{
"url": "https://macauhotelsunsun.com",
"score": 3,
"summary": {
"missing": 9,
"warnings": 2,
"notices": 8
},
"caches": [
"Website",
"Cloudflare",
"Browser"
],
"headers": {
"date": {
"value": "wed, 28 oct 2026 03:10:42 gmt",
"findings": [
{
"severity": "info",
"message": "The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires."
}
]
},
"content-type": {
"value": "text/plain; charset=utf-8",
"findings": [
{
"severity": "info",
"message": "The type of the message body, specified as a MIME type."
}
]
},
"content-length": {
"value": "16",
"findings": [
{
"severity": "info",
"message": "The size of the message body, in bytes."
}
]
},
"cache-control": {
"value": "private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0",
"findings": [
{
"severity": "info",
"message": "private means the response can only be stored by the browser's cache, but not by CDNs, proxies, or any other shared caches."
},
{
"severity": "info",
"message": "no-cache means the response can be stored by any cache, but the stored response must be validated with the origin server before each reuse. If the origin confirms that the response hasn't changed, downloading of the full response body can be skipped."
},
{
"severity": "warning",
"message": "no-cache will cause a revalidation request to the origin server for every use of the cached response. Consider using public with appropriate max-age to improve caching efficiency."
},
{
"severity": "warning",
"message": "no-store means the response may not be stored in any cache, including the browser's cache. Every request will hit the origin server. If this page can be cached, consider using public with an appropriate max-age."
},
{
"severity": "info",
"message": "max-age=0 with must-revalidate means caching is disabled and all requests must be validated with the origin server."
},
{
"severity": "notice",
"message": "must-revalidate has no effect with no-store since nothing is cached. Remove must-revalidate."
},
{
"severity": "notice",
"message": "must-revalidate is redundant with no-cache since no-cache already requires revalidation. Remove must-revalidate."
},
{
"severity": "notice",
"message": "no-cache is redundant when no-store is set, though some sites keep both for compatibility with older caches."
},
{
"severity": "notice",
"message": "private has no effect when no-store is set since nothing will be cached. It can be safely removed."
},
{
"severity": "notice",
"message": "pre-check is a legacy directive introduced by Internet Explorer 5 and is no longer supported. No other browser supports it. Including pre-check is unnecessary, wastes bandwidth and processing power."
},
{
"severity": "notice",
"message": "post-check is a legacy directive introduced by Internet Explorer 5 and is no longer supported. No other browser supports it. Including post-check is unnecessary, wastes bandwidth and processing power."
}
]
},
"expires": {
"value": "thu, 01 jan 1970 00:00:01 gmt",
"findings": [
{
"severity": "info",
"message": "This Expires date is in the past: the page is considered stale and will be removed from all caches."
},
{
"severity": "notice",
"message": "Because there is a Cache-Control header with a max-age and/or s-maxage directive, the Expires header will be ignored. Consider removing Expires to save bandwidth and processing power."
}
]
},
"referrer-policy": {
"value": "same-origin",
"findings": [
{
"severity": "info",
"message": "When a visitor navigates from one page to another page, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important because private information can be embedded in the path or query string."
},
{
"severity": "info",
"message": "same-origin means that the full URL (protocol, host, port, path and query string) is shared for same-origin requests. For cross-origin requests, no referrer information is shared at all."
}
]
},
"x-frame-options": {
"value": "sameorigin",
"findings": [
{
"severity": "info",
"message": "X-Frame-Options prevents this URL from being embedded in an iframe. This protects against clickjacking attacks."
},
{
"severity": "info",
"message": "sameorigin allows this page to be displayed in an iframe on the same origin. This is the recommended setting."
}
]
},
"server": {
"value": "cloudflare",
"findings": [
{
"severity": "info",
"message": "Identifies the software used by the origin server to handle the request (e.g. Apache, Nginx, Cloudflare)."
},
{
"severity": "notice",
"message": "Consider removing or minimizing the Server header. Even without a version number, it reveals the server software, which aids reconnaissance."
}
]
},
"cf-ray": {
"value": "a516bfbd1a82e5ba-iad",
"findings": [
{
"severity": "info",
"message": "The cf-ray header provides a unique identifier for each request through Cloudflare. It's useful for troubleshooting and tracking requests in Cloudflare logs."
}
]
},
"alt-svc": {
"value": "h3=\":443\"; ma=86400",
"findings": [
{
"severity": "info",
"message": "The alt-svc header tells the browser that the same content is available over a different protocol. This allows the browser to upgrade to a faster protocol (e.g. HTTP/3 over QUIC) on subsequent requests without a separate negotiation step."
},
{
"severity": "info",
"message": "h3 indicates that HTTP/3 is supported. HTTP/3 uses the QUIC protocol (UDP-based) instead of TCP, which eliminates the TCP handshake delay and performs better on lossy networks. Variants like h3-29 refer to specific drafts of the HTTP/3 protocol."
},
{
"severity": "info",
"message": "ma=86400 specifies that the alternative service information is fresh for 86400 seconds."
}
]
}
},
"missing": {
"strict-transport-security": {
"message": "Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication."
},
"content-security-policy": {
"message": "Add a Content-Security-Policy header. The Content-Security-Policy header helps browsers prevent cross site scripting (XSS) and data injection attacks."
},
"permissions-policy": {
"message": "Add a Permissions-Policy header. Restrict access to device features like the camera, microphone, location, accelerometer and much more."
},
"cross-origin-embedder-policy": {
"message": "Add a Cross-Origin-Embedder-Policy header. It requires cross-origin resources to explicitly consent before this page can load them, protecting those resources from being exposed to Spectre-style timing attacks. Together with Cross-Origin-Opener-Policy, it enables cross-origin isolation and access to SharedArrayBuffer."
},
"cross-origin-opener-policy": {
"message": "Add a Cross-Origin-Opener-Policy header. It prevents other sites from retaining a window reference to this page when opened via window.open() or navigation, blocking script-based attacks through shared browsing contexts."
},
"cross-origin-resource-policy": {
"message": "Add a Cross-Origin-Resource-Policy header. It controls which origins can embed or load this page's resources (images, scripts, etc.), preventing hotlinking and cross-origin data leaks."
},
"x-content-type-options": {
"message": "Add an X-Content-Type-Options: nosniff header to prevent browsers from MIME type sniffing. Without it, browsers may interpret files as a different content type than intended, which can lead to security vulnerabilities."
},
"x-permitted-cross-domain-policies": {
"message": "Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains."
},
"content-encoding": {
"message": "No Content-Encoding header found. Enable compression such as gzip or br (Brotli) to reduce transfer sizes. Brotli typically achieves 15–20% better compression than gzip and is supported by all modern browsers."
}
}
}