HTTPS Enabled
content-security-policydefault-src 'self' https://diamant-zucker.de https://www.diamant-zucker.de https://www.diamant.pl/; script-src 'self' *.googleapis.com *.gstatic.com www.google.com apis.google.com connect.facebook.net ajax.aspnetcdn.com platform.twitter.com https://syndication.twitter.com/ https://s.ytimg.com https://publish.twitter.com *.twimg.com platform.linkedin.com http://platform.stumbleupon.com/1/widgets.js https://www.youtube.com/iframe_api https://dec.azureedge.net/ munchkin.marketo.net *.eloqua.com js.hs-scripts.com js.hs-analytics.net *.en25.com https://www.googletagmanager.com https://code.jquery.com http://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://cookiepro.blob.core.windows.net https://www.diamant-zucker.de https://cookie-cdn.cookiepro.com https://html2canvas.hertzen.com https://cdnjs.com 'unsafe-inline' 'unsafe-eval' *.google-analytics.com https://cdn.insight.sitefinity.com cdn.ampproject.org http://code.jquery.com http://cdnjs.cloudflare.com https://unpkg.com https://analytics.tiktok.com https://analytics.google.com/ *.loyjoy.com https://tracking-cdn.figpii.com https://sessions.bugsnag.com https://statics-cdn.figpii.com https://visitor.figpii.com https://variations-cdn.figpii.com https://s.pinimg.com https://ct.pinterest.com https://js.adsrvr.org https://stable.loyjoy.com/ https://www.juicer.io https://dec.azureedge.net web-chat.nativechat.com; style-src 'self' *.googleapis.com *.gstatic.com netdna.bootstrapcdn.com kendo.cdn.telerik.com www.google.com platform.twitter.com/css/ *.twimg.com http://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://cookiepro.blob.core.windows.net https://www.diamant-zucker.de 'unsafe-inline' https://cdn.insight.sitefinity.com https://dec.azureedge.net http://cdnjs.cloudflare.com https://variations-cdn.figpii.com https://stable.loyjoy.com https://www.juicer.io web-chat.nativechat.com; img-src 'self' *.gstatic.com *.googleapis.com platform.tumblr.com web.facebook.com www.facebook.com www.redditstatic.com www.linkedin.com https://syndication.twitter.com https://static.licdn.com/scds/common/u/images/apps/connect/sprites/sprite_connect_v14.png pbs.twimg.com platform.twitter.com/css/ *.twimg.com data: blob: https://*.insight.sitefinity.com https://*.dec.sitefinity.com *.eloqua.com track.hubspot.com staging.diamant-zucker.de https://diamant-zucker.de https://www.diamant-zucker.de *.google-analytics.com https://dec.azureedge.net https://cookie-cdn.cookiepro.com *.loyjoy.com *.googletagmanager.com/ https://analytics.figpii.com https://pixel.adsafeprotected.com https://static.adsafeprotected.com https://connect.facebook.net https://www.juicer.io https://cdn.insight.sitefinity.com web-chat.nativechat.com; font-src 'self' fonts.gstatic.com kendo.cdn.telerik.com netdna.bootstrapcdn.com data: https://diamant-zucker.de https://www.diamant-zucker.de https://plmsa-sql-web-diamant-staging.azurewebsites.net *.loyjoy.com; frame-src 'self' https://www.google.com https://open.spotify.com https://ct.pinterest.com https://insight.adsrvr.org https://stable.loyjoy.com web-chat.nativechat.com; connect-src 'self' accounts.google.com *.mktoresp.com http://staging.diamant-zucker.de https://diamant-zucker.de https://www.google-analytics.com https://www.diamant-zucker.de https://cookie-cdn.cookiepro.com https://privacyportal.cookiepro.com https://*.insight.sitefinity.com https://*.dec.sitefinity.com https://api.friendlycaptcha.com https://analytics.tiktok.com https://analytics.google.com/ *.googleapis.com *.loyjoy.com https://stats.g.doubleclick.net https://sessions.bugsnag.com https://tracking-settings.figpii.com https://visitor.figpii.com https://rr.figpii.com https://analytics.figpii.com https://ct.pinterest.com https://notify.bugsnag.com wss://tdw.figpii.com https://tdh.figpii.com https://eu-analytics.figpii.com https://eu-analytics-ip.figpii.com https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://www.juicer.io *.google-analytics.com; media-src 'self' data: blob: https://diamant-zucker.de https://www.diamant-zucker.de https://diamant-zucker-de.s3.amazonaws.com https://www.juicer.io; child-src 'self' https://platform.twitter.com/ https://syndication.twitter.com/ https://www.youtube.com/ https://player.vimeo.com/ https://w.soundcloud.com/ apis.google.com accounts.google.com staticxx.facebook.com www.facebook.com web.facebook.com badge.stumbleupon.com https://unpkg.com blob: web-chat.nativechat.com; object-src https://tracking-settings.figpii.comControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGINControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomainsForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyno-referrer-when-downgradeControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlno-cacheCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp