
1 192.0.77.48 2635 (AUTOMATTIC)
13 3
Apex Domain
Subdomains		 Transfer
12 heroclick.io
heroclick.io
39 KB
1 w.org
s.w.org — Cisco Umbrella Rank: 4537
795 B
13 2
Domain Requested by
12 heroclick.io 1 redirects heroclick.io
1 s.w.org heroclick.io
13 2

This site contains links to these domains. Also see Links.

Domain
www.company119.com
Subject Issuer Validity Valid
*.heroclick.io
R11		 2024-11-07 -
2025-02-05		 3 months crt.sh
*.w.org
Sectigo ECC Domain Validation Secure Server CA		 2023-12-18 -
2025-01-17		 a year crt.sh

This page contains 1 frames:

Primary Page: https://heroclick.io/
Frame ID: 8B200F1ED80A537B81612078E8F9BCEF
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Home - HeroClick by Company 119

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Page Statistics

13
Requests

85 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

40 kB
Transfer

189 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • https://heroclick.io/favicon.ico HTTP 302
  • https://heroclick.io/wp-includes/images/w-logo-blue-white-bg.png

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
heroclick.io/ 		20 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
f0ad4558164505b8bd56f8c22e46d5e12083e4b8fa2203dc598902e5cad0e312
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
5264
content-type
text/html; charset=UTF-8
date
Tue, 12 Nov 2024 13:11:04 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
link
<https://heroclick.io/wp-json/>; rel="https://api.w.org/", <https://heroclick.io/wp-json/wp/v2/pages/2>; rel="alternate"; title="JSON"; type="application/json", <https://heroclick.io/>; rel=shortlink
pragma
no-cache
referrer-policy
no-referrer
server
Apache
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding,User-Agent
x-content-type-options
nosniff
x-frame-options
sameorigin
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
normalize.min.css
heroclick.io/wp-content/plugins/breakdance/plugin/themeless/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/plugins/breakdance/plugin/themeless/normalize.min.css
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
da17f6c3072f2fdc0cebdce84afa6593a0a2c0e72c4fb7231144328a3da41846
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 19:11:00 GMT
vary
Accept-Encoding,User-Agent
content-type
text/css
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
958
x-xss-protection
1; mode=block
server
Apache
style.min.css
heroclick.io/wp-includes/css/dist/block-library/ 		110 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-includes/css/dist/block-library/style.min.css?ver=6.6.2
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
fb3a89cc6347e098063bd15f285bc90411846ddce6f17812364feedab67a67f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 18:52:09 GMT
vary
Accept-Encoding,User-Agent
content-type
text/css
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
14840
x-xss-protection
1; mode=block
server
Apache
post-2-defaults.css
heroclick.io/wp-content/uploads/breakdance/css/ 		895 B
409 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/uploads/breakdance/css/post-2-defaults.css?v=1543ec0627c99aa325a89c70f71e30ee
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
1f10e392fba89854dc3dc8d07bb67b15524e312b15f816fe6830e0cbb9677be5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 21:14:41 GMT
vary
Accept-Encoding,User-Agent
content-type
text/css
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
346
x-xss-protection
1; mode=block
server
Apache
global-settings.css
heroclick.io/wp-content/uploads/breakdance/css/ 		25 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/uploads/breakdance/css/global-settings.css?v=d3f34642bfd56a695058ce0c1be94085
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
417912c81126bb2fb8e4ee0ce961720e841571f1fc11a5e7e38a215a5e4a749f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 21:13:33 GMT
vary
Accept-Encoding,User-Agent
content-type
text/css
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
5518
x-xss-protection
1; mode=block
server
Apache
presets.css
heroclick.io/wp-content/uploads/breakdance/css/ 		0
60 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/uploads/breakdance/css/presets.css?v=d41d8cd98f00b204e9800998ecf8427e
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
x-permitted-cross-domain-policies
none
referrer-policy
no-referrer
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
accept-ranges
bytes
content-length
0
x-xss-protection
1; mode=block
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 21:13:33 GMT
vary
User-Agent
server
Apache
content-type
text/css
x-frame-options
sameorigin
selectors.css
heroclick.io/wp-content/uploads/breakdance/css/ 		0
28 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/uploads/breakdance/css/selectors.css?v=d41d8cd98f00b204e9800998ecf8427e
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
x-permitted-cross-domain-policies
none
referrer-policy
no-referrer
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
accept-ranges
bytes
content-length
0
x-xss-protection
1; mode=block
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 21:13:33 GMT
vary
User-Agent
server
Apache
content-type
text/css
x-frame-options
sameorigin
post-2.css
heroclick.io/wp-content/uploads/breakdance/css/ 		707 B
320 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/uploads/breakdance/css/post-2.css?v=bc7fde204e974be17e1671ed8c5cb8d8
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
cabb8d8df7c0c4877bf3ddb461e53cd85a6b3a89bc337c1dc54bb432de56e9f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 21:14:41 GMT
vary
Accept-Encoding,User-Agent
content-type
text/css
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
281
x-xss-protection
1; mode=block
server
Apache
breakdance-utils.js
heroclick.io/wp-content/plugins/breakdance/plugin/global-scripts/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-content/plugins/breakdance/plugin/global-scripts/breakdance-utils.js?bd_ver=2.1.0
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
1163a1caae6161aeff0dccd7fdce2616cd2c0ebc88af544d876be750bbe9b216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:04 GMT
date
Tue, 12 Nov 2024 13:11:04 GMT
last-modified
Thu, 07 Nov 2024 19:11:00 GMT
vary
Accept-Encoding,User-Agent
content-type
text/javascript
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
2227
x-xss-protection
1; mode=block
server
Apache
71c15aa8-94b8-4ec6-9e0f-b21f4f5b6798
https://heroclick.io/ 		0
0
wp-emoji-release.min.js
heroclick.io/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-includes/js/wp-emoji-release.min.js?ver=6.6.2
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:05 GMT
date
Tue, 12 Nov 2024 13:11:05 GMT
last-modified
Thu, 07 Nov 2024 18:52:09 GMT
vary
Accept-Encoding,User-Agent
content-type
text/javascript
x-frame-options
sameorigin
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
referrer-policy
no-referrer
accept-ranges
bytes
content-length
5062
x-xss-protection
1; mode=block
server
Apache
1f525.svg
s.w.org/images/core/emoji/15.0.3/svg/ 		822 B
795 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/15.0.3/svg/1f525.svg
Requested by
Host: heroclick.io
URL: https://heroclick.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
4fa646a4dbc10513ddeb70561789483638faf456e15186f4eb7291c5c455cbb6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

