HTTPS Enabled
content-security-policyframe-ancestors 'self' *.myraidbox.de medico-26496.vasil-ams.servebolt.cloud medico-26497.vasil-ams.servebolt.cloud medico-24644.siv-ams.servebolt.cloud medico-28276.vasil-ams.servebolt.cloud backend.medicover-wordpress.ddev.site 'self' medico-26496.vasil-ams.servebolt.cloud medico-26497.vasil-ams.servebolt.cloud medico-24644.siv-ams.servebolt.cloud medico-24746.siv-ams.servebolt.cloud backend.medicover-wordpress.ddev.site vercel.live; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googlesyndication.com *.googleapis.com *.cookiebot.com www.googletagmanager.com tagmanager.google.com www.google.com www.google.de www.gstatic.com www.google-analytics.com www.googleadservices.com googleads.g.doubleclick.net vercel.live connect.facebook.net cdn.vercel-insights.com https://*.googletagmanager.com https://www.google-analytics.com https://ssl.google-analytics.com app.usercentrics.eu widget.customer-alliance.com privacy-proxy.usercentrics.eu https://web.cmp.usercentrics.eu cdn.eye-able.com access.eye-able.com translate-cdn.eye-able.com https://*.clarity.ms https://c.bing.com ; script-src-elem 'self' 'unsafe-eval' 'unsafe-inline' web.cmp.usercentrics.eu https://widget.customer-alliance.com https://www.googletagmanager.com/ https://maps.googleapis.com https://321med-cdn.com https://321med6.com https://321med16.com cdn.eye-able.com access.eye-able.com translate-cdn.eye-able.com vercel.live https://*.clarity.ms https://c.bing.com; connect-src 'self' data: localhost *.typekit.net *.googleapis.com www.google-analytics.com stats.g.doubleclick.net www.google.com googleads.g.doubleclick.net vitals.vercel-insights.com vercel.live googletagmanager.com google-analytics.com region1.google-analytics.com region1.analytics.google.com https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com https://www.google-analytics.com consentcdn.cookiebot.com api.usercentrics.eu consent-api.service.consent.usercentrics.eu https://aggregator.service.usercentrics.eu https://consent-api.service.consent.usercentrics.eu https://graphql.usercentrics.eu https://v1.api.service.cmp.usercentrics.eu/ https://privacy-proxy.usercentrics.eu https://sentry.brandung-dev.de cdn.eye-able.com access.eye-able.com translate-cdn.eye-able.com https://translate.eye-able.com https://321med-cdn.com https://321med6.com https://321med16.com vercel.live https://*.clarity.ms https://c.bing.com; style-src 'self' 'unsafe-inline' *.googleapis.com tagmanager.google.com *.typekit.net https://cdn.eye-able.com https://translate-cdn.eye-able.com vercel.live; font-src 'self' data: assets.vercel.com *.typekit.net widget.customer-alliance.com https://fonts.gstatic.com vercel.live; img-src 'self' blob: data: *.gstatic.com medico-26496.vasil-ams.servebolt.cloud medico-26497.vasil-ams.servebolt.cloud medico-24644.siv-ams.servebolt.cloud/ medico-28276.vasil-ams.servebolt.cloud *.googleapis.com ssl.gstatic.com www.gstatic.com googleads.g.doubleclick.net www.google.com www.google.de www.google-analytics.com assets.vercel.com vercel.com vercel.live https://*.google-analytics.com https://*.googletagmanager.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com https://www.google-analytics.com tr.snapchat.com analytics.tiktok.com googleadservices.com *.googleadservices.com *.cookiebot.com *.medicover-diagnostics.de *.backend.medicover-diagnostics.de uct.service.usercentrics.eu https://app.usercentrics.eu https://www.ihp-labor.de *.vercel.app https://321med.com https://cdn.eye-able.com https://translate-cdn.eye-able.com vercel.live https://*.clarity.ms https://c.bing.com; media-src 'self' *.typekit.net; manifest-src 'self'; worker-src 'self' blob:; object-src 'none'Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomainsForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyaccelerometer=(), ambient-light-sensor=(), autoplay=(self), battery=(), camera=(), cross-origin-isolated=(self), display-capture=(self), document-domain=(), encrypted-media=(self), execution-while-not-rendered=(self), execution-while-out-of-viewport=(self), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=(self), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(self), usb=(), web-share=(self), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), speaker-selection=()Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controls-maxage=60, stale-while-revalidate=31535940Caching policy. Use no-store/private for sensitive pages.
x-powered-byNext.jsShould be removed. Reveals server technology to attackers.
Missing: x-frame-options
Recommendation: Controls framing. Use CSP frame-ancestors instead.
Missing: referrer-policy
Recommendation: Controls referrer info. Recommended: strict-origin-when-cross-origin
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — Next.js
Recommendation: Should be removed. Reveals server technology to attackers.
Missing recommended header: referrer-policy
Recommendation: Review and fix this security issue
Header 'x-powered-by' has potentially insecure value: Next.js
Recommendation: Review and fix this security issue