HTTPS Enabled
content-security-policydefault-src 'self';script-src 'self' 'unsafe-eval' 'nonce-b402335134aab1a6d078bee639714c5c' 'nonce-f6a55bf11573781b9763cda0167f1e16' 'nonce-9964a681146780be6cb648d2719ca0c0' 'nonce-3ff5a6f4bc5c7a8d9b865372f2c5a8e0' 'nonce-3c035499ec035cdc4341b57ab07af669' 'nonce-123e2e6b7bf4a0b988f51b9a55da9ffc' 'nonce-e81d7e638fa15c4c102d171a8b169976' 'nonce-6933bddd6691e7085fef2eed3cdb6948' 'nonce-0487e4638c667829112a22f6dc9f3fb0' 'nonce-0835584e495d262dee3ed54f9567b123' 'nonce-5ab57b550854e033c134dda90abb541e' 'nonce-74b03e2e80a5b9ebd6dd1ddca200e660' 'nonce-ee4297eb247240d398c47da03ecf8cf7' 'nonce-4de78baed2ebc267f4ab555c013a17cf' 'nonce-d01eee423d7e0d620c55e1ad43a23f38' 'nonce-2c66d060a4725e2d6047e251265e439c' 'nonce-8fbf85e3584f647f62bd30dba75e9b74' 'nonce-8d533683e41c4847821ec07436904e29' 'nonce-07329af3979712d1009b402e643b2528' 'nonce-f35b9db91b2ed6aad59e5d995a8966c6' 'nonce-bef98f55c3024e2fd337f23bfae25a72' 'nonce-9d5624408a446d24dc878aa5b9f3e3ff' 'nonce-ea6c2e6ae70e00f73f7bf6d8a3f101b4' 'nonce-5e958467ad6ca6b37b72fa656c6054d6' 'nonce-6902eea862492e1b3d6587f9650f6ed8' 'nonce-03b0167a8c05148633ece4a0bc068137' 'nonce-677ff7c188c1186585bffe2fea8e88a5' 'nonce-9e6b984d3ba2ab54cf11b3ccd8b3d170' 'nonce-5f8103d11f344a920ffbe4b02ede6d5f' 'nonce-e5c9f74eab0db34edfff798ceac3c11e' 'nonce-a29dde169c1c79bf210279a451b26303' 'nonce-ec8784ff38bc16afde5521788d9321e6' 'nonce-5ae46c1decb0ba118d0074925f533342' 'nonce-5bb49a2dcfe8078ac0b27b10b6065a49' 'nonce-f2cccf7485f41fafa248035829020a59' 'nonce-7007f4296999bffb2ee42189e45b53b4' 'nonce-8b1b5256648ca28da2544cc473f22cef' 'nonce-97ec1376c6d5cb3e96e5ae224ca312f4' 'nonce-53b1148fc6a1aaf83dda2f7c8fc8ad9c' 'nonce-7a1ee85b55f0b1616e5274aea00e31b1' 'nonce-1027b26e64703079f3d041f45750242e' 'nonce-9e4581833a8d2ba815e79a47ae091c5a' 'nonce-b1fa3230ca83da3b3a003c0e501e39b8' 'nonce-21880f6a9d77273652dee39b4811a265' 'nonce-b2a36d9d9bf667cbd78c4bd64a6ee2f5' 'nonce-7d537f7704332d7692a589c565613b97' widget.join.com cdn-widgetv2.join.com gem-stats.de join.com cdn.join.com app.cituro.com google.com maps.googleapis.com developers.google.com ajax.googleapis.com widgets.trustedshops.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com cdn.logwork.com global.frcapi.com cdn.mouseflow.com api.leadinfo.com cdn.ldnfrpl.com sibforms.com sibautomation.com cdn.by.wonderpush.com www.googletagmanager.com *.googlesyndication.com 'sha256-jKKO0Sb2ZRrN6u86cOSFU0N8fNjHoKczd3BvaFAWm9U=';img-src 'self' 'unsafe-inline' data: join.com cdn.join.com app.cituro.com maps.gstatic.com maps.googleapis.com ajax.googleapis.com media.geiger-edelmetalle.de widgets.trustedshops.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com *.zakeke.com *.googlesyndication.com fonts.gstatic.com www.googletagmanager.com blob:;style-src 'self' 'unsafe-inline' fonts.googleapis.com join.com cdn.join.com app.cituro.com use.fontawesome.com ajax.googleapis.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com sibforms.com www.googletagmanager.com;font-src 'self' fonts.gstatic.com cdn.cituro.com app.cituro.com play.google.com use.fontawesome.com ajax.googleapis.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com assets.brevo.com ;frame-src 'self' www.youtube-nocookie.com app.cituro.com google.com youtube.com ajax.googleapis.com www.google.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com global.frcapi.com *.zakeke.com;connect-src 'self' cdn.join.com join.com gem-stats.de app.cituro.com google.com maps.googleapis.com *.trustedshops.com *.etrusted.com *.trustbadge.com ajax.googleapis.com facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com api.friendlycaptcha.com widget.join.com logwork.com *.mouseflow.com api.leadinfo.com zakeke-shopware.azurewebsites.net *.zakeke.com *.sibforms.com *.brevo.com *.wonderpush.com *.googlesyndication.com *.googletagmanager.com;frame-ancestors 'none';worker-src blob:;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsdenyControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=600; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyno-referrer-when-downgradeControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlno-cache, privateCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
HSTS max-age is too low: 600 seconds (recommended: >= 31536000)
Recommendation: Review and fix this security issue