Security Report Summary
R
| Redirect: | Click here to follow the redirect to https://www.booking.com/index.en-gb.html?label=gen173rf-1BCAEoggI46AdIM1gDaIkCiAEBmAEJuAEYyAEM2AEB6AEBiAIBogITc2VjdXJpdHloZWFkZXJzLmNvbagCBLgCt7icsgbAAgHSAiRjMDU0YWU0Yy02NDlmLTRiMGQtYTdjYy0wNGNhYTY1NGI0YWHYAgXgAgE&sid=f30089294e1f7c19df7d21d7f36b5a94&keep_landing=1&sb_price_type=total&. | ||
|---|---|---|---|
| Site: | https://www.booking.com/ | ||
| IP Address: | 18.239.199.14 | ||
| Report Time: | 17 May 2024 08:58:31 UTC | ||
| Headers: |
|
||
| Advanced: |
|
Missing Headers
| Content-Security-Policy | Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. |
|---|---|
| X-Frame-Options | X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking. Recommended value "X-Frame-Options: SAMEORIGIN". |
| X-Content-Type-Options | X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff". |
| Referrer-Policy | Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. |
| Permissions-Policy | Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser. |
Warnings
| Response is not HTML | The content-type of the response does not indicate HTML. Not all headers, and therefore the score, may be appropriate. |
|---|
Raw Headers
| HTTP/2 | 302 |
|---|---|
| server | nginx |
| date | Fri, 17 May 2024 08:58:31 GMT |
| location | /index.en-gb.html?label=gen173rf-1BCAEoggI46AdIM1gDaIkCiAEBmAEJuAEYyAEM2AEB6AEBiAIBogITc2VjdXJpdHloZWFkZXJzLmNvbagCBLgCt7icsgbAAgHSAiRjMDU0YWU0Yy02NDlmLTRiMGQtYTdjYy0wNGNhYTY1NGI0YWHYAgXgAgE&sid=f30089294e1f7c19df7d21d7f36b5a94&keep_landing=1&sb_price_type=total& |
| nel | {"report_to":"default","max_age":604800} |
| report-to | {"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default","max_age":604800} |
| set-cookie | _implmdnbl=2__1__0; path=/; expires=Sun, 19-May-2019 08:58:31 GMT; HttpOnly |
| set-cookie | px_init=0; domain=booking.com; expires=Wed, 30-Nov-2078 17:57:02 GMT; SameSite=Strict; secure; HttpOnly |
| set-cookie | bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5sWGdX2B1HIl0M9A6NnEO1uzdJz6RH%2FZpUsh%2Bf9OYV7Js3U%2FpC8UVb%2F3mq0ZvQrsiWY4Kz%2B2zwwM4x6%2FDgydrNIrqRUZAey3sJ8cmT1w9L2uNNid%2FEwWrw1Rt%2Bi1Xyr3kmkzMt1QzI6OczTT1pr8iIuL6HDDpom9aY%3D; domain=.booking.com; path=/; expires=Wed, 16-May-2029 08:58:31 GMT; Secure; HTTPOnly; SameSite=None |
| strict-transport-security | max-age=2592000; includeSubDomains |
| x-recruiting | Like HTTP headers? Come write ours: https://careers.booking.com |
| x-terms-of-service | https://www.booking.com/content/terms.html |
| x-xss-protection | 1; mode=block |
| set-cookie | bkng_sso_auth=CAIQsOnuTRpm1OfQIFPoaiNTI6I/Hac9rW052/8bOLA6QhlEDhXpaVLMXDBOA1R2kXFRKAlNVZE6Kz/3Rb+SqtMCecRezwlZSWv3Ro0IN1z7ctdxb+DnknaqqVfeuyv1jQ1HGGu2Ev2WUQL64jNS; Domain=.booking.com; Path=/; Expires=Sun, 17 May 2026 08:58:31 GMT; HttpOnly; Secure; SameSite=Lax |
| set-cookie | pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3Dff46e319-70eb-48e7-bba5-35996d23c35e%26consentedAt%3D2024-05-17T08%3A58%3A31.421Z%26expiresAt%3D2025-05-12T08%3A58%3A31.421Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DCA%26regulation%3Dccpa%26legacyRegulation%3Dnone; Domain=.booking.com; Path=/; Expires=Sat, 17 May 2025 08:58:31 GMT; HttpOnly; Secure; SameSite=Lax |
| x-cache | Miss from cloudfront |
| via | 1.1 429c95a57b05855a277dbdde218efe4e.cloudfront.net (CloudFront) |
| x-amz-cf-pop | SFO53-P3 |
| x-amz-cf-id | O6gXeOviFSw4q_xXYpnC6xol3UoQ-eBqFU0NyaiqCm01ho2Om1_pPg== |
Upcoming Headers
| Cross-Origin-Embedder-Policy | Cross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP. |
|---|---|
| Cross-Origin-Opener-Policy | Cross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser. |
| Cross-Origin-Resource-Policy | Cross-Origin Resource Policy allows a resource owner to specify who can load the resource. |
Additional Information
| server | This Server header seems to advertise the software being run on the server but you can remove or change this value. |
|---|---|
| nel | Network Error Logging is a new header that instructs the browser to send reports during various network or application errors. You can sign up for a free account on Report URI to collect these reports. |
| report-to | Report-To enables the Reporting API. This allows a website to collect reports from the browser about various errors that may occur. You can sign up for a free account on Report URI to collect these reports. |
| strict-transport-security | HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. |
| x-xss-protection | X-XSS-Protection sets the configuration for the XSS Auditor built into older browsers. The recommended value was "X-XSS-Protection: 1; mode=block" but you should now look at Content Security Policy instead. |
| set-cookie | There is no Cookie Prefix on this cookie. |