HTTPS Enabled
content-security-policyscript-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.shopify.com https://*.vercel-scripts.com https://*.vercel-insights.com https://www.googletagmanager.com https://www.google-analytics.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.gstatic.com https://dainese-cdn.thron.com https://*.hsforms.net https://*.hs-scripts.com https://*.hs-analytics.net https://*.hscollectedforms.net https://*.hs-banner.com https://*.usemessages.com https://*.hubspot.com https://*.hsadspixel.net https://*.hsappstatic.net https://*.hsstatic.net https://*.hsleadflows.net https://connect.facebook.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://dainese-cdn.thron.com https://*.hsforms.net https://*.hubspot.com; img-src 'self' data: blob: https://cdn.shopify.com https://res.cloudinary.com https://*.public.blob.vercel-storage.com https://dainese-cdn.thron.com https://dainese-share.thron.com https://dainese-view.thron.com https://dainese-track.thron.com https://*.vercel-scripts.com https://www.googletagmanager.com https://www.google-analytics.com https://analytics.google.com https://www.google.com https://www.google.co.jp https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.hsforms.com https://*.hubspot.com https://*.hubspot.net https://*.hubspotusercontent-na1.net https://*.hubspotusercontent-na2.net https://*.hubspotusercontent10.net https://*.hubspotusercontent20.net https://*.hubspotusercontent30.net https://*.hubspotusercontent40.net https://*.hs-fs.com https://*.hubfs.net https://*.hsappstatic.net https://*.facebook.com https://s3.amazonaws.com https://a.storyblok.com; font-src 'self' https://fonts.gstatic.com https://dainese-cdn.thron.com; connect-src 'self' https://*.shopify.com https://*.myshopify.com https://res.cloudinary.com https://api.cloudinary.com https://*.public.blob.vercel-storage.com https://*.vercel-insights.com https://*.vercel-scripts.com https://www.googletagmanager.com https://www.google-analytics.com https://analytics.google.com https://*.analytics.google.com https://*.google-analytics.com https://www.google.com https://www.google.co.jp https://googleads.g.doubleclick.net https://ad.doubleclick.net https://zipcloud.ibsnet.co.jp https://*.thron.com https://*.hsforms.com https://*.hsforms.net https://hubspot-forms-static-embed-na2.s3.amazonaws.com https://*.hubspot.com https://*.hubapi.com https://*.usemessages.com https://*.hsappstatic.net https://*.hsstatic.net https://*.facebook.com https://*.facebook.net; frame-src https://www.googletagmanager.com https://www.google.com https://dainese-cdn.thron.com https://*.hsforms.net https://*.hsforms.com https://*.hubspot.com https://*.hubspotvideo.com https://*.hs-sites.com https://*.hs-sites-na2.com https://www.facebook.com; frame-ancestors 'none'; form-action 'self' https://forms.hsforms.com https://*.hsforms.com https://www.facebook.com; media-src 'self' blob: https://res.cloudinary.com https://*.public.blob.vercel-storage.com https://dainese-cdn.thron.com https://blog.dainesejapan.com; worker-src 'self' blob:; base-uri 'self'Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsDENYControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=63072000; includeSubDomains; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policycamera=(), microphone=(), geolocation=()Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlpublic, max-age=0, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-byNext.jsShould be removed. Reveals server technology to attackers.
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — Next.js
Recommendation: Should be removed. Reveals server technology to attackers.
Header 'x-powered-by' has potentially insecure value: Next.js
Recommendation: Review and fix this security issue