HTTPS Enabled
content-security-policydefault-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: *.nr-data.net wss://*.api-vivi-ws.davivienda.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com www.google.com.co www.google.com.kw ponos.zeronaught.com wa.appsflyersdk.com static.cloudflareinsights.com www.google.fr *.google.com www.google.com.au www.google.es apm.safecharge.com www.google.com.sa bcdn-god.we-stats.com www.google.co.kr www.google.pl cm.teads.tv *.botframework.com www.google.it p.teads.tv www.google.com.do www.google.pt *.eloqua.com secure-short.payv.co *.tiktok.com cobrowse.mypurecloud.com api.transmitsecurity.io www.google.fi *.dynatrace.com www.google.nl *.googleadservices.com wss://hdndukmu7i.execute-api.us-east-1.amazonaws.com www.google.com.my wa.appsflyer.com checkout.placetopay.com www.google.at www.google.co.il www.google.com.bo *.cloudfront.net www.google.si *.googleapis.com *.despegar.com.co www.google.co.nz *.youtube.com www.google.com.qa www.google.ca www.google.com.uy www.mercadopago.com.co *.onelink.me www.acueducto.com.co *.facebook.net 1.b406929acabac9b095f124c81bdfcf57f.com platform-websdk.transmitsecurity.io www.google.de analytics-ipv6.tiktokw.us t.teads.tv www.google.com.sv apps.mypurecloud.com www.google.co.jp account.yajuego.co www.google.co.ve *.facebook.com *.jsdelivr.net www.google.com.vn colvdox7cg.execute-api.us-east-1.amazonaws.com region1.google-analytics.com www.google.com.ec www.google.com.mx 1.c81358859121583b7adf2ace89cb39f44.com www.google.com.mt js-agent.newrelic.com www.alkosto.com www.google.com.pe *.davivienda.com *.dvvapps.io www.google-analytics.com www.google.com.br www.despegar.com websdk.appsflyer.com www.google.com.pa www.google.cz www.google.hn nuevaversion.bbvanet.com.co www.google.com.gt www.google.no api.openpay.co cdnjs.cloudflare.com api.wompi.co www.google.ru www.google.be api.kushkipagos.com *.apps.mypurecloud.com *.googlesyndication.com www.google.ie gateway2.tucompra.com.co www.google.ch www.google.co.cr *.gstatic.com www.google.ae *.doubleclick.net callback.payulatam.com secure.payco.co l.teads.tv *.googletagmanager.com www.google.co.uk www.google.co.in tags.bkrtx.com www.google.com.ar www.mercadopago.com www.google.com.sg www.google.cl; frame-ancestors 'self' *.youtube.com *.davivienda.com; connect-src 'self' wss://api-vivi-ws.davivienda.com wss://hdndukmu7i.execute-api.us-east-1.amazonaws.com colvdox7cg.execute-api.us-east-1.amazonaws.com https://www.google-analytics.com *.teads.tv *.appsflyersdk.com *.google.com *.tiktok.com *.davivienda.com *.onelink.me *.doubleclick.net *.tiktokw.us *.transmitsecurity.io www.googleadservices.comControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomainsForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlprivate, no-cache, no-store, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: x-frame-options
Recommendation: Controls framing. Use CSP frame-ancestors instead.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp