Security Report Summary
D
Site: https://www.wheelcovers.com/
IP Address: 192.200.160.248
Report Time: 08 Nov 2026 11:53:23 UTC
Headers:
  • X-Content-Type-Options
  • X-Frame-Options
  • Content-Security-Policy
  • Referrer-Policy
  • Permissions-Policy
  • Strict-Transport-Security
Advanced:
Your site could be at risk, let’s perform a deeper security analysis of your site and APIs:
Missing Headers
Content-Security-PolicyContent Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
Referrer-PolicyReferrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Permissions-PolicyPermissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.
Warnings
Strict-Transport-SecurityThe "max-age" directive is too small. The minimum recommended value is 2592000 (30 days).
Raw Headers
HTTP/2103
link<https://www.powr.io/powr.js?external-type=bigcommerce>; as=script; rel=preload, <https://cdn11.bigcommerce.com/s-ohwpqp7>; as=font; crossorigin=anonymous; rel=preconnect, <https://fonts.googleapis.com/>; as=font; crossorigin=anonymous; rel=preconnect, <https://fonts.gstatic.com/>; as=font; crossorigin=anonymous; rel=preconnect, <https://cdn11.bigcommerce.com/s-ohwpqp7/stencil/3c222b60-834d-013f-8fe8-52958aafeed3/e/7badc6c0-8344-013f-5f51-0ef81d2c6f63/css/theme-f2803330-890c-013f-4cd4-3e84fca73be6.css>; as=style; rel=preload, <https://cdn11.bigcommerce.com/s-ohwpqp7/stencil/3c222b60-834d-013f-8fe8-52958aafeed3/e/7badc6c0-8344-013f-5f51-0ef81d2c6f63/dist/theme-bundle.head_async.js>; as=script; rel=preload, <https://cdn11.bigcommerce.com/s-ohwpqp7/stencil/3c222b60-834d-013f-8fe8-52958aafeed3/e/7badc6c0-8344-013f-5f51-0ef81d2c6f63/dist/theme-bundle.main.js>; as=script; rel=preload
HTTP/2 200
dateSun, 08 Nov 2026 11:53:23 GMT
content-typetext/html; charset=UTF-8
cf-raya574607bf9921d56-DUB
cf-cache-statusDYNAMIC
cache-controlno-store, no-cache, must-revalidate
link<https://www.powr.io/powr.js?external-type=bigcommerce>; rel=preload; as=script, <https://cdn11.bigcommerce.com/s-ohwpqp7>; rel=preconnect; as=font; crossorigin=anonymous, <https://fonts.googleapis.com/>; rel=preconnect; as=font; crossorigin=anonymous, <https://fonts.gstatic.com/>; rel=preconnect; as=font; crossorigin=anonymous, <https://cdn11.bigcommerce.com/s-ohwpqp7/stencil/3c222b60-834d-013f-8fe8-52958aafeed3/e/7badc6c0-8344-013f-5f51-0ef81d2c6f63/css/theme-f2803330-890c-013f-4cd4-3e84fca73be6.css>; rel=preload; as=style, <https://cdn11.bigcommerce.com/s-ohwpqp7/stencil/3c222b60-834d-013f-8fe8-52958aafeed3/e/7badc6c0-8344-013f-5f51-0ef81d2c6f63/dist/theme-bundle.head_async.js>; rel=preload; as=script, <https://cdn11.bigcommerce.com/s-ohwpqp7/stencil/3c222b60-834d-013f-8fe8-52958aafeed3/e/7badc6c0-8344-013f-5f51-0ef81d2c6f63/dist/theme-bundle.main.js>; rel=preload; as=script
servercloudflare
x-request-id563812b4b244d0c7690997778f1d8618
strict-transport-securitymax-age=0
varyAccept-Encoding
via1.1 google
bc-ray1
bc-ray1
alt-svch3=":443"; ma=86400
fpc-metadatac=1:h=0
x-bc-disable-meta-pixel-page-viewtrue
x-bc-is-ha1
x-bc-store-id500125
x-content-type-optionsnosniff
x-frame-optionsdeny
x-makeswift-default-localeen
x-makeswift-entity-id
x-makeswift-page-localeen
x-makeswift-stable-page-referencedefault-0
x-makeswift-template-filepages/home
x-permitted-cross-domain-policiesnone
set-cookieSF-CSRF-TOKEN=3a27dc7c-69bc-4e8c-8c5a-8894e15e6355; Path=/; Secure; SameSite=Strict
set-cookiefornax_anonymousId=03c79296-39d2-4e56-abc4-5437aad90250; Expires=Tue, 07 Nov 2028 11:53:22 GMT; Path=/; Secure; SameSite=None
set-cookieathena_short_visit_id=a7444972-dbd1-4fc8-a1f2-4cf506adcc25:1794138802; Expires=Sun, 08 Nov 2026 12:23:22 GMT; Path=/; Secure; HttpOnly; SameSite=None
set-cookieShopper-Pref=788B10C7873BD429C91113971C7621B1B9E11F84-1794743603161-x%7B%22cur%22%3A%22USD%22%2C%22funcConsent%22%3Atrue%7D; Expires=Sun, 15 Nov 2026 11:53:23 GMT; Path=/; Secure; HttpOnly
set-cookieShopper-Pref-v2=968B9DCF5D0053956FFFD87AEEBF28EF6B901678-1794743603161-x%7B%22funcConsent%22%3Atrue%2C%22channels%22%3A%7B%221%22%3A%7B%22cur%22%3A%22USD%22%7D%7D%7D; Expires=Sun, 15 Nov 2026 11:53:23 GMT; Path=/; Secure; HttpOnly
set-cookieSHOP_SESSION_TOKEN=194a5668-6ce8-4c88-bc5b-685001a906b5; Expires=Sun, 15 Nov 2026 11:53:23 GMT; Path=/; Secure; HttpOnly; SameSite=None
set-cookie__cf_bm=stuuPC7YK8aDfK3RDWCZY1p3lL6ej4TpNK1KBZ45njc-1794138802.5575492-1.0.1.1-gVN7om_3o_64fQ8jJDlb0opAeE9toIaQf02k6IU7iHSh2vyMaOAmN6Nbyb7Vi_9QFA7vpNjkm1I1XiMCsP._E3ECzgCkLHVG2MdJCvd5AcC6cLNmFI74WyMavU1ch6ya; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=www.wheelcovers.com; Expires=Sun, 08 Nov 2026 12:23:23 GMT
report-to{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nkf4vYBSzoRC5dEZnQcPzBrHrEajf0TET%2Fnpzpy1nc8d8%2B99muQkxyVQGwOg%2FPxVZ7EpD%2BBViQwa4RcIQsSO58x%2B8SOQoG9JSnQWc%2BXHzS%2BfpHdVSUkl9DfHiUbqyKV1HFin0Ig%3D"}]}
nel{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encodinggzip
Upcoming Headers
Cross-Origin-Embedder-PolicyCross-Origin Embedder Policy allows a site to prevent assets being loaded that do not grant permission to load them via CORS or CORP.
Cross-Origin-Opener-PolicyCross-Origin Opener Policy allows a site to opt-in to Cross-Origin Isolation in the browser.
Cross-Origin-Resource-PolicyCross-Origin Resource Policy allows a resource owner to specify who can load the resource.
Additional Information
serverServer value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2".
strict-transport-securityHTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.
x-content-type-optionsX-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".
x-frame-optionsX-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
set-cookieThe 'httpOnly' flag is not set on this cookie. There is no Cookie Prefix on this cookie.
set-cookieThere is no Cookie Prefix on this cookie. This is not a SameSite Cookie.
report-toReport-To enables the Reporting API. This allows a website to collect reports from the browser about various errors that may occur. You can sign up for a free account on Report URI to collect these reports.
nelNetwork Error Logging is a new header that instructs the browser to send reports during various network or application errors. You can sign up for a free account on Report URI to collect these reports.