{
    "url": "https://9roe4wokvct.typeform.com/to/sbvVGFtU",
    "score": 0,
    "summary": {
        "missing": 8,
        "warnings": 5,
        "notices": 7
    },
    "caches": [
        "Website",
        "Browser"
    ],
    "headers": {
        "date": {
            "value": "sun, 26 jul 2026 06:36:31 gmt",
            "findings": [
                {
                    "severity": "info",
                    "message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against <code>Max-Age</code> or <code>Expires</code>."
                }
            ]
        },
        "content-type": {
            "value": "text/html; charset=utf-8",
            "findings": [
                {
                    "severity": "info",
                    "message": "The type of the message body, specified as a <a href=\"https://en.wikipedia.org/wiki/Media_type\">MIME type</a>."
                }
            ]
        },
        "set-cookie": {
            "value": "awsalbtg=5vsmoydpm7lpyvhrlwmmpf4jjfoevfetl/rmvybhdfnoge8bgz+1yuyyogxs8v8p5aqer1tzfpo1m6eybxeg0uzjjzbebvp0abszusjvyvvucn7eqaiwzgl/nvqbapikajgje0k3qghuok5thtssgpxjpxdyiaqziyn3jml6iot8; expires=sun, 02 aug 2026 06:36:31 gmt; path=/, awsalbtgcors=5vsmoydpm7lpyvhrlwmmpf4jjfoevfetl/rmvybhdfnoge8bgz+1yuyyogxs8v8p5aqer1tzfpo1m6eybxeg0uzjjzbebvp0abszusjvyvvucn7eqaiwzgl/nvqbapikajgje0k3qghuok5thtssgpxjpxdyiaqziyn3jml6iot8; expires=sun, 02 aug 2026 06:36:31 gmt; path=/; samesite=none; secure",
            "findings": [
                {
                    "severity": "info",
                    "message": "A cookie that was sent from the server to the browser."
                },
                {
                    "severity": "info",
                    "message": "<code>expires=</code> sets the maximum lifetime of the cookie using a specific date."
                },
                {
                    "severity": "info",
                    "message": "<code>path=</code> indicates the path that must exist in the requested URL for the browser to send the cookie."
                },
                {
                    "severity": "warning",
                    "message": "<code>samesite=none</code> instructs the browser to send the cookie to all cross-site requests, such as on requests to load images or frames from other sites. This enables third-party sites to log cookie data. This could lead to data leaks and cross-site request forgery attacks. To improve security, set to <code>samesite=strict</code> or <code>samesite=lax</code>."
                },
                {
                    "severity": "info",
                    "message": "<code>secure</code> instructs the browser to only send the cookie back when HTTPS requests are used, making it more resistant to man-in-the-middle attacks."
                },
                {
                    "severity": "notice",
                    "message": "This cookie is missing the <code>httponly</code> flag. Without it, JavaScript can access the cookie, increasing the risk of cross-site scripting (XSS) attacks."
                }
            ]
        },
        "traceparent": {
            "value": "00-d7979bac54c1853cfe80aafb9487327d-1cf06e501d16e5c6-01",
            "findings": [
                {
                    "severity": "info",
                    "message": "A <a href=\"https://www.w3.org/TR/trace-context/\">W3C Trace Context</a> header for distributed tracing. Contains a trace ID, span ID, and trace flags that allow requests to be tracked across multiple services and systems."
                }
            ]
        },
        "cache-control": {
            "value": "private no-cache no-store max-age=0 must-revalidate",
            "findings": [
                {
                    "severity": "info",
                    "message": "<code>private</code> means the response can <em>only</em> be stored by the browser's cache, but <em>not</em> by CDNs, proxies, or any other shared caches."
                },
                {
                    "severity": "info",
                    "message": "<code>no-cache</code> means the response can be stored by <em>any</em> cache, but the stored response <strong>must</strong> be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped."
                },
                {
                    "severity": "warning",
                    "message": "<code>no-cache</code> will cause a revalidation request to the origin server for <em>every</em> use of the cached response. Consider using <code>public</code> with appropriate <code>max-age</code> to improve caching efficiency."
                },
                {
                    "severity": "warning",
                    "message": "<code>no-store</code> means the response may <em>not</em> be stored in <em>any</em> cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using <code>public</code> with an appropriate <code>max-age</code>."
                },
                {
                    "severity": "info",
                    "message": "<code>max-age=0</code> with <code>must-revalidate</code> means caching is disabled and all requests must be validated with the origin server."
                },
                {
                    "severity": "notice",
                    "message": "<code>must-revalidate</code> has no effect with <code>no-store</code> since nothing is cached. Remove <code>must-revalidate</code>."
                },
                {
                    "severity": "notice",
                    "message": "<code>must-revalidate</code> is redundant with <code>no-cache</code> since <code>no-cache</code> already requires revalidation. Remove <code>must-revalidate</code>."
                },
                {
                    "severity": "notice",
                    "message": "<code>no-cache</code> is redundant when <code>no-store</code> is set, though some sites keep both for compatibility with older caches."
                },
                {
                    "severity": "notice",
                    "message": "<code>private</code> has no effect when <code>no-store</code> is set since nothing will be cached. It can be safely removed."
                }
            ]
        },
        "pragma": {
            "value": "no-cache",
            "findings": [
                {
                    "severity": "notice",
                    "message": "<code>Pragma: no-cache</code> forces revalidation with the origin server on every request. <code>Pragma</code> is a legacy HTTP/1.0 directive, superseded by <code>Cache-Control</code>. Remove <code>Pragma</code> to save bandwidth and processing power."
                }
            ]
        },
        "x-cache": {
            "value": "hit",
            "findings": [
                {
                    "severity": "info",
                    "message": "The page was served from a cache."
                }
            ]
        },
        "x-cache-lookup": {
            "value": "hit",
            "findings": [
                {
                    "severity": "info",
                    "message": "The page was served from a cache."
                }
            ]
        },
        "x-powered-by": {
            "value": "30091533737-11.7.0",
            "findings": [
                {
                    "severity": "info",
                    "message": "Some of the software used to generate or serve this page."
                },
                {
                    "severity": "warning",
                    "message": "Sharing too many details about a server or web application makes it easier for hackers to target a website. Avoid specific version numbers such as 11.7.0, especially when running software that is end-of-life and/or has known security bugs. Consider removing this header. At a minimum, remove any version number."
                }
            ]
        },
        "vary": {
            "value": "accept-encoding",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>Vary</code> header specifies a list of headers that must be considered when caching responses. For a cached response to be used, these headers must match between the cached response and the new request. This ensures that the appropriate version of a resource is served based on factors like language, encoding, or device type."
                }
            ]
        },
        "content-encoding": {
            "value": "br",
            "findings": [
                {
                    "severity": "info",
                    "message": "Specifies how the resource is <em>compressed</em>. Not to be confused with <code>Transfer-Encoding</code> which specifies how the data is transferred."
                },
                {
                    "severity": "info",
                    "message": "<code>br</code> means that the data is compressed with <code>brotli</code>."
                },
                {
                    "severity": "warning",
                    "message": "Add a <code>Content-Length</code> header. The Content-Length header is required, unless the message is transported using chunked encoding. Without a <code>Content-Length</code> header some servers will respond with 400 (bad request) or terminate connections early."
                }
            ]
        },
        "x-envoy-upstream-service-time": {
            "value": "40",
            "findings": [
                {
                    "severity": "info",
                    "message": "The time in milliseconds that the Envoy proxy spent waiting for the upstream service to respond. Envoy is used by many cloud platforms including Google Cloud, Istio, and AWS App Mesh."
                }
            ]
        },
        "server": {
            "value": "istio-envoy",
            "findings": [
                {
                    "severity": "info",
                    "message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
                },
                {
                    "severity": "notice",
                    "message": "Consider removing or minimizing the <code>Server</code> header. Even without a version number, it reveals the server software, which aids reconnaissance."
                }
            ]
        },
        "access-control-allow-methods": {
            "value": "get, options, post, put, patch, delete",
            "findings": [
                {
                    "severity": "info",
                    "message": "Part of CORS (Cross-Origin Resource Sharing). Sent in response to a preflight request to indicate which HTTP methods (e.g. <code>GET</code>, <code>POST</code>, <code>PUT</code>) the server allows for cross-origin requests."
                }
            ]
        },
        "access-control-allow-headers": {
            "value": "x-typeform-key, content-type, authorization, typeform-version, typeform-app, x-requested-with, anonymousid, x-namespace",
            "findings": [
                {
                    "severity": "info",
                    "message": "Part of CORS (Cross-Origin Resource Sharing). Sent in response to a preflight request to indicate which HTTP headers the server allows in the actual cross-origin request."
                }
            ]
        },
        "access-control-expose-headers": {
            "value": "location, x-request-id",
            "findings": [
                {
                    "severity": "info",
                    "message": "Specifies which headers can be exposed to the client in a CORS (Cross-Origin Resource Sharing) context."
                }
            ]
        },
        "strict-transport-security": {
            "value": "max-age=63072000; includesubdomains",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>Strict-Transport-Security</code> header (HSTS) instructs browsers to only use HTTPS for future connections to this domain, enhancing security by preventing downgrade attacks and cookie hijacking."
                },
                {
                    "severity": "info",
                    "message": "<code>max-age</code> specifies the time, in seconds, that the browser should remember to use HTTPS only for this domain."
                },
                {
                    "severity": "info",
                    "message": "<code>includesubdomains</code> instructs the browser that all subdomains are HTTPS-only as well."
                }
            ]
        },
        "x-content-type-options": {
            "value": "nosniff",
            "findings": [
                {
                    "severity": "info",
                    "message": "The <code>X-Content-Type-Options</code> header prevents browsers from guessing a response's content type. Without it, browsers may interpret files differently than intended, which can lead to security vulnerabilities."
                },
                {
                    "severity": "info",
                    "message": "The value <code>nosniff</code> is correctly set."
                }
            ]
        }
    },
    "missing": {
        "content-security-policy": {
            "message": "Add a <code>Content-Security-Policy</code> header. The <code>Content-Security-Policy</code> header helps browsers prevent cross site scripting (XSS) and data injection attacks."
        },
        "referrer-policy": {
            "message": "Add a <code>Referrer-Policy</code> header. When a visitor navigates from one page to another, browsers often pass along <em>referrer information</em>. The <code>Referrer-Policy</code> header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the <i>path</i> or <i>query string</i> and passed onto an external destination."
        },
        "permissions-policy": {
            "message": "Add a <code>Permissions-Policy</code> header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
        },
        "cross-origin-embedder-policy": {
            "message": "Add a <code>Cross-Origin-Embedder-Policy</code> header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with <code>Cross-Origin-Opener-Policy</code>, it enables cross-origin isolation and access to <code>SharedArrayBuffer</code>."
        },
        "cross-origin-opener-policy": {
            "message": "Add a <code>Cross-Origin-Opener-Policy</code> header. It prevents other sites from retaining a <code>window</code> reference to this page when opened via <code>window.open()</code> or navigation, blocking script-based attacks through shared browsing contexts."
        },
        "cross-origin-resource-policy": {
            "message": "Add a <code>Cross-Origin-Resource-Policy</code> header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
        },
        "x-frame-options": {
            "message": "Add a <code>X-Frame-Options</code> header. The <code>X-Frame-Options</code> header prevents this URL from being embedded in an <code>iframe</code>. This protects against clickjacking attacks. Alternatively, set a <code>Content-Security-Policy</code> header with a <code>frame-ancestors</code> directive."
        },
        "x-permitted-cross-domain-policies": {
            "message": "Add a <code>X-Permitted-Cross-Domain-Policies</code> header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
        }
    }
}