Security Report Summary
C
Site: https://www.walgreens.com/
IP Address: 95.100.98.115
Report Time: 21 Oct 2026 19:23:57 UTC
Headers:
  • X-Frame-Options
  • X-Content-Type-Options
  • Strict-Transport-Security
  • Content-Security-Policy
  • Referrer-Policy
  • Permissions-Policy
Advanced:
Not bad… Maybe you should perform a deeper security analysis of your website and APIs:
Missing Headers
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Raw Headers
HTTP/2200
content-typetext/html;charset=utf-8
x-dispatcherdispatcher9eastus2-b86
x-vhostcontenthub
x-frame-optionsSAMEORIGIN
x-akamai-transformed9 - 0 pmb=mRUM,2
varyAccept-Encoding
content-encodinggzip
expiresWed, 21 Oct 2026 23:23:57 GMT
dateWed, 21 Oct 2026 19:23:57 GMT
set-cookieFST2=t; expires=Sat, 05-Dec-2026 19:23:57 GMT; path=/
set-cookieAKA_A2=A; expires=Wed, 21-Oct-2026 20:23:57 GMT; path=/; domain=walgreens.com; secure; HttpOnly
server-timingcdn-cache; desc=HIT
server-timingedge; dur=26
alt-svch3=":443"; ma=93600
link<https://rum.hlx.page>;rel="preconnect",<https://dok.js-cdn.dynatrace.com>;rel="preconnect",<https://securepubads.g.doubleclick.net>;rel="preconnect",<https://assets.adobedtm.com>;rel="preconnect",<https://cdn.cookielaw.org>;rel="preconnect",<https://cdn.branch.io>;rel="preconnect",<https://walgreens.demdex.net>;rel="preconnect",<https://resources.digital-cloud-west.medallia.com>;rel="preconnect"
set-cookieakavpau_walgreens=1792610937~id=fdae94704ef0fb3c26ff681fb31c1438; Path=/; HttpOnly; Secure; SameSite=None
x-akamai-nativeNO
x-akamai-cachekeymoddesktop;NONATIVE;o9
x-content-type-optionsnosniff
x-akamai-deviceosWindows NT
akamai-x-url/
x-akamai-devicetypedesktop
strict-transport-securitymax-age=31536000 ; includeSubDomains
cache-controlmax-age=1800
timing-allow-origin*
akamai-grn0.6f62645f.1792610636.959a3271
set-cookie_abck=720905C98D650F261E70919811C30496~-1~YAAQb2JkX3VdBzOhAQAA6pTrXxDCDwn8qjZTj84Q97CFrUMpAagBvvkips+ofIybT04D+fGyTy0Da9KK/C37gMHs+W2XdJok8PF80MhXf14xaFjQQOjbFR/aQEtV5F6kKZLktMUgS6ao9cpFD8hKxNZhUBl6W4Anjz9ANVnk1g9fCY/dldZPY4j9WjST246h0ttWvoNx60lhD/INSMFwnlZelF2tMtozixEoqQq4eNbtKslzVPmwoG4G/BGDKV7cMf5EybH/tl3oGVNcsTA1yuSfnR+cbVIj/28rbDt1tosMcVP4Wj4pq8qxTmSm6LE2Rl8NfUPpeN+ThRUSB+FozxRh90oE1YBON+ft9xKPtEtBrmbGBHyi42gOUduwUde4pptnVpsxhhrouX4H0I9kqtcbUH78OHwtgD4J4K2u9Aqit3nonzQjnZHYLF8fLiKAPzKtzTRYVaGGeJ0=~-1~-1~-1~-1~-1; Domain=.walgreens.com; Path=/; Expires=Thu, 21 Oct 2027 19:23:57 GMT; Max-Age=31536000; Secure
set-cookieak_bmsc=E185A58B46B854E1719C05DFB34B91D6~000000000000000000000000000000~YAAQb2JkX3ZdBzOhAQAA6pTrXwFQSikb6d7N06b0hBHyrAV5nB4MIZ5S2rYPy22vTi7VwhLGviOizIWk2AZhN7iqaLGjhcZQVSB3KRNGnRD8uygGW8GQt405QBre2U+Tk+jdUUXt7LXVT7s7Jikh3GEIslF/17XSfdg8WOdRkMYotRQUSxeaF8Ul9bX++RaaWmBHe9kGWn/T8PseHacAOEV60PbYbedjGay9g2MAmt6lCPWkiMMBRzH+kd3rH+mvF29R4STkw+R/QG9s+eFVwEc4vQx/XTssymtRKyNsdrgdpMZQS1H6Jug/j1jwl4p1Ek4uQxnpsRodDbNDE9smItU+HnSBIsqwbRDxGDXZQkneVEd/+cEfGkwST1rnKC5majtYz1Q8AYKBeMH4AxEzLg==; Domain=.walgreens.com; Path=/; Expires=Wed, 21 Oct 2026 21:23:56 GMT; Max-Age=7199; HttpOnly
set-cookiebm_mi=93F21D34601836935C0B8A5B29D40453~YAAQb2JkX3ddBzOhAQAA6pTrXwEjgPcvf/UIzCcELFi2KeuB1ctw7PVqQsGVoNiehfVeb66IvPxUtlt4Ifwgl2rqPlX51yqxH1xwofj6ua+eQRyEoHGCRgCOAYM4Y4JIcINogOCLlSt/VDiCn3eLxyped/UpQEVaQR8HwhsMK201Y7tZQioyMnR31qsGCrZqsW3wzPH1Y2vYT+4juDGTXtdluxI7QLRFB3rwo8arDo+EwJRHThiyuIK2kS/dHV+dh3k+XAJw+Vawl9+FgGQz3ZS0sWvTNN1JitBKyIM06zQkY9A+13wf4QM1vLapZv+RwA==~1; Domain=.walgreens.com; Path=/; Expires=Wed, 21 Oct 2026 19:23:57 GMT; Max-Age=0; Secure
set-cookiebm_sz=386D7396EDD9F05AB640EFF01DAD0D44~YAAQb2JkX3hdBzOhAQAA6pTrXwG/yK/rT1o1AmIUKyLkT1ydDHXGPBFgExrve17voXJMea8xuS9KyOYJ6xwgFk2l1uvHKzF+xgToutyw/Hg9hos2DOyCqN9pvCCUFDOwM5S1VeBwoPKdKu4QhsHfih6cUKM9UtMGl/mez/vrUJtK7/8KdacmXUWpnYaEzcvgAnYlyQBlmCTo3EpjM52TePpB1PUFWaVXZ3jBIeSpPDM/y7e89cVBrYYm3wNKANNZ0wZbr4JwVggjDEYXGNdoHQtBg8S4JsgW9eIqCuHJjzziOk3NEghDbgQ5/JljpY5XGHzt+PDGjNZXSJwQEHhq8HcOYyYiYitXr6IIrPv1syI0ZXi9604RhWNNoSD4NhPKHdrfoyhLZzxDRHMAK7ZNOIr9~3490103~3686713; Domain=.walgreens.com; Path=/; Expires=Wed, 21 Oct 2026 23:23:56 GMT; Max-Age=14399
server-timingak_p; desc="1792610636930_1600414319_2509910641_2863_28038_0_5_15";dur=1
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.