Security Report Summary
A
Site: https://az-dev-amex-port.axa-assistance.us/
IP Address: 191.234.129.50
Report Time: 30 Oct 2026 16:27:37 UTC
Headers:
  • Content-Security-Policy
  • Referrer-Policy
  • X-Content-Type-Options
  • X-Frame-Options
  • Strict-Transport-Security
  • Permissions-Policy
Warning: Grade capped at A, please see warnings below.
Advanced:
Great grade! Perform a deeper security analysis of your website and APIs:
Missing Headers
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
Content-Security-PolicyThis policy contains 'unsafe-inline' which is dangerous in the default-src directive. This policy contains 'unsafe-inline' which is dangerous in the script-src directive. This policy contains 'unsafe-eval' which is dangerous in the script-src directive. This policy contains 'unsafe-hashes' which is dangerous in the script-src directive.
Raw Headers
HTTP/2200
dateFri, 30 Oct 2026 16:27:37 GMT
content-typetext/html; charset=UTF-8
content-length845
accept-rangesbytes
cache-controlpublic, max-age=0
content-encodinggzip
etagW/"64c-1a18818d050"
last-modifiedThu, 29 Oct 2026 14:38:10 GMT
set-cookiesession=s%3AAt_NhaFfyoeNiJNXznLaROxUV_nbS5yE.PFX2s4%2BZRcVsTuQGEr91Ed74nR2D6F1mb1lzQNorZgk; Path=/; HttpOnly; Secure
varyAccept-Encoding
request-contextappId=cid-v1:
content-security-policydefault-src 'self' 'unsafe-inline' fonts.googleapis.com fonts.gstatic.com https://axaus-travel.my.salesforce.com/lightning/lightning.out.delegate.js https://axaus-travel.my.salesforce.com/lightning/lightning.out.js https://axaus-travel--uatt.sandbox.my.salesforce-sites.com/ https://d.la3-c1-ia6.salesforceliveagent.com https://d.la3-core1.sfdc-yfeipo.salesforceliveagent.com https://c.la3-core1.sfdc-yfeipo.salesforceliveagent.com https://c.la13-core1.sfdc-yfeipo.salesforceliveagent.com https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com https://c.la12s-core1.sfdc-yfeipo.salesforceliveagent.com https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://service.force.com/ https://service.force.com/embeddedservice/5.0/esw.min.css https://axaus-travel--uat.sandbox.my.salesforce-sites.com//embeddedService/sidebarApp.app https://static.zdassets.com/ekr/vendors~rollbar.noconflict.umd.min.js https://www.googletagmanager.com/debug/badge.css https://www.google-analytics.com/debug/badge.css https://www.googletagmanager.com/ns.html https://cardmember-benefits.axa-assistance.us http://cardmember-benefits.axa-assistance.us https://www.googletagmanager.com/gtag/js https://www.google.com.br/ads/ga-audiences https://enterprise-hlg.tokbox.com/prod/logging/ClientEvent https://api-enterprise.opentok.com/session https://api-enterprise.opentok.com/session/* https://api-enterprise.opentok.com https://enterprise-hlg.tokbox.com https://axaus-travel--uat.sandbox.my.salesforce.com/embeddedservice/5.0/esw.min.css https://axaus-travel--uat.sandbox.my.salesforce.com/ https://axaus-travel.my.salesforce.com https://axaus-travel.my.salesforce-sites.com/amexchat https://zaasamexcmdpubppanc1sto.blob.core.windows.net/public/policy/privacy-policy.pdf https://zaasamexcmdpubppanc1sto.blob.core.windows.net/public/policy/politica-de-privacidad.pdf https://zaasamexcmdpubppanc1sto.blob.core.windows.net/public/policy/politica-de-privacidade.pdf https://zaasamexcmdpubppabs1sto.blob.core.windows.net/public/policy/privacy-policy.pdf https://zaasamexcmdpubppabs1sto.blob.core.windows.net/public/policy/politica-de-privacidad.pdf https://zaasamexcmdpubppabs1sto.blob.core.windows.net/public/policy/politica-de-privacidade.pdf https://zaasamexcmdpubreabs1sto.blob.core.windows.net/public/policy/privacy-policy.pdf https://zaasamexcmdpubreabs1sto.blob.core.windows.net/public/policy/politica-de-privacidad.pdf https://zaasamexcmdpubreabs1sto.blob.core.windows.net/public/policy/politica-de-privacidade.pdf https://secure.quantserve.com/quant.js *.quantcount.com *.quantserve.com https://axaus-travel--uatt.sandbox.my.site.com/ESWAmexPortal1753388317377/assets/styles/bootstrap.min.css https://axaus-travel--uatt.sandbox.my.site.com/ESWExternalAmexUAT1753721027019/assets/styles/bootstrap.min.css https://axaus-travel.my.site.com/ESWAMEXProd1757361238111/assets/styles/bootstrap.min.css;img-src 'self' data: https://www.google.com.br/pagead/ https://googleads.g.doubleclick.net https://cdn.cookielaw.org/logos/ https://cdn.cookielaw.org/logos/static/ot_logo.png https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg https://cdn.cookielaw.org/logos/static/ot_company_logo.png https://cdn.cookielaw.org/logos/static/powered_by_logo.svg https://cdn.cookielaw.org/logos/static/ot_close.svg https://v2assets.zopim.io https://www.google-analytics.com/collect https://cardmember-benefits.axa-assistance.us http://cardmember-benefits.axa-assistance.us https://www.google.com https://zaasamexcmdpubppanc1sto.blob.core.windows.net/public/ https://zaasamexcmdpubppanc1sto.blob.core.windows.net/qrcodes/ https://zaasamexcmdpubppabs1sto.blob.core.windows.net/public/ https://zaasamexcmdpubppabs1sto.blob.core.windows.net/qrcodes/ https://zaasamexcmdpubdvabs1sto.blob.core.windows.net/public/ https://zaasamexcmddvabs1sto.blob.core.windows.net/qrcodes/ https://zaasamexcmdpubreabs1sto.blob.core.windows.net/public/ https://zaasamexcmdreabs1sto.blob.core.windows.net/qrcodes/ https://zaasamexcmdpubprabs1sto.blob.core.windows.net/public/ https://zaasamexcmdprabs1sto.blob.core.windows.net/qrcodes/ https://cdn.cookielaw.org/consent/ https://pre.api.amos-am.com https://api.amos-am.com https://www.google.com.br/ads/ga-audiences https://enterprise-hlg.tokbox.com/prod/logging/ClientEvent https://api-enterprise.opentok.com/session https://api-enterprise.opentok.com/session/* https://api-enterprise.opentok.com https://enterprise-hlg.tokbox.com https://www.google.com.br/ads/ga-audiences https://www.googletagmanager.com/a *.quantcount.com *.quantserve.com;script-src 'self' 'unsafe-inline' 'unsafe-hashes' 'unsafe-eval' e909cd4b-85ff-4d65-b574-3f09dfec621a https://axaus-travel--uatt.sandbox.my.salesforce-sites.com/ https://axaus-travel.my.salesforce-sites.com/ https://d.la3-c1-ia6.salesforceliveagent.com https://axaus-travel.my.salesforce.com https://d.la2s-core1.sfdc-yfeipo.salesforceliveagent.com/ https://axaus-travel--uatt.sandbox.my.salesforce.com/ https://googleads.g.doubleclick.net https://www.googleadservices.com https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com https://d.la3-core1.sfdc-yfeipo.salesforceliveagent.com https://cdn.cookielaw.org/scripttemplates/202505.1.0/otBannerSdk.js https://axaus-travel.my.salesforce-sites.com/ https://d.la3-c1-ia6.salesforceliveagent.com/chat/ https://axaus-travel.my.salesforce.com/lightning/lightning.out.delegate.js https://axaus-travel.my.salesforce.com/lightning/lightning.out.js https://d.la3-c1-ia6.salesforceliveagent.com https://d.la3-core1.sfdc-yfeipo.salesforceliveagent.com/chat https://d.la3-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Availability.jsonp https://d.la3-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://d.la3-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://d.la3-c1-ia6.salesforceliveagent.com/chat/rest/Visitor/Availability.jsonp https://d.la3-c1-ia6.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://d.la3-c1-ia6.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://c.la13-core1.sfdc-yfeipo.salesforceliveagent.com/content https://c.