Security Report Summary
A
Site: https://www.americanexpress.com/
IP Address: 104.123.96.191
Report Time: 13 Jun 2026 11:09:38 UTC
Headers:
  • Referrer-Policy
  • Strict-Transport-Security
  • X-Content-Type-Options
  • X-Frame-Options
  • Content-Security-Policy
  • Permissions-Policy
Advanced:
Great grade! Perform a deeper security analysis of your website and APIs:
Missing Headers
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
Strict-Transport-SecurityThere was a duplicate Strict-Transport-Security header.
X-Content-Type-OptionsThere was a duplicate X-Content-Type-Options header.
Raw Headers
HTTP/2200
content-typetext/html; charset=utf-8
referrer-policyno-referrer
strict-transport-securitymax-age=63072000; includeSubDomains
x-content-type-optionsnosniff
x-dns-prefetch-controloff
x-download-optionsnoopen
x-frame-optionsSAMEORIGIN
x-permitted-cross-domain-policiesnone
x-xss-protection0
one-app-version6.24.0-c07fbeaa
cache-controlno-store
pragmano-cache
content-security-policyreport-uri https://homepage1uplifthydra.americanexpress.com/_/report/security/csp-violation; block-all-mixed-content; default-src *.aexp.com 'self' wss://*.americanexpress.com *.americanexpress.com *.aexp-static.com nexus.ensighten.com *.bf.dynatrace.com omn.americanexpress.com assets.adobedtm.com aexp.demdex.net stage.sp100500b5.guided.ss-omtrdc.net sp100500b5.guided.ss-omtrdc.net service.maxymiser.net api.maxymiser.net wss://*.liveperson.net *.liveperson.net *.liveperson.com *.lpsnmedia.net *.liveengage.net *.liveengage.com *.liveper.sn https://addressvalidation.googleapis.com maps.googleapis.com maps.gstatic.com fonts.googleapis.com fonts.gstatic.com csi.gstatic.com ads.yahoo.com cdn.optimizely.com aeopdevvip.acxiom.com aeopprodvip.acxiom.com api.rlcdn.com/api/identity/idl zndhztugwqhlulqht-aexpfeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com aexpfeedback.siteintercept.qualtrics.com aexpfeedback.com ca1.qualtrics.com yul1.qualtrics.com; script-src 'nonce-1cfffeca-caf4-4979-bf57-4e45e9f21fd2' *.aexp.com c.evidon.com 'self' *.americanexpress.com *.aexp-static.com nexus.ensighten.com service.maxymiser.net api.maxymiser.net *.liveperson.net *.lpsnmedia.net track.sv.rkdms.com api.securedvisit.com omn.americanexpress.com aexp.demdex.net assets.adobedtm.com s.ntv.io ct.contentsquare.net contentsquare.com app.contentsquare.com js-cdn.dynatrace.com staging.cdn-net.com www.cdn-net.com utt.impactcdn.com ojrq.net doubleclick.net googleads.g.doubleclick.net ad.doubleclick.net https://www.googletagmanager.com https://pagead2.googlesyndication.com https://doubleclick.net www.googleads.g.doubleclick.net https://ad.doubleclick.net/activity https://googleads.g.doubleclick.net www.google.com/recaptcha/ www.gstatic.com/recaptcha/ securepubads.g.doubleclick.net https://www.google.com/gmp/ https://www.google.com/ccm/ https://www.google.com/pagead/ https://www.googleadservices.com; img-src data: c.evidon.com 'self' blob: *.americanexpress.com *.aexp-static.com *.bf.dynatrace.com amex.sv.rkdms.com images.securedvisit.com stags.bluekai.com p.adsymptotic.com www.facebook.com aax-eu.amazon-adsystem.com aax-fe.amazon-adsystem.com private-orm-open-receipt-match.s3.amazonaws.com s.amazon-adsystem.com b92.yahoo.co.jp sp.analytics.yahoo.com alb.reddit.com https://ad.soicos.com https://lot.neatpowr.com pixel.sojern.com tag.yieldoptimizer.com dc.ads.linkedin.com px.ads.linkedin.com www.bizographics.com www.linkedin.com/px/ *.doublemax.net t.teads.tv track.adform.net jadserve.postrelease.com affleads.latamtracking.com pubads.g.doubleclick.net bat.bing.com/action/ prf.hn c.contentsquare.net r.contentsquare.net l.contentsquare.net wr-us.contentsquare.net pixel.quantserve.com insight.adsrvr.org track.securedvisit.com track.sv.rkdms.com ct.pinterest.com/v3/ rtb.adgrx.com tags.w55c.net ping.pdst.fm ib.adnxs.com/pixie pmldigital.go2cloud.org/aff_l pixel.efike.co/pixel.php px.sunmedia.tv/tr pixel.loganmedia.mobi/ traffic.kickadsit.com/ tags.srv.stackadapt.com a.tribalfusion.com px.adentifi.com secure.adnxs.com/ amplify.outbrain.com/ tr.outbrain.com/ dr.outbrain.com/ analytics.twitter.com t.co logs-01.loggly.com pixel.cdn.tagular.com www.google.com/ads/user-lists/ www.google.com/pagead/1p-user-list/ www.gstatic.com/recaptcha/ www.google.com/recaptcha/ ad.doubleclick.net ad-emea.doubleclick.net www.google.com/pagead/1p-conversion/ https://www.googleadservices.com/ https://googleads.g.doubleclick.net https://www.googletagmanager.com ad.au.doubleclick.net/activity https://pagead2.googlesyndication.com https://www.google.com https://ade.googlesyndication.com https://adservice.google.com https://ad.doubleclick.net/activity https://www.google.com/gmp/conversion https://www.google.com/ccm/collect https://www.google.ad https://www.google.cat https://www.googleadservices.com https://google.com https://ad.doubleclick.net https://fonts.gstatic.com https://elfingest.aexp.com; style-src *.aexp.com 'unsafe-inline' *.aexp-static.com *.liveperson.net *.americanexpress.com *.bf.dynatrace.com fonts.googleapis.com fonts.gstatic.com csi.gstatic.com content.securedvisit.com; connect-src 'self' *.aexp.com *.aexp-static.com c.evidon.com l.evidon.com optoutapi.evidon.com *.americanexpress.com assets.adobedtm.com aexp.demdex.net dpm.demdex.net *.bf.dynatrace.com *.sundaysky.com zndhztugwqhlulqht-aexpfeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com aexpfeedback.siteintercept.qualtrics.com aexpfeedback.com ca1.qualtrics.com c.contentsquare.net r.contentsquare.net l.contentsquare.net wr-us.contentsquare.net q-aus1.contentsquare.net k-aus1.contentsquare.net *.liveperson.net aeopdevvip.acxiom.com aeopprodvip.acxiom.com track.securedvisit.com amex.sv.rkdms.com track.sv.rkdms.com https://pagead2.googlesyndication.com securepubads.g.doubleclick.net https://www.google.com/gmp/conversion https://www.google.com/ccm/collect https://googleads.g.doubleclick.net https://www.googleadservices.com https://ad.doubleclick.net https://google.com https://www.google.com; manifest-src 'self' *.aexp.com *.americanexpress.com *.aexp-static.com; worker-src 'self' *.aexp.com *.americanexpress.com *.aexp-static.com blob:; frame-ancestors 'none'; frame-src blob: aexp.demdex.net *.idfy.io *.idfy.no *.americanexpress.com *.liveperson.net service.maxymiser.net *.aexp-static.com staging.cdn-net.com www.cdn-net.com *.bf.dynatrace.com api.securedvisit.com https://8627703.fls.doubleclick.net https://189445.fls.doubleclick.net https://14859086.fls.doubleclick.net https://5059743.fls.doubleclick.net https://15058099.fls.doubleclick.net https://8538740.fls.doubleclick.net https://14245440.fls.doubleclick.net https://9145004.fls.doubleclick.net https://15014717.fls.doubleclick.net https://www.goole.com https://www.google.ad https://www.google.cat https://td.doubleclick.net https://www.googletagmanager.com; child-src blob:
x-b3-traceide10bcb4f880e423487d00d29e0a53e05
x-b3-spanid402a1b072f181fcb
x-b3-sampled1
traceparent00-e10bcb4f880e423487d00d29e0a53e05-402a1b072f181fcb-01
tracestatec603d647-5eda1a12@dt=fw4;d;91837432;4ed448b;3;1;0;1dc;1674;2h01;3h91837432;4h04ed448b;5h01;7h015d3a7fa9f82d3e
content-encodinggzip
strict-transport-securitymax-age=31536000; includeSubDomains
x-content-type-optionsnosniff
content-length127507
dateSat, 13 Jun 2026 11:09:38 GMT
varyAccept-Encoding
set-cookieagent-id=d5aa75ac-041e-48bc-ae67-e3982d360e40; expires=Sun, 13-Jun-2027 11:09:38 GMT; path=/; domain=.americanexpress.com; secure; HttpOnly
akamai-request-bc[a=2.19.176.13,b=965794305,c=g,n=IE__DUBLIN,o=20940]
set-cookieakaalb_www_homepageus_v18=1781349278~op=www_homepage_enus_LBM:homepagehydraorigin|~rv=80~m=homepagehydraorigin:0|~os=9184cb63cc50160c7345890467a4f9a2~id=f3b30fabd590722a6436a338da60f930; path=/; Expires=Sat, 13 Jun 2026 11:14:38 GMT; HttpOnly; Secure; SameSite=None
set-cookieakaalb_www_homepageus_v18=1781349278~op=www_homepage_enus_LBM:homepagehydraorigin|~rv=80~m=homepagehydraorigin:0|~os=9184cb63cc50160c7345890467a4f9a2~id=f3b30fabd590722a6436a338da60f930; path=/; Expires=Sat, 13 Jun 2026 11:14:38 GMT; HttpOnly; Secure; SameSite=None
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
referrer-policyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
x-xss-protectionX-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead.
content-security-policyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".