HTTPS Enabled
content-security-policybase-uri 'self' analytics.c2comms.cloud; block-all-mixed-content; child-src 'self' blob:; connect-src 'self' blob: *.algolia.io *.algolia.net *.algolianet.com *.config.eu-1.smooch.io *.demdex.net *.everesttech.net *.execute-api.us-east-2.amazonaws.com gr3btv2492.execute-api.eu-central-1.amazonaws.com *.sc.omtrdc.net 7tfpgoho62.execute-api.us-west-2.amazonaws.com adservice.google.com aggregator.service.usercentrics.eu api.company-target.com api.dc.siemens.com uat.api.dc.siemens.com api.eu-1.smooch.io api.refiner.io api.s.sw.siemens.com api.support.sw.siemens.com api.sw.siemens.com api.usercentrics.eu assets.new.siemens.com auth.sw.siemens.com botbuilder.siemens.cloud *.directline.botframework.com directline.botframework.com wss://directline.botframework.com wss://*.directline.botframework.com browser-intake-datadoghq.com cdn.plyr.io config-api.c2comms.cloud consent-api.service.consent.usercentrics.eu content.hotjar.io data.cdn.siemens.com data.metrics.siemens-cdn.com metrics.siemens-cdn.com experience.ninetailed.co field-marshal.sw.siemens.com graphql.contentful.com graphql.usercentrics.eu googleads.g.doubleclick.net irpages2.eqs.com metrics.hotjar.io payment.siemens.com preview.contentful.com profiles.siemens.com prompts.maze.co px.ads.linkedin.com region1.google-analytics.com secure.ixopay.com static.sw.cdn.siemens.com tag-logger.demandbase.com tools.adlytics.net uct.service.usercentrics.eu video.sw.siemens.com legacy-video.sw.siemens.com w3.siemens.com ws.hotjar.com wss://*.appsync-realtime-api.eu-central-1.amazonaws.com wss://*.smooch.io wss://transcribestreaming.eu-central-1.amazonaws.com:8443 wss://ws.hotjar.com www.cdn.botfriendsx.com www.facebook.com www.google-analytics.com www.google.com www.google.de www.googleadservices.com www.gstatic.com www.siemens.at *.amplitude.com data: i0youh1e7m-1.algolianet.com i0youh1e7m-2.algolianet.com i0youh1e7m-3.algolianet.com i0youh1e7m-dsn.algolia.net raw.githubusercontent.com rum.browser-intake-datadoghq.com session-replay.browser-intake-datadoghq.com siemens.sc.omtrdc.net vc.hotjar.io video.sw.cdn.siemens.com www.googletagmanager.com service.sellerportal.xcelerator.siemens.com siemenscrm.my.salesforce-scrt.com siemenscrm.my.salesforce.com siemenscrm.my.site.com bat.bing.com partner-finder.btregistration.si.siemens.cloud seaapi.siemens.cloud assets.investisdigital.com api.investisdigital.com code.highcharts.com vertex.siemens.studio *.brapps.siemens.cloud *.brappsqa.siemens.cloud *.boltdns.net players.brightcove.net edge.api.brightcove.com *.akamaihd.net *.brightcovecdn.com *.media.brightcove.com metrics.brightcove.com secure.brightcove.com one.beta.siemens.com; default-src 'self' blob:; font-src 'self' data: analytics.c2comms.cloud cdn.siemens-web.com cdn.siemens.com siemenscrm.my.site.com static.sw.cdn.siemens.com tools.adlytics.net www.cdn.botfriendsx.com players.brightcove.net one.beta.siemens.com; frame-ancestors 'self' *.c2comms.cloud contentpath.siemens.com mc.contentpath.siemens.com content.sw.siemens.com resources.dc.siemens.com siemensfactoryautomation.pathfactory.com myaccount.lingotek.com vertex.siemens.studio *.cuenect.online *.siemens.com; frame-src 'self' *.demdex.net cdn.siemens.com contentpath.siemens.com mc.contentpath.siemens.com home-e31.niceincontact.com js.refiner.io rq.nativeforms.app s.company-target.com secure.ixopay.com siemens-disw.formstack.com