HTTPS Enabled
content-security-policyupgrade-insecure-requests ; default-src 'self' 'unsafe-inline' data: ; style-src 'self' 'unsafe-inline' consentmanager.mgr.consensu.org cdn.consentmanager.mgr.consensu.org *.privacy-center.org widget.solvemate.com www.googletagmanager.com *.optimonk.com *.ablyft.com ; img-src *.consentmanager.net *.solvemate.com *.bvg.de fahrinfo.vbb.de *.youtube.com *.optimonk.com *.google-analytics.com *.ablyft.com 'self' data: cdn.consentmanager.mgr.consensu.org consentmanager.mgr.consensu.org *.google-analytics.com *.privacy-center.org www.googletagmanager.com *.doubleclick.net *.google.com *.google.de *.ablyft.com ; connect-src 'self' ws: wss: *.consentmanager.net sso.bvg.de sso-integration.bvg.de consentmanager.mgr.consensu.org *.google-analytics.com *.solvemate.com *.dixa.io *.sentry.io *.doubleclick.net endpoint-app.cognigy.ai static-app.cognigy.ai *.google.com securehub-ar.bvg.de *.privacy-center.org *.optimonk.com *.ablyft.com *.googleadservices.com *.google.de ; form-action 'self' sso.bvg.de sso-integration.bvg.de *.ablyft.com ; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.consentmanager.net www.googletagmanager.com *.google-analytics.com api.solvemate.com widget.solvemate.com consentmanager.mgr.consensu.org cdn.consentmanager.mgr.consensu.org bvg-apps.hafas.de *.privacy-center.org cdn.consentmanager.mgr.consensu.org bvg-apps.hafas.de *.hafas.cloud *.doubleclick.net *.doubleclick.com *.googleadservices.com www.google.com www.google.de *.ablyft.com adservice.google.com pagead2.googlesyndication.com tagassistant.google.com *.optimonk.com ; frame-ancestors 'self' ; frame-src 'self' sso.bvg.de sso-integration.bvg.de bvg-apps.hafas.de *.hafas.cloud widget.solvemate.com www.youtube-nocookie.com transportb.novafind.eu www.googletagmanager.com vimeo.com forms.microsoft.com *.optimonk.com www.youtube.com *.ablyft.com static-app.cognigy.ai blob: https://bvg-apps.hafas.de https://bvg.hafas.cloud ; base-uri widget.solvemate.com 'self' ; object-src 'none' ; media-src 'self' data: *.optimonk.com ; font-src *.solvemate.com *.optimonk.com fonts.gstatic.com *.ablyft.com 'self' ; report-uri /csp-reportControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsdenyControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=315360000Forces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policygeolocation=(self "https://bvg-apps.hafas.de")Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlmax-age=600, publicCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp