cava.com Review

 N/A

HTTP/1.1 301 Moved Permanently
Date: Sun, 24 Aug 2025 17:26:46 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 24 Aug 2025 18:26:46 GMT
Location: https://cava.com/
Set-Cookie: __cf_bm=hBFTipeyKo8FG9nlIzYWRKMgzIK8j2IKEGcTUwhnFqk-1756056406-1.0.1.1-562oK8a.89agmeVho9XNhtZEQT.uOr0ZPNZYZ39WUx1bLc20G8RmMA5sK.hV3AvaT10zJfCMzJbbaR5Vt0v2O5BllMn4OkAz78_wmcHkIYU; path=/; expires=Sun, 24-Aug-25 17:56:46 GMT; domain=.cava.com; HttpOnly
Set-Cookie: _cfuvid=Zm6Uz6ZgSeZH_17Cep2TpflmM6l7wFMh6WbemnGlfv4-1756056406224-0.0.1.1-604800000; path=/; domain=.cava.com; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 97448e7aca54b955-KIX

HTTP/1.1 200 OK
Date: Sun, 24 Aug 2025 17:26:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip
CF-Ray: 97448e7b3c8bd3ee-KIX
CF-Cache-Status: DYNAMIC
Age: 257137
Cache-Control: public, max-age=0, s-maxage=31536000, must-revalidate
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Vary: Accept-Encoding
Via: 1.1 a1a16c2426f703425b280e2f9d2dde5a.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://*.googletagmanager.com https://cdn-prod.securiti.ai https://tagmanager.google.com; img-src 'self' https://*.googleapis.com https://*.gstatic.com data: *.google.com *.googleusercontent.com https://cdn-prod.securiti.ai https://www.facebook.com/ https://bat.bing.com https://tr.snapchat.com https://*.google-analytics.com https://*.googletagmanager.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com https://www.google-analytics.com https://googleads.g.doubleclick.net https://ssl.gstatic.com https://www.gstatic.com https://www.google.com *.ctfassets.net https://appboy-images.com https://braze-images.com https://*.adform.net https://www.googleadservices.com https://*.app.privacycenter.cloud https://*.adsrvr.org; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: https://maps.googleapis.com https://maps.gstatic.com https://*.googleapis.com https://*.gstatic.com https://*.google.com https://*.googletagmanager.com https://*.google-analytics.com *.google.com https://*.ggpht.com *.googleusercontent.com https://safetechpageencryptionvar.chasepaymentech.com https://safetechpageencryption.chasepaymentech.com https://cdn-prod.securiti.ai https://sc-static.net https://connect.facebook.net https://analytics.tiktok.com https://tr-shadow.snapchat.com http://bat.bing.com https://bat.bing.com https://tagmanager.google.com https://ssl.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google-analytics.com https://www.google.com https://tr.snapchat.com https://cdn.riskid.security https://knowledgetags.yextpages.net https://sdk.iad-03.braze.com https://js.appboycdn.com https://csp-reporting.cloudflare.com https://challenges.cloudflare.com https://*.jpmorgan.com/ https://drive-widget.cdn4dd.com/ https://*.app.privacycenter.cloud https://*.adform.net https://*.fullstory.com https://*.adsrvr.org https://*.pinimg.com; frame-src *.google.com https://tr-shadow.snapchat.com https://tr.snapchat.com https://bid.g.doubleclick.net https://challenges.cloudflare.com https://privacy-central.securiti.ai https://*.jpmorgan.com/ https://ssl.kaptcha.com/ https://tst.kaptcha.com/ https://*.adform.net https://td.doubleclick.net/ https://s2.adform.net https://*.app.privacycenter.cloud https://*.adsrvr.org https://*.pinimg.com; connect-src 'self' https://*.googleapis.com https://*.google-analytics.com *.google.com https://*.gstatic.com https://cdn-prod.securiti.ai https://app.securiti.ai https://rum.browser-intake-datadoghq.com data: blob: https://tr-shadow.snapchat.com https://analytics.tiktok.com https://tr.snapchat.com https://*.analytics.google.com https://*.googletagmanager.com https://*.g.doubleclick.net https://*.google.com https://www.google-analytics.com https://collect.riskid.security https://*.launchdarkly.com https://sdk.iad-03.braze.com https://*.jpmorgan.com https://*.split.io/ https://ssl.kaptcha.com/ https://tst.kaptcha.com/ https://browser-intake-datadoghq.com https://api.ipify.org https://*.app.privacycenter.cloud https://*.adform.net https://*.fullstory.com https://*.adsrvr.org https://*.pinimg.com; font-src https://fonts.gstatic.com 'self' data:; form-action 'self'; frame-ancestors true
referrer-policy: same-origin
x-amz-cf-id: A04LRnmlf8GLd0shKM5pNDb6PsXWxTj9lhbU0h5YolvOZVy84eMVeg==
x-amz-cf-pop: HEL51-P2
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: deny
x-xss-protection: 1
Set-Cookie: __cf_bm=aLlwMBRPK93YgQ1adiVlABYPlVWKj2ICi_6KWLttLyE-1756056407-1.0.1.1-jC08nbENnq8ks4lIjGBgl.KdESF71Ly6X63ctLd1umcHle6EtaGfjwczogk32fUwC1mb4nzglqExXfpDaREpSJTzw7Y_jlkqth9rst2xpvg; path=/; expires=Sun, 24-Aug-25 17:56:47 GMT; domain=.cava.com; HttpOnly; Secure
Set-Cookie: _cfuvid=CS4ZBiC9vPk44DcHnEnMocQf0_uGaL2IZWPvHIuhsm0-1756056407147-0.0.1.1-604800000; path=/; domain=.cava.com; HttpOnly
Server: cloudflare