Security Report Summary
D
| Site: | https://mobile.santander.com.br/ | ||
|---|---|---|---|
| IP Address: | 2.19.176.146 | ||
| Report Time: | 29 Apr 2025 19:09:37 UTC | ||
| Headers: |
|
||
| Advanced: |
|
Missing Headers
| Content-Security-Policy | Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. |
|---|---|
| X-Frame-Options | X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN". |
| X-Content-Type-Options | X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff". |
| Referrer-Policy | Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. |
| Permissions-Policy | Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser. |
Warnings
| Response is not HTML | The content-type of the response does not indicate HTML. Not all headers, and therefore the score, may be appropriate. |
|---|---|
| Status code indicates error | The status code of the response indicates an error. Not all headers may be set when the response is an error. |
Raw Headers
| HTTP/2 | 404 |
|---|---|
| content-type | text/plain; charset=utf-8 |
| content-length | 21 |
| strict-transport-security | max-age=31536000; includeSubDomains |
| expires | Tue, 29 Apr 2025 19:09:37 GMT |
| cache-control | max-age=0, no-cache, no-store |
| pragma | no-cache |
| date | Tue, 29 Apr 2025 19:09:37 GMT |
| server-timing | cdn-cache; desc=MISS |
| server-timing | edge; dur=191 |
| server-timing | origin; dur=13 |
| alt-svc | h3=":443"; ma=93600 |
| set-cookie | akaalb_mobile_santander=~op=mobile_santander:DC_AWS_C|~rv=91~m=DC_AWS_C:0|~os=fd5947ee9a407982a7a47e86d479733d~id=4b4591b879b0827f5ffeb48b6153240c; path=/; HttpOnly; Secure; SameSite=None |
| set-cookie | _abck=820A230BBE6ADCF69627CEA0A526E024~-1~YAAQjrATAgpjw3uWAQAAsWX0gg09PE/Hj6Ghq0YZScQNWBHJ2bnlNj5bEbVCcv8oxyynzIq5JhKxQgDwoSvK12hoWQm9OIRvfDierrPLRCVi2RU0WibL+8pWN+ioNBzHnjLvDFIEAcsyPDApNpIiQmCHKjt30zuKtaBf2aSgz3C797qizX0QdS7P0S35Fe9MzhkJyhluaVCakSiAGlNqHx9+zcJ6Mad85/So2YAnLpWIlw9y4r6ijCMTl+U+newx0QIIDeXyzRX7BPEQH4oxJdUHyNoaoKcXft2Gls745nb21cPDkKpdbMxcTolhGTWsGu3cwJ8j4kZPTu0OwDRdlRgQKI3106HuNy7FV0OywyA2dMAah27xb0Em7qFPHmyOw85gm+szTDZkwYXQ7/AugclqoXJ8Vno4F7he0hK146m2HiE=~-1~-1~-1; Domain=.santander.com.br; Path=/; Expires=Wed, 29 Apr 2026 19:09:37 GMT; Max-Age=31536000; SameSite=None; Secure |
| set-cookie | ak_bmsc=5228EF53220B3D526DCE7261B5BF2F8B~000000000000000000000000000000~YAAQjrATAgtjw3uWAQAAsWX0ghuAE3zFPbbLUGjjdzuAmSFeNB+eVnyarswjhud256jpTG/FTyMUtQiVr4S5h9T/sHyHV1PkS2HDFiluHrEzq8S+py3tNliGpeZJ0vbThi8nMoaY94pY4RUOXRxWoODaCHTmoqAVwAcAOpI+yOEVF0Ft895Y3KEE7fmo+EdcSceyieez2kyAfC7PLSM/k3fHbMPKJEwLGbpq/5mRZTX+xhX9zz2N1eDXlDErM9mbxi/GzaXHsgA3p8Rrm/+tDs7QGtCcTg0stEEp456woyUWfZf0kj8rAWtdJv91RpIi5w86eVc6KgGbEEAl7aG8js6Y0esfkWQJjK35tCoI5OtA1WQVpMtu4t2jZSXZIZa6+VwLc+4ALioKZwo8oBME+DY=; Domain=.santander.com.br; Path=/; Expires=Tue, 29 Apr 2025 21:09:36 GMT; Max-Age=7199; SameSite=None; Secure |
| set-cookie | bm_sz=6117B9B335881A0A5068B8886C762D7E~YAAQjrATAgxjw3uWAQAAsWX0ghtkf/FBrmQEKvrO811fSenvgdN/zo43snyek6TM0Ddyiv/q09csER8N8JYnFveEpF/Ojbh1A751iJOe3yQEHYZkFMqjQJ6yobLMj/H/QzDelKHYxytQuPqJ4oIg+20u+IMB5GplyiXkWUle6dItIi27WyUkXzytsi90JDf+YiAZ7FOlZ4NEI1E6aVyk2rm7Qao33fnphN2Q+aEwpxIcHOBYlUnpLWulMUReVXnlOp7QD384SA2Y0H4mwujyMwq83y1SSw8LIr9lDVOnS82bspXBqQ52euTiMjSRHCPXH4GGxRdTTRdX0MaOIlr6DzQV/dupCuGLxWUSlVezEg6RUQqnRIDsFcU92IqFZoqwh51LKb4+64Y0gMmQdRqn4/6XCLiy~3158081~3687733; Domain=.santander.com.br; Path=/; Expires=Tue, 29 Apr 2025 23:09:36 GMT; Max-Age=14399; SameSite=None; Secure |
| server-timing | ak_p; desc="1745953776850_34844814_384051910_20398_12349_1_4_15";dur=1 |
Upcoming Headers
| Cross-Origin-Embedder-Policy | Cross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP. |
|---|---|
| Cross-Origin-Opener-Policy | Cross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser. |
| Cross-Origin-Resource-Policy | Cross-Origin Resource Policy allows a resource owner to specify who can load the resource. |
Additional Information
| strict-transport-security | HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. |
|---|