HTTPS Enabled
content-security-policydefault-src 'self' 'unsafe-inline' 'unsafe-eval' *.lafeltrinelli.it *.googleapis.com *.gravatar.com http://p2c.xplace.de *.sciencebehindecommerce.com appleid.cdn-apple.com *.klarnacdn.net *.jsdelivr.net *.flixfacts.com *.addthisedge.com *.dwin1.com *.azure.net *.monitor.azure.net *.moatads.com *.awin1.com *.addtoany.com apis.google.com *.igodigital.com *.googleadservices.com *.appspot.com *.bing.com *.kk-resources.com *.cloudflare.com *.googlesyndication.com *.creativecdn.com *.cloudfront.net *.tiktok.com *.algorecs.com *.criteo.com *.googleadservices.com *.doubleclick.net criteo-partners.tremorhub.com *.mediavine.com *.teads.tv sync-criteo.ads.yieldmo.com *.richrelevance.com *.sharethrough.com *.facebook.net *.clarity.ms *.bidswitch.net secure.adnxs.com *.youtube-nocookie.com *.msecnd.net *.omnitagjs.com *.3lift.com *.taboola.com *.smartadserver.com *.googleoptimize.com *.polyfill.io *.googletagmanager.com *.googletagservices.com contextual.media.net *.go-mpulse.net bsa-media.s3.amazonaws.com samples.findawayworld.com *.cookielaw.org *.google-analytics.com *.tradedoubler.com *.tradetracker.com ts.tradetracker.net /ad.yieldlab.net *.ivitrack.com *.mainadv.com *.riskified.com *.mndtrk.com ups.analytics.yahoo.com *.jquery.com *.rubiconproject.com *.bootstrapcdn.com nxtck.com *.gstatic.com *.facebook.com *.crystal-blocker.com *.onetrust.com sync.outbrain.com *.casalemedia.com *.salecycle.com *.lgw.io *.pubmatic.com ep-default-fcom-prd-mkio-community.westeurope.streaming.mediakind.com *.algolia.net *.visualstudio.com *.akstat.io *.akamaihd.net *.kobo.com *.criteo.net *.tangooserver.com *.creativecdn.com bofcom-cms.prd.life-cloud.net fibs-prd-apim-gw.life-cloud.net fibs-prd-apim.azure-api.net europe.directline.botframework.com *.blob.core.windows.net *.ibs.it https: wss: blob: data: properties: filesystem:;upgrade-insecure-requests;report-uri https://fibs-prd-apim.azure-api.net/csp-prd-ai/fcom-v1/TrackControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsDENYControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=300; includeSubDomainForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlprivate, s-maxage=0Caching policy. Use no-store/private for sensitive pages.
x-powered-byASP.NETShould be removed. Reveals server technology to attackers.
Missing: referrer-policy
Recommendation: Controls referrer info. Recommended: strict-origin-when-cross-origin
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — ASP.NET
Recommendation: Should be removed. Reveals server technology to attackers.
Missing recommended header: referrer-policy
Recommendation: Review and fix this security issue
Header 'x-powered-by' has potentially insecure value: ASP.NET
Recommendation: Review and fix this security issue
HSTS max-age is too low: 300 seconds (recommended: >= 31536000)
Recommendation: Review and fix this security issue