no-images-in-public-posts.ckqa.page Open in urlscan Pro
2606:4700:4400::6812:2aee  Public Scan

URL: https://no-images-in-public-posts.ckqa.page/
Submission: On July 19 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2606:4700:4400::6812:2aee, located in United States and belongs to CLOUDFLARENET, US. The main domain is no-images-in-public-posts.ckqa.page.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 14th 2023. Valid for: a year.
This is the only time no-images-in-public-posts.ckqa.page was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 2606:4700:440... 13335 (CLOUDFLAR...)
4 2606:4700:440... 13335 (CLOUDFLAR...)
1 1 188.114.96.3 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
10 3
Apex Domain
Subdomains
Transfer
5 ckqa.page
no-images-in-public-posts.ckqa.page
11 KB
4 convertkitqa.com
cdn.convertkitqa.com
424 KB
1 unsplash.com
images.unsplash.com — Cisco Umbrella Rank: 19337
29 KB
1 qa-convertkitfiles.com
h.qa-convertkitfiles.com
753 B
10 4
Domain Requested by
5 no-images-in-public-posts.ckqa.page no-images-in-public-posts.ckqa.page
cdn.convertkitqa.com
4 cdn.convertkitqa.com no-images-in-public-posts.ckqa.page
1 images.unsplash.com no-images-in-public-posts.ckqa.page
1 h.qa-convertkitfiles.com 1 redirects
10 4

This site contains links to these domains. Also see Links.

Domain
twitter.com
facebook.com
convertkit.com
Subject Issuer Validity Valid
ckqa.page
Cloudflare Inc ECC CA-3
2023-10-14 -
2024-10-13
a year crt.sh
convertkitqa.com
WE1
2024-07-10 -
2024-10-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://no-images-in-public-posts.ckqa.page/
Frame ID: 5D75B0B8E50F8B5BBFEAAFF16A0529D7
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Posts | This page is blue

Page Statistics

10
Requests

90 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

464 kB
Transfer

2434 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://h.qa-convertkitfiles.com/e/bcL4pXTLeDFzRWLHQq9mKQ/4cqYWKsgMngukdDzRmz8Gc HTTP 302
  • https://images.unsplash.com/photo-1684868623430-aa353b5da28d?crop=entropy&cs=srgb&fm=jpg&ixid=M3w3MDkwMnwwfDF8YWxsfDh8fHx8fHwyfHwxNjg1MTE5MDE0fA&ixlib=rb-4.0.3&q=85&utm_source=convertkit&utm_medium=referral&utm_campaign=api-credit?fit=max&w=800

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
no-images-in-public-posts.ckqa.page/
32 KB
9 KB
Document
General
Full URL
https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2aee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
535a3444b2b2ce2543501bed10efb6f005593019cc54f6b1273e9491279d18e0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOWALL
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
cache-control
max-age=30, public, stale-while-revalidate=300, stale-if-error=86400
cf-cache-status
DYNAMIC
cf-ray
8a599ec2cdbb6ab9-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 19 Jul 2024 09:17:45 GMT
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
strict-transport-security
max-age=63072000; includeSubDomains
vary
Origin
x-content-type-options
nosniff
x-frame-options
ALLOWALL
x-permitted-cross-domain-policies
none
x-request-id
3a2a9cf6-2e07-4a1d-8337-79e05caf5be7
x-runtime
0.052254
x-xss-protection
0
runtime-838763a89775b3f11d2a.js
cdn.convertkitqa.com/pages/js/
1 KB
894 B
Script
General
Full URL
https://cdn.convertkitqa.com/pages/js/runtime-838763a89775b3f11d2a.js
Requested by
Host: no-images-in-public-posts.ckqa.page
URL: https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:210f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4eeba0087edfa45fc84a096bfd81d13d356b13b3a5baf8f2946d2e46500215e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 25 Jun 2024 15:23:45 GMT
server
cloudflare
x-amz-request-id
YF96ZSG710ESPV2B
age
6
etag
W/"e8c36e2d01b932de7a88c89cd1cd8580"
x-amz-server-side-encryption
AES256
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cf-ray
8a599ec75d096937-FRA
x-amz-id-2
B3cAE1xCCluiBDiJ09N5CmwMqDteNHHSmGT81fyK7K7lRDn5MXFmyyzE95blnu2Kk/usiumDxa4=
creator-profile-v2-profile-3db76d0ac2868ec16e9e.chunk.js
cdn.convertkitqa.com/pages/js/
1 MB
299 KB
Script
General
Full URL
https://cdn.convertkitqa.com/pages/js/creator-profile-v2-profile-3db76d0ac2868ec16e9e.chunk.js
Requested by
Host: no-images-in-public-posts.ckqa.page
URL: https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:210f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ded680fec5c73098a37a5ea2822d9a98b70611e955c3c2a94d3e00e0813d1ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 25 Jun 2024 15:23:45 GMT
server
cloudflare
x-amz-request-id
H4PZE007MS2KZ325
age
6
etag
W/"fe6d4fc24730dce87642c33ebb266f85"
x-amz-server-side-encryption
AES256
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cf-ray
8a599ec75d066937-FRA
x-amz-id-2
jnMVoC+2vQq16wEEIaUy35zXbkkiBvGLT3Yoy1lbEAl2crddC502rEmAZF8XK4cl2dW6OBfXQiA=
creator-profile-v2-profile-f3f0b1a1467e6365eab4.css
cdn.convertkitqa.com/pages/css/
366 B
547 B
Stylesheet
General
Full URL
https://cdn.convertkitqa.com/pages/css/creator-profile-v2-profile-f3f0b1a1467e6365eab4.css
Requested by
Host: no-images-in-public-posts.ckqa.page
URL: https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:210f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b60a4e53fe44f7cf25c63c806d49d3e01016fb329cfe9bab7d5a6976b02baa0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 25 Jun 2024 15:23:45 GMT
server
cloudflare
x-amz-request-id
YF93ZZ7ZYS7SN5CB
age
6
etag
W/"29f531cad90e35aa4dac900a13bac1de"
x-amz-server-side-encryption
AES256
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cf-ray
8a599ec75d026937-FRA
x-amz-id-2
78JUA8HdE+6yL7skXv4EmUBb+fmOKojSRBq9JhBJFB9FVW4avN9C54dvLBlgjef2GAYPwCkKdLA=
shared-95f7419f130ebbc75a26.css
cdn.convertkitqa.com/pages/css/
1 MB
123 KB
Stylesheet
General
Full URL
https://cdn.convertkitqa.com/pages/css/shared-95f7419f130ebbc75a26.css
Requested by
Host: no-images-in-public-posts.ckqa.page
URL: https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:210f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d287c6f395142fdbd193d2ea200e9c47b41b542f6ea9b634bdf5d4dce74badc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 25 Jun 2024 15:23:45 GMT
server
cloudflare
x-amz-request-id
YF982ZHDJXEMTMWD
age
6
etag
W/"61e03f662df5f1fdac7f15e319fa7b76"
x-amz-server-side-encryption
AES256
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cf-ray
8a599ec75cfd6937-FRA
x-amz-id-2
11RFIXkAzmx5KAo+o5W1dM/ttZ9NY3cZrzEb2MZIYh9RitBO8VDTG/iZMU6qOGqE+OREn4rgB40=
photo-1684868623430-aa353b5da28d
images.unsplash.com/
Redirect Chain
  • https://h.qa-convertkitfiles.com/e/bcL4pXTLeDFzRWLHQq9mKQ/4cqYWKsgMngukdDzRmz8Gc
  • https://images.unsplash.com/photo-1684868623430-aa353b5da28d?crop=entropy&cs=srgb&fm=jpg&ixid=M3w3MDkwMnwwfDF8YWxsfDh8fHx8fHwyfHwxNjg1MTE5MDE0fA&ixlib=rb-4.0.3&q=85&utm_source=convertkit&utm_medium...
29 KB
29 KB
Image
General
Full URL
https://images.unsplash.com/photo-1684868623430-aa353b5da28d?crop=entropy&cs=srgb&fm=jpg&ixid=M3w3MDkwMnwwfDF8YWxsfDh8fHx8fHwyfHwxNjg1MTE5MDE0fA&ixlib=rb-4.0.3&q=85&utm_source=convertkit&utm_medium=referral&utm_campaign=api-credit?fit=max&w=800
Requested by
Host: no-images-in-public-posts.ckqa.page
URL: https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Server
2a04:4e42:200::720 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
imgix /
Resource Hash
8c98bf7619378d368fc83ba6124129ab2d7baa2f82bc8b2210d9b7880c69aaf2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
x-content-type-options
nosniff
last-modified
Fri, 19 Jul 2024 09:06:56 GMT
server
imgix
age
649
x-cache
HIT, MISS, MISS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-imgix-id
a135eed0dd55254476acd192a0fd96f43cc8c7a8
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
29758
x-served-by
cache-sjc10069-SJC, cache-fra-etou8220150-FRA, cache-cph2320028-CPH

Redirect headers

date
Fri, 19 Jul 2024 09:17:45 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-permitted-cross-domain-policies
none
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
x-request-id
6a33e64f12c28dacc1a7bf195a4e9121
x-runtime
0.006866
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
vary
Origin
content-type
text/html; charset=utf-8
location
https://images.unsplash.com/photo-1684868623430-aa353b5da28d?crop=entropy&cs=srgb&fm=jpg&ixid=M3w3MDkwMnwwfDF8YWxsfDh8fHx8fHwyfHwxNjg1MTE5MDE0fA&ixlib=rb-4.0.3&q=85&utm_source=convertkit&utm_medium=referral&utm_campaign=api-credit?fit=max&w=800
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rim6QxmWP52QgM61XE45KzC667dKNIuvMxPhu8tZa0yf3UGiK%2FJdfbqvvYcM90pEEMTzAtYlZTh%2BVlyrCNvCMHH48MGywbDgoWL%2BVDi2ofhaC%2FnXwHjx0OxdHdxnXh0NVgYe7zHQ%2BS4RtTI%3D"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache
cf-ray
8a599ec72e9b9243-FRA
email-decode.min.js
no-images-in-public-posts.ckqa.page/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
825 B
Script
General
Full URL
https://no-images-in-public-posts.ckqa.page/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: no-images-in-public-posts.ckqa.page
URL: https://no-images-in-public-posts.ckqa.page/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2aee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 12 Jul 2024 17:10:52 GMT
server
cloudflare
etag
W/"6691639c-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
8a599ec6baf56ab9-FRA
expires
Sun, 21 Jul 2024 09:17:45 GMT
visit
no-images-in-public-posts.ckqa.page/posts/
0
0
Fetch
General
Full URL
https://no-images-in-public-posts.ckqa.page/posts/visit
Requested by
Host: cdn.convertkitqa.com
URL: https://cdn.convertkitqa.com/pages/js/creator-profile-v2-profile-3db76d0ac2868ec16e9e.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2aee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOWALL
X-Xss-Protection 0

Request headers

Accept
application/json
Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 19 Jul 2024 09:17:46 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
content-length
0
x-xss-protection
0
x-request-id
27119924-80c5-46c3-b582-55469a447d15
x-runtime
0.017805
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
ALLOWALL
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*, *
access-control-expose-headers
cache-control
no-cache
content-type
application/json
vary
Origin
cf-ray
8a599ec90e4a6ab9-FRA
reporting_event
no-images-in-public-posts.ckqa.page/ui/
0
0
Fetch
General
Full URL
https://no-images-in-public-posts.ckqa.page/ui/reporting_event
Requested by
Host: cdn.convertkitqa.com
URL: https://cdn.convertkitqa.com/pages/js/creator-profile-v2-profile-3db76d0ac2868ec16e9e.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2aee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOWALL
X-Xss-Protection 0

Request headers

Accept
application/json
Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 19 Jul 2024 09:17:45 GMT
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
content-length
0
x-xss-protection
0
x-request-id
ed716f7f-b103-43ed-be66-a39d7ca6bd0c
x-runtime
0.015177
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
ALLOWALL
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*, *
access-control-expose-headers
cache-control
no-cache
content-type
application/json
vary
Origin
cf-ray
8a599ec90e4f6ab9-FRA
favicon.ico
no-images-in-public-posts.ckqa.page/
2 KB
999 B
Other
General
Full URL
https://no-images-in-public-posts.ckqa.page/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2aee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca4fc1d5fc9ca1937776ece1374eb574a21b0b33686ad72a7c84ccf5221c4d0f

Request headers

Referer
https://no-images-in-public-posts.ckqa.page/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 19 Jul 2024 09:17:46 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
8a599ecad93f6ab9-FRA
content-type
text/html

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| props object| webpackJsonp function| setImmediate function| clearImmediate object| FontAwesomeConfig object| ___FONT_AWESOME___ object| regeneratorRuntime

2 Cookies

Domain/Path Name / Value
no-images-in-public-posts.ckqa.page/ Name: XSRF-TOKEN
Value: 3-BOiqaoikFg6W7t08Qzo3Hdc85rDFWkTeUCL9zF3XAp_pwntnNF3eY7H7DEHcftMSbLX5bsTv2QqOFvtRjSVg
no-images-in-public-posts.ckqa.page/ Name: _mailapp_session
Value: eUoyTUhmKzY1SXY5OXVPdHJESWM0aGxmOVQ1blg1c3hGY0YvWW41YXUreThLR3pYYlNaMENKUm84RTR1eW5JaXZRaW02MnpZTEJkdnZ6TjhRbWtGTWhQTnoyOEpDTVp6eG5HZ3RhQnN0dHFWa3llYjlqN1BRdVRzNENWWFV1cGFqUFB3M1VPay93TGVscTJOa21IdTR3PT0tLVBkbEhnZFdETHFhT3E0VERzSjlZMXc9PQ%3D%3D--9f68b42a90448becf3e01b1c032b9920ba69985c

1 Console Messages

Source Level URL
Text
network error URL: https://no-images-in-public-posts.ckqa.page/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOWALL
X-Xss-Protection 0