siemenscrm.my.salesforce-scrt.com siemenscrm.my.site.com *.smooch.io www.facebook.com players.brightcove.net vertex.siemens.studio; img-src 'self' blob: data: *.demdex.net *.everesttech.net *.sc.omtrdc.net adservice.google.com analytics.c2comms.cloud app.usercentrics.eu *.amplitude.com assets.new.siemens.com blogs.sw.siemens.com botbuilder.siemens.cloud cdn.auth0.com cdn.datatables.net cdn.siemens.com content.prescreen.io cookies.siemens.com i1.wp.com id.rlcdn.com images.ctfassets.net images.sw.cdn.siemens.com jobdata.prescreen.io mall.industry.siemens.com px.ads.linkedin.com s.gravatar.com static.siemens.com static.sw.cdn.siemens.com tools.adlytics.net uct.service.usercentrics.eu video.sw.cdn.siemens.com www.gravatar.com analytics.twitter.com d2xo500swnpgl1.cloudfront.net plmsisw.file.force.com siemenscrm.my.site.com sellerportal-prod-data.s3.eu-central-1.amazonaws.com solidedge.siemens.com support.sw.siemens.com t.co www.googletagmanager.com bat.bing.com bat.bing.net ad.doubleclick.net www.facebook.com *.ads.linkedin.com assets.investisdigital.com vertex.siemens.studio players.brightcove.net *.boltdns.net *.akamaihd.net *.brightcove.com *.brightcovecdn.com; manifest-src 'self'; media-src 'self' blob: *.amplitude.com cdn.plyr.io video.sw.cdn.siemens.com video.sw.siemens.com legacy-video.sw.siemens.com vertex.siemens.studio *.brightcovecdn.com *.boltdns.net *.media.brightcove.com *.akamaihd.net *.cf.brightcove.com; object-src 'none'; script-src 'report-sample' 'self' 'unsafe-eval' 'unsafe-inline' blob: analytics.c2comms.cloud anteilspreise.siemens.com app.usercentrics.eu *.amplitude.com cdn.c2comms.cloud cdn.datatables.net cdn.jsdelivr.net cdn.siemens-web.com cdn.siemens.com cookies.siemens.com data.cdn.siemens.com data.metrics.siemens-cdn.com metrics.siemens-cdn.com home-e31.niceincontact.com js.refiner.io metrics.siemens-cdn.com ml314.com payment.siemens.com prod.ste.dc.siemens.com profiles.siemens.com script.hotjar.com secure.ixopay.com snap.licdn.com snippet.maze.co static.ads-twitter.com static.hotjar.com static.sw.cdn.siemens.com tag.demandbase.com tools.adlytics.net w3.siemens.com www.datadoghq-browser-agent.com www.googletagmanager.com botbuilder.siemens.cloud connect.facebook.net img.en25.com www.cdn.botfriendsx.com bat.bing.com *.smooch.io service.force.com siemenscrm.my.salesforce.com siemenscrm.my.site.com assets.investisdigital.com api.investisdigital.com code.highcharts.com vertex.siemens.studio players.brightcove.net vjs.zencdn.net one.beta.siemens.com; style-src 'self' 'unsafe-inline' *.amplitude.com assets.investisdigital.com api.investisdigital.com analytics.c2comms.cloud cdn.datatables.net cdn.siemens.com profiles.siemens.com siemenscrm.my.site.com static.sw.cdn.siemens.com www.cdn.botfriendsx.com botbuilder.siemens.cloud fonts.googleapis.com tools.adlytics.net vertex.siemens.studio players.brightcove.net one.beta.siemens.com; upgrade-insecure-requests; worker-src 'self' blob:; report-uri https://w3.siemens.com/report?environment=siemenscom-prod&release=6eb534ab; report-to commscloudControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionssameoriginControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomains; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlpublic, max-age=60, s-maxage=300, stale-while-revalidate=3600, stale-if-error=3600, no-cache="Set-Cookie"Caching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp