HTTPS Enabled
content-security-policydefault-src 'self' https://cdn.cookielaw.org https://privacyportalde-cdn.onetrust.com https://*.youtube.com https://api-engage-eu.sitecorecloud.io https://edge.sitecorecloud.io https://ka-p.fontawesome.com https://kit.fontawesome.com https://xmc-bdrthermea1-platform-production.sitecorecloud.io/ https://xmf.remeha.co.uk https://*.googletagmanager.com https://*.google-analytics.com https://*.analytics.google.com https://*.g.doubleclick.net https://*.google.com https://maps.googleapis.com/ https://www.broetje.de https://cdnjs.cloudflare.com https://cdn.jsdelivr.net bdr-prd-platform-broetje-1hm0e0c1t-bdr-thermea-group.vercel.app; script-src 'self' 'unsafe-inline' 'unsafe-eval' bdr-prd-platform-broetje-1hm0e0c1t-bdr-thermea-group.vercel.app https://cdn.cookielaw.org https://privacyportalde-cdn.onetrust.com https://api-engage-eu.sitecorecloud.io https://*.googletagmanager.com https://*.google-analytics.com https://kit.fontawesome.com https://*.youtube.com https://vitals.vercel-insights.com https://maps.googleapis.com https://*.googleapis.com https://*.gstatic.com https://www.google.com https://bdr-prd-platform-broetje.vercel.app https://www.broetje.de https://cdnjs.cloudflare.com https://cdn.jsdelivr.net blob:; child-src https://maps.googleapis.com https://*.youtube.com https://*.youtube-nocookie.com https://edge-platform.sitecorecloud.io bdr-prd-platform-broetje-1hm0e0c1t-bdr-thermea-group.vercel.app; style-src 'self' 'unsafe-inline' https://edge.sitecorecloud.io https://*.fontawesome.com https://www.broetje.de https://cdn.jsdelivr.net bdr-prd-platform-broetje-1hm0e0c1t-bdr-thermea-group.vercel.app; img-src 'self' * data:; connect-src 'self' https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://api-engage-eu.sitecorecloud.io https://*.fontawesome.com https://*.doubleclick.net https://cdn.cookielaw.org/ https://*.onetrust.com https://*.youtube.com/ https://vitals.vercel-insights.com https://edge-platform.sitecorecloud.io https://*.googleapis.com https://*.gstatic.com https://www.broetje.de https://cdnjs.cloudflare.com https://cdn.jsdelivr.net https://ipapi.co https://api.ipinfo.io bdr-prd-platform-broetje-1hm0e0c1t-bdr-thermea-group.vercel.app data: blob:; font-src 'self' https://fonts.gstatic.com https://ka-p.fontawesome.com https://kit.fontawesome.com https://bdr-prd-platform-broetje.vercel.app https://www.broetje.de bdr-prd-platform-broetje-1hm0e0c1t-bdr-thermea-group.vercel.app; report-uri https://bdrthermea.report-uri.com/r/d/csp/reportOnly; frame-src 'self' mailto: https://erp.bdrthermea.com https://advisor.co2online.de https://ratgeber.co2online.de https://broetje-website.foerderdata.de https://broetje.questionizer.eu https://www.youtube-nocookie.com https://www.youtube.com https://de-broetje.bdrwebtest.com https://maps.googleapis.com https://edge-platform.sitecorecloud.io https://www.google.com https://partner.broetje.de/ https://esr.fe-bis.de/de/broetje/;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGINControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=63072000; includeSubDomains; preload;Forces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyno-referrerControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlpublic, max-age=0, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-byNext.jsShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — Next.js
Recommendation: Should be removed. Reveals server technology to attackers.
Header 'x-powered-by' has potentially insecure value: Next.js
Recommendation: Review and fix this security issue