HTTPS Enabled
content-security-policydefault-src 'self' 'unsafe-eval' 'unsafe-hashes' 'unsafe-inline' data: blob: www.google.com.gt www.google.co.in www.google.com.my *.googleapis.com secure.payco.co www.mercadopago.com.co *.apps.mypurecloud.com wss://hdndukmu7i.execute-api.us-east-1.amazonaws.com gateway2.tucompra.com.co www.google.co.cr www.google.ca www.google.co.uk www.acueducto.com.co www.google.com.qa www.google.com.mt *.davivienda.com *.tiktok.com nuevaversion.bbvanet.com.co *.doubleclick.net secure-short.payv.co api.kushkipagos.com api.transmitsecurity.io www.alkosto.com www.google.com.pa colvdox7cg.execute-api.us-east-1.amazonaws.com websdk.appsflyer.com api.wompi.co www.google.no *.facebook.net 1.b406929acabac9b095f124c81bdfcf57f.com apm.safecharge.com *.dynatrace.com www.google.com.co www.google.com.kw ponos.zeronaught.com www.google.fi www.google.pt www.google.co.ve wss://*.api-vivi-ws.davivienda.com www.google.it cm.teads.tv *.youtube.com www.despegar.com 1.c81358859121583b7adf2ace89cb39f44.com *.despegar.com.co www.google.com.sa www.google.com.bo platform-websdk.transmitsecurity.io www.google.co.jp 1.a79ab95c1589a13f8a4cab612bc71f9f7.com www.google.si *.onelink.me *.cloudfront.net www.google.com.uy www.google.nl www.google.com.sv t.teads.tv *.google.com account.yajuego.co apps.mypurecloud.com www.google.at analytics-ipv6.tiktokw.us wa.appsflyersdk.com www.google.de www.google.cl www.google.co.nz www.mercadopago.com p.teads.tv tags.bkrtx.com www.google.co.il checkout.placetopay.com l.teads.tv cdnjs.cloudflare.com www.google.com.au www.google.es www.google.pl www.google.com.do api.openpay.co *.eloqua.com *.botframework.com www.google.fr wa.appsflyer.com *.googlesyndication.com *.googleadservices.com cobrowse.mypurecloud.com *.nr-data.net www.google.com.sg www.google.ie www.google-analytics.com www.google.co.kr www.google.ru www.google.be www.google.com.mx www.google.com.vn www.google.cz www.google.com.ec *.jsdelivr.net region1.google-analytics.com static.cloudflareinsights.com www.google.com.br *.dvvapps.io www.google.com.pe www.google.hn js-agent.newrelic.com callback.payulatam.com www.google.ae www.google.com.ar www.google.ch *.gstatic.com *.googletagmanager.com *.facebook.com; frame-ancestors 'self' *.davivienda.com *.youtube.com; connect-src 'self' wss://api-vivi-ws.davivienda.com wss://hdndukmu7i.execute-api.us-east-1.amazonaws.com colvdox7cg.execute-api.us-east-1.amazonaws.com https://www.google-analytics.com *.teads.tv *.appsflyersdk.com *.google.com *.tiktok.com *.davivienda.com *.onelink.me *.doubleclick.net *.tiktokw.us *.transmitsecurity.ioControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomainsForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlprivate, no-cache, no-store, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: x-frame-options
Recommendation: Controls framing. Use CSP frame-ancestors instead.
Missing: referrer-policy
Recommendation: Controls referrer info. Recommended: strict-origin-when-cross-origin
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Missing recommended header: referrer-policy
Recommendation: Review and fix this security issue