3 ms·

This is probably obvious, but just in case : for point 4 this is DOM-based XSS protection that is missing.