vary
Accept-Encoding
cache-control
max-age=315360000
content-encoding
br
x-nc
HIT hhn 1
access-control-allow-methods
GET, HEAD
x-content-type-options
nosniff
expires
Thu, 31 Dec 2037 23:55:55 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Tue, 12 Nov 2024 13:11:05 GMT
content-type
image/svg+xml
last-modified
Tue, 30 Jan 2024 01:18:34 GMT
server
nginx
x-frame-options
SAMEORIGIN
w-logo-blue-white-bg.png
heroclick.io/wp-includes/images/
Redirect Chain
  • https://heroclick.io/favicon.ico
  • https://heroclick.io/wp-includes/images/w-logo-blue-white-bg.png
4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://heroclick.io/wp-includes/images/w-logo-blue-white-bg.png
Protocol
H2
Server
72.52.161.142 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
cloud01.company119.com
Software
Apache /
Resource Hash
6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=2592000
x-permitted-cross-domain-policies
none
referrer-policy
no-referrer
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 13:11:05 GMT
accept-ranges
bytes
content-length
4119
x-xss-protection
1; mode=block
date
Tue, 12 Nov 2024 13:11:05 GMT
last-modified
Thu, 07 Nov 2024 18:48:53 GMT
content-type
image/png
server
Apache
x-frame-options
sameorigin

Redirect headers

x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
expires
Thu, 19 Nov 1981 08:52:00 GMT
date
Tue, 12 Nov 2024 13:11:05 GMT
content-type
text/html; charset=UTF-8
vary
User-Agent
x-frame-options
sameorigin
x-redirect-by
WordPress
strict-transport-security
max-age=31536000; includeSubDomains; preload
link
<https://heroclick.io/wp-json/>; rel="https://api.w.org/"
cache-control
no-store, no-cache, must-revalidate
location
https://heroclick.io/wp-includes/images/w-logo-blue-white-bg.png
pragma
no-cache
referrer-policy
no-referrer
content-length
0
x-xss-protection
1; mode=block
server
Apache

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
heroclick.io
URL
blob:https://heroclick.io/71c15aa8-94b8-4ec6-9e0f-b21f4f5b6798

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings object| BreakdanceFrontend object| twemoji object| wp

4 Cookies

Domain/Path Name / Value
heroclick.io/ Name: PHPSESSID
Value: 72845899af4677e9cdfae70bc14a39fa
heroclick.io/ Name: breakdance_view_count
Value: 1
heroclick.io/ Name: breakdance_session_count
Value: 1
heroclick.io/ Name: breakdance_last_session_id
Value: 72845899af4677e9cdfae70bc14a39fa

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block