HTTPS Enabled
content-security-policyworker-src 'self' blob: data:; default-src 'self'; script-src 'self' 'unsafe-inline' *.fona.de *.cookiebot.com *.cookiebot.eu *.vditz.com *.googleapis.com *.google.com *.youtube.com *.vimeo.com *.streambuzzer.com; style-src 'self' 'unsafe-inline'; img-src data: 'self' *.usercentrics.eu *.twitter.com *.twimg.com *.fona.de *.matpro.de *.ytimg.com *.vimeocdn.com; font-src 'self'; connect-src 'self' *.cookiebot.com *.cookiebot.eu stats.vditz.com; base-uri 'self'; media-src blob: 'self' *.youtube.com *.vimeo.com *.bmbf.de; frame-src 'self' *.fona.de *.openstreetmap.de *.streambuzzer.com *.cookiebot.com *.cookiebot.eu *.vditz.com *.pt-dlr.de *.google.com *.youtube.com *.youtube-nocookie.com *.vimeo.com *.bmbf.de *.emailsys1a.net *.bmbfcluster.de; object-src 'none'; frame-ancestors 'self' *.fona.de;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniff;Prevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGIN;Controls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=300; includeSubDomains;Forces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlmax-age=0Caching policy. Use no-store/private for sensitive pages.
x-powered-byPleskLinShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — PleskLin
Recommendation: Should be removed. Reveals server technology to attackers.
Header 'x-powered-by' has potentially insecure value: PleskLin
Recommendation: Review and fix this security issue
X-Content-Type-Options should be 'nosniff', got: nosniff;
Recommendation: Review and fix this security issue
HSTS max-age is too low: 300 seconds (recommended: >= 31536000)
Recommendation: Review and fix this security issue