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/content https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com/chat https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Availability.jsonp https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://d.la13-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/chat https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Availability.jsonp https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://d.la12s-core1.sfdc-yfeipo.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://static.opentok.com/v2/js/opentok.min.js https://axaus-travel--uat.sandbox.my.salesforce-sites.com https://b.static.lightning.force.com https://static.lightning.force.com/ https://d.la3-c1cs-ia6.salesforceliveagent.com/chat/rest/Visitor/Settings.jsonp https://service.force.com https://axaus-travel--uat.sandbox.my.salesforce.com https://d.la3-c1cs-ia6.salesforceliveagent.com/chat/rest/EmbeddedService/EmbeddedServiceConfig.jsonp https://web-sdk.smartlook.com/recorder.js https://web-sdk.smartlook.com https://cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.4/beautify-html.min.js https://cdnjs.cloudflare.com/ajax/libs/ace/1.4.2/theme-idle_fingers.js https://cdnjs.cloudflare.com/ajax/libs/ace/1.4.2/mode-html.js https://static.zdassets.com/ekr/snippet.js https://www.google-analytics.com/analytics.js https://static.zdassets.com https://widget-mediator.zopim.com https://www.google-analytics.com https://cdn.cookielaw.org/scripttemplates/otSDKStub.js https://cdn.cookielaw.org/consent/ https://www.googletagmanager.com/gtm.js https://www.googletagmanager.com/gtag/js https://www.googletagmanager.com/debug/bootstrap https://www.googletagmanager.com/debug/badge https://cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.4/beautify.min.js https://cdnjs.cloudflare.com/ajax/libs/ace/1.4.2/ace.js https://enterprise-hlg.tokbox.com/prod/logging/ClientEvent https://api-enterprise.opentok.com/session https://api-enterprise.opentok.com/session/* https://api-enterprise.opentok.com https://enterprise-hlg.tokbox.com https://d.la3-c1cs-ia6.salesforceliveagent.com/chat/rest/Visitor/Availability.jsonp https://secure.quantserve.com/quant.js *.quantcount.com *.quantserve.com https://axaus-travel--uatt.sandbox.my.site.com/ESWAmexPortal1753388317377 https://axaus-travel--uatt.sandbox.my.site.com/ESWAmexPortal1753388317377/assets/js/bootstrap.min.js https://axaus-travel--uatt.sandbox.my.site.com/ESWAmexPortal1753388317377/assets/js/inert.min.js https://axaus-travel--uatt.sandbox.my.site.com/ESWExternalAmexUAT1753721027019 https://axaus-travel--uatt.sandbox.my.site.com/ESWExternalAmexUAT1753721027019/assets/js/bootstrap.min.js https://axaus-travel--uatt.sandbox.my.site.com/ESWExternalAmexUAT1753721027019/assets/js/inert.min.js https://axaus-travel.my.site.com/ESWAMEXProd1757361238111 https://axaus-travel.my.site.com/ESWAMEXProd1757361238111/assets/js/bootstrap.min.js https://axaus-travel.my.site.com/ESWAMEXProd1757361238111/assets/js/inert.min.js https://www.google.com/recaptcha/api.js https://www.gstatic.com/recaptcha/releases/;connect-src 'self' https://axaus-travel.my.salesforce-sites.com/amexchat/embeddedService/sidebarApp.app https://axaus-travel.my.salesforce-sites.com/ https://axaus-travel--uatt.sandbox.my.salesforce-sites.com/ https://axaus-travel.my.salesforce-sites.com/amexchat/aura https://axaus-travel.my.salesforce-sites.com/ https://axaus-travel--uat.sandbox.my.salesforce-sites.com//embeddedService/sidebarApp.app https://axaus-travel--uat.sandbox.my.salesforce-sites.com/aura https://axaus-travel--uat.sandbox.my.salesforce-sites.com https://stats.g.doubleclick.net https://web-writer.br.smartlook.cloud/rec/v3/write https://assets-proxy.smartlook.cloud/cache https://analytics.google.com https://web-writer.br.smartlook.cloud/rec/v3/write https://assets-proxy.smartlook.cloud/cache https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location https://privacyportal-eu.onetrust.com/request/v1/consentreceipts https://axaassistance.zendesk.com https://manager.eu.smartlook.cloud https://dc.services.visualstudio.com/v2/track http://localhost:8080/public-page/categories https://az-dev-amex-api.axa-assistance.us/public-page/categories https://az-pp-amex-api.axa-assistance.us/public-page/categories https://az-uat-amex-api-v2.axa-assistance.us/public-page/categories https://az-uat-amex-api.axa-assistance.us/public-page/categories https://amex-api.axa-assistance.us/public-page/categories http://localhost:8080/public-page/categories/benefits https://az-dev-amex-api.axa-assistance.us/public-page/categories/benefits https://az-pp-amex-api.axa-assistance.us/public-page/categories/benefits https://az-uat-amex-api-v2.axa-assistance.us/public-page/categories/benefits https://az-uat-amex-api.axa-assistance.us/public-page/categories/benefits https://amex-api.axa-assistance.us/public-page/categories/benefits http://localhost:8080/public-page/categories/benefit https://az-dev-amex-api.axa-assistance.us/public-page/categories/benefit https://az-pp-amex-api.axa-assistance.us/public-page/categories/benefit https://az-uat-amex-api-v2.axa-assistance.us/public-page/categories/benefit https://az-uat-amex-api.axa-assistance.us/public-page/categories/benefit https://amex-api.axa-assistance.us/public-page/categories/benefit https://az-uat-amex-api-v2.axa-assistance.us/content/public-image-managements https://az-uat-amex-api-v2.axa-assistance.us/public-resources/contacts-us https://az-uat-amex-api-v2.axa-assistance.us/public-resources/faq https://az-uat-amex-api-v2.axa-assistance.us/public-resources/popup-management https://az-uat-amex-api-v2.axa-assistance.us/public-resources/landing-page https://az-uat-amex-api-v2.axa-assistance.us/content/banners https://az-uat-amex-api.axa-assistance.us/content/public-image-managements https://az-uat-amex-api.axa-assistance.us/public-resources/contacts-us https://az-uat-amex-api.axa-assistance.us/public-resources/faq https://az-uat-amex-api.axa-assistance.us/public-resources/popup-management https://az-uat-amex-api.axa-assistance.us/public-resources/landing-page https://az-uat-amex-api.axa-assistance.us/content/banners https://amex-api.axa-assistance.us/content/public-image-managements https://amex-api.axa-assistance.us/public-resources/contacts-us https://amex-api.axa-assistance.us/public-resources/faq https://amex-api.axa-assistance.us/public-resources/popup-management https://amex-api.axa-assistance.us/public-resources/landing-page https://amex-api.axa-assistance.us/content/banners https://stats.g.doubleclick.net/j/collect https://az-pp-amex-api.axa-assistance.us/content/public-image-managements https://az-pp-amex-api.axa-assistance.us/public-resources/contacts-us https://az-pp-amex-api.axa-assistance.us/public-resources/faq https://az-pp-amex-api.axa-assistance.us/public-resources/popup-management https://az-pp-amex-api.axa-assistance.us/public-resources/landing-page https://az-pp-amex-api.axa-assistance.us/content/banners https://az-dev-amex-api.axa-assistance.us/content/public-image-managements https://az-dev-amex-api.axa-assistance.us/public-resources/contacts-us https://az-dev-amex-api.axa-assistance.us/public-resources/faq https://az-dev-amex-api.axa-assistance.us/public-resources/popup-management https://az-dev-amex-api.axa-assistance.us/public-resources/landing-page https://az-dev-amex-api.axa-assistance.us/content/banners http://localhost:8080/public-resources/popup-management http://localhost:8080/public-resources/landing-page http://localhost:8080/public-resources/contacts-us http://localhost:8080/public-resources/faq http://localhost:8080/content/banners https://ekr.zdassets.com/compose/e909cd4b-85ff-4d65-b574-3f09dfec621a wss://widget-mediator.zopim.com https://www.google-analytics.com/j/collect https://z-aas-amex-api-dva-bs1-wap.z-aas-tran-shrd-npd-bs1-ase01.appserviceenvironment.net https://z-aas-amex-api-rea-bs1-wap.z-aas-tran-shrd-npd-bs1-ase01.appserviceenvironment.net https://z-aas-amex-api-pra-bs1-wap.z-aas-tran-shrd-prd-bs1-ase01.appserviceenvironment.net https://z-aas-amex-api-pra-ucs-wap.z-aas-tran-shrd-prd-ucs-ase01.appserviceenvironment.net https://api-standard.opentok.com https://hlg.tokbox.com https://hlg.tokbox.com https://anvil.opentok.com https://config.opentok.com wss://*.tokbox.com ws://localhost:3000/sockjs-node https://static.opentok.com https://cdn.cookielaw.org/consent/ https://cdn.cookielaw.org/scripttemplates/ https://www.googletagmanager.com/gtm.js https://www.google-analytics.com/g/collect https://enterprise-hlg.tokbox.com/prod/logging/ClientEvent https://api-enterprise.opentok.com/session https://api-enterprise.opentok.com/session/* https://api-enterprise.opentok.com https://enterprise-hlg.tokbox.com https://axaus-travel--uatt.sandbox.my.salesforce-scrt.com/embeddedservice/v1/embedded-service-config https://axaus-travel--uatt.sandbox.my.salesforce-scrt.com/embeddedservice/v1/businesshours https://axaus-travel--uatt.sandbox.my.salesforce-scrt.com https://axaus-travel.my.salesforce-scrt.com/embeddedservice/v1/embedded-service-config https://axaus-travel.my.salesforce-scrt.com/embeddedservice/v1/businesshours https://axaus-travel.my.salesforce-scrt.com http://localhost:8080/healthcheck https://az-dev-amex-api.axa-assistance.us/healthcheck https://az-pp-amex-api.axa-assistance.us/healthcheck https://az-uat-amex-api-v2.axa-assistance.us/healthcheck https://az-uat-amex-api.axa-assistance.us/healthcheck https://amex-api.axa-assistance.us/healthcheck https://www.google.com/recaptcha/api.js https://www.google.com/ccm/form-data/ https://www.google.com/rmkt/collect/ https://www.google.com/recaptcha/api2/clr https://www.google.com/ https://www.googletagmanager.com/gtag/js;media-src 'self' https://static.zdassets.com https://static.zdassets.com/web_widget/static/chat-incoming-message-notification.mp3 https://static.zdassets.com/web_widget/latest/classic/*;frame-src https://td.doubleclick.net https://service.force.com https://axaus-travel.my.site.com https://axaus-travel--uatt.sandbox.my.site.com https://www.google.com/;frame-ancestors 'self' https://axaus-travel.my.site.com https://axaus-travel--uatt.sandbox.my.site.com;base-uri 'self';font-src 'self' https: data:;form-action 'self';object-src 'none';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cross-origin-opener-policysame-origin
origin-agent-cluster?1
referrer-policyno-referrer
x-content-type-optionsnosniff
x-dns-prefetch-controloff
x-download-optionsnoopen
x-permitted-cross-domain-policiesnone
x-xss-protection0
x-frame-optionsdeny
strict-transport-securitymax-age=31536000; includeSubDomains;preload
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
set-cookieThere is no Cookie Prefix on this cookie. This is not a SameSite Cookie.
content-security-policyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.
cross-origin-opener-policyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
referrer-policyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-xss-protectionX-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead.
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.