Technical Information
| HTTP Status Code | 200 |
| HTTP Version | HTTP/1.1 |
| HTTPS | ✔ Available |
| IP Address | 20.39.143.75 |
| Compression | gzip |
|
🔒 🟡 Mixed Content (3 HTTP resources) | The page is served over HTTPS but loads 3 resource(s) over HTTP. This may be blocked in modern browsers. |
|
ℹ 🔵 Missing X-Frame-Options | The site can be embedded in iframes by third parties (clickjacking risk). |
HTTP Status Code 200
HTTP Version HTTP/1.1
HTTPS ✔ Available
IP Address 20.39.143.75
Compression gzip
🔒 🟡 Mixed Content (3 HTTP resources) The page is served over HTTPS but loads 3 resource(s) over HTTP. This may be blocked in modern browsers.
ℹ 🔵 Missing X-Frame-Options The site can be embedded in iframes by third parties (clickjacking risk).
Redirect Chain
| # | URL | HTTP Status Code | Status |
| 1 | https://ttc.ca:443 | 301 | HTTP/1.1 301 Moved Permanently |
| 2 | https://www.ttc.ca/ | 200 | HTTP/1.1 200 OK |
#1 URL https://ttc.ca:443
HTTP Status Code 301
Status HTTP/1.1 301 Moved Permanently
#2 URL https://www.ttc.ca/
HTTP Status Code 200
Status HTTP/1.1 200 OK
Performance
| DNS Lookup | 4.1 ms |
| TCP Connect | 92.5 ms |
| TLS Handshake | 182.6 ms |
| Time To First Byte (TTFB) | 605.6 ms |
| Content Download | 1 ms |
| Total Response Time | 606.6 ms |
DNS Lookup 4.1 ms
TCP Connect 92.5 ms
TLS Handshake 182.6 ms
Time To First Byte (TTFB) 605.6 ms
Content Download 1 ms
Total Response Time 606.6 ms
Security
| HTTPS | ✔ Enabled |
| HSTS | ✔ max-age=31536000; includeSubDomains; |
| CSP | ✔ Configured |
| X-Frame-Options | ⚠ Not configured |
| X-Content-Type-Options | ✔ nosniff |
| Referrer Policy | no-referrer |
| HTTP/2 | ⚠ HTTP/1.1 |
HTTPS ✔ Enabled
HSTS ✔ max-age=31536000; includeSubDomains;
CSP ✔ Configured
X-Frame-Options ⚠ Not configured
X-Content-Type-Options ✔ nosniff
Referrer Policy no-referrer
HTTP/2 ⚠ HTTP/1.1
SEO Quick Check
| Title | TTC.ca |
| Open Graph Title | TTC.ca |
| Twitter Card | summary_large_image |
| Twitter Title | TTC.ca |
Title TTC.ca
Open Graph Title TTC.ca
Twitter Card summary_large_image
Twitter Title TTC.ca
Detected Technologies
| Technology | Google Analytics Google Tag Manager |
Technology Google Analytics Google Tag Manager
HTTP Headers
| Date
| Thu, 27 Aug 2026 16:28:22 GMT |
| Content-Type
| text/html; charset=utf-8 |
| Content-Length
| 33478 |
| Connection
| keep-alive |
| Cache-Control
| no-cache, no-store |
| Pragma
| no-cache |
| Content-Encoding
| gzip |
| Expires
| -1 |
| Vary
| Accept-Encoding |
| Access-Control-Allow-Origin
| * |
| Referrer-Policy
| no-referrer |
| Expect-CT
| max-age=3600, enforce |
| X-XSS-Protection
| 1; mode=block |
| X-Content-Type-Options
| nosniff |
| Content-Security-Policy
| default-src 'self' 'unsafe-inline' *.ttc.ca 'unsafe-eval' https://apps.sitecore.net *.azureedge.net; media-src 'self' data: ; img-src *.ttc.ca *.dmtry.com *.siteimproveanalytics.io *.researchnow.com 'self' data: *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com siteimproveanalytics.io *.windows.net *.clarity.ms *.customsearch.ai *.bing.com *.cluepixel.com ; style-src 'self' 'unsafe-inline' *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com *.windows.net *.clarity.ms *.customsearch.ai *.bing.com; font-src 'self' 'unsafe-inline' *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com *.windows.net *.clarity.ms *.customsearch.ai *.bing.com; connect-src * ; frame-src 'self' *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com *.triplinx.ca transitapp.com *.hafas.cloud; script-src * 'self' data: 'unsafe-inline' 'unsafe-eval' *.ttc.ca *.azureedge.net *.google.com *.google.ca *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com ;upgrade-insecure-requests; block-all-mixed-content; frame-ancestors 'none'; object-src data: 'unsafe-eval' |
| Strict-Transport-Security
| max-age=31536000; includeSubDomains; |
Meta Tags
| Apple-mobile-web-app-title | TTC.ca |
| Viewport | width=device-width, initial-scale=1 |
Date Thu, 27 Aug 2026 16:28:22 GMT
Content-Type text/html; charset=utf-8
Content-Length 33478
Connection keep-alive
Cache-Control no-cache, no-store
Pragma no-cache
Content-Encoding gzip
Expires -1
Vary Accept-Encoding
Access-Control-Allow-Origin *
Referrer-Policy no-referrer
Expect-CT max-age=3600, enforce
X-XSS-Protection 1; mode=block
X-Content-Type-Options nosniff
Content-Security-Policy default-src 'self' 'unsafe-inline' *.ttc.ca 'unsafe-eval' https://apps.sitecore.net *.azureedge.net; media-src 'self' data: ; img-src *.ttc.ca *.dmtry.com *.siteimproveanalytics.io *.researchnow.com 'self' data: *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com siteimproveanalytics.io *.windows.net *.clarity.ms *.customsearch.ai *.bing.com *.cluepixel.com ; style-src 'self' 'unsafe-inline' *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com *.windows.net *.clarity.ms *.customsearch.ai *.bing.com; font-src 'self' 'unsafe-inline' *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com *.windows.net *.clarity.ms *.customsearch.ai *.bing.com; connect-src * ; frame-src 'self' *.ttc.ca *.azureedge.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com *.triplinx.ca transitapp.com *.hafas.cloud; script-src * 'self' data: 'unsafe-inline' 'unsafe-eval' *.ttc.ca *.azureedge.net *.google.com *.google.ca *.google-analytics.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.addthis.com *.addthisedge.com *.youtube.com *.moatads.com ;upgrade-insecure-requests; block-all-mixed-content; frame-ancestors 'none'; object-src data: 'unsafe-eval'
Strict-Transport-Security max-age=31536000; includeSubDomains;
