Security Report Summary
D
| Site: | https://apps.irs.gov/app/eos | ||
|---|---|---|---|
| IP Address: | 23.44.131.213 | ||
| Report Time: | 08 Oct 2026 10:29:16 UTC | ||
| Headers: |
|
||
| Advanced: |
|
Missing Headers
| Content-Security-Policy | Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. |
|---|---|
| X-Frame-Options | X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN". |
| X-Content-Type-Options | X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff". |
| Referrer-Policy | Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. |
| Permissions-Policy | Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser. |
Raw Headers
| HTTP/2 | 200 |
|---|---|
| x-amz-id-2 | 31gEBKYrnwtEsGQ0A/0I1myISRe4pNHMeN0VsP7RMzHShwq7m5l4ysjQneEsi+zBI17VrLS4Bh3baBPZi+GgH9C2igudUxckav/neDyiofA= |
| x-amz-request-id | ZRSD6VXH7389DNST |
| last-modified | Fri, 29 May 2026 11:17:56 GMT |
| etag | "46d35a011d8299c3253e58b1be0497e7" |
| x-amz-server-side-encryption | AES256 |
| x-amz-version-id | mIT0G6WDp7mnGboNIRi52c9iLbYNYKCa |
| accept-ranges | bytes |
| content-type | text/html |
| vary | Accept-Encoding |
| content-encoding | gzip |
| date | Thu, 08 Oct 2026 10:29:16 GMT |
| content-length | 31545 |
| alt-svc | h3=":443"; ma=93600 |
| set-cookie | akaalb_PAWS_ALB_PROD=1791456256~op=ALB_TEOS_PROD:TEOS_East_Cloudapps_PROD|~rv=76~m=TEOS_East_Cloudapps_PROD:0|~os=f04148c27847015de8d0928bda9afd2a~id=ffff30b25d203d9fa77d61ab7f9c4e37; path=/; Expires=Thu, 08 Oct 2026 10:44:16 GMT; HttpOnly; Secure; SameSite=None |
| strict-transport-security | max-age=31536000 |
| akamai-grn | 0.4d822c17.1791455356.34f59498 |
| set-cookie | _abck=4AEC66ABF31DD8A8EB9884593D4044DB~-1~YAAQTYIsF3NiXfGgAQAAWGUPGxD8KWk3o2mg8Fptv3GdvKK7tIAta5Ff3Ud2LuDSFftbAWUGbmSw7b/vY2c+K096qH6ADYbcNxKYVLe6HRzdLTl/XKxp3066vRchQFkbt/orm1Df1+nXnCYropUvnrMb0lyyTDHEfVWAGXeaomt7cnoe8qE1O5BzSWLsBdkOVgNXtJwedSm/+0yIUB/eW5Tkuu32rRJsm7xd1Apy3PoK4l8FY1Jp7QWQDxSzXgqyanzK81ybKDWRikRk0MB/L49AM/kF3d1J1RelJhTDEw8QAM4ijLQBKBsbvFd03xheNVADILTjRLtNmabEjOgmRYAZiLNhSuFG0IiOhpk7RdwGJBX0U9Y/aKR6Zlrf/Lxj3ipVXUm+9Sxyd9m99OQPJ9JEe9a5JJxfWHdDGGRhUD+co90rJOLSv7NHPagrKTCYVKEguCA=~-1~-1~-1~-1~-1; Domain=.irs.gov; Path=/; Expires=Fri, 08 Oct 2027 10:29:16 GMT; Max-Age=31536000; Secure |
| set-cookie | ak_bmsc=F49CEC6E5F0BE82C25B2B9A92875B7EE~000000000000000000000000000000~YAAQTYIsF3RiXfGgAQAAWGUPGwFPlZ9Jvr/5UXRiK55OgspzbLQ0PMp28cuxRoZrNH5mr6tSsQw74FjfEgRjgSY4L99+k17lfOLyxkZ2dzIUEjc7IBMGrSwrJCytc6iP817YoMwHNvWj1Mmxcn7mXjDJjBjUmP28vwL7BuqHkv47EEYAjK+6NqH8UfsySdrhF/QXm+0yEAd0pp4nYhu0m9Yh7AHKDIbY6rFBVc2nnKSRMFmvCKwnIX2Kn8LRe/l0EdDapCB3iMPeL4RPmY7uoZCR6wPZkRV992iedRfTrRxR9/bujPqCEkrjfBeFZuFWJnolT2zjgloD67vA7hgrT5BNLWcc5I33Zhi/myLjN2SlSHM10YMOnsGVpSyBdAnyApR0A82YVd+7PQ==; Domain=.irs.gov; Path=/; Expires=Thu, 08 Oct 2026 12:29:16 GMT; Max-Age=7200; HttpOnly |
| set-cookie | bm_sz=BF0064D5DCEED6C9342213B501449F6F~YAAQTYIsF3ViXfGgAQAAWWUPGwEGWCJxYlPHp7W3FL0Cr96rTN3k/WotjbMxeyj3FpXPkXteJu4OCcYZvo31CFqdD69ogkyO+axPzWaZicXgouDuE51TvMvxTcf4NEb2+O8frb9Asia93rr7tRdXHa1EAYc++kmrJXMACp11f0VSaq3lPxZ9gc3nyLi5jVBOBP8hwyigpceDmLuIJ7jLezeHxZkz5Ug1DYYbI3/UnE3LHUDL1ohFXJswEwWhfTZ9trL4TCHRS1NxaztX2QWVtz46tu+Gowl7RuQIlCO0egXrHxg2Ujp8rSWuM5LTab/Szq+dHVcjaIFM2xvBGGmuKwyW3pn9YdAF/5cJPf9rwDRmK5KXnK2nhZYsDeKcWHA5dZQe3qiL9fasSHsK~4339763~3490105; Domain=.irs.gov; Path=/; Expires=Thu, 08 Oct 2026 14:29:16 GMT; Max-Age=14400 |
Upcoming Headers
| Cross-Origin-Embedder-Policy | Cross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP. |
|---|---|
| Cross-Origin-Opener-Policy | Cross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser. |
| Cross-Origin-Resource-Policy | Cross-Origin Resource Policy allows a resource owner to specify who can load the resource. |
Additional Information
| strict-transport-security | HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. |
|---|