HTTPS Enabled
content-security-policydefault-src 'self' static.ethosapp.com ; script-src 'self' 'unsafe-inline' cdn-cookieyes.com https://salesiq.zoho.com *.zohocdn.com js.zohostatic.com www.googletagmanager.com https://www.google-analytics.com https://googleads.g.doubleclick.net www.googleadservices.com/ maps.googleapis.com https://apis.google.com *.firebaseio.com static.ethosapp.com https://bat.bing.com https://www.clarity.ms https://scripts.clarity.ms https://app.frase.io;img-src 'self' https://c.bing.com https://bat.bing.com https://c.clarity.ms salesiq.zohopublic.com css.zohocdn.com https://www.google.co.in https://secure.gravatar.com https://*.gstatic.com https://googleads.g.doubleclick.net https://www.google-analytics.com https://www.google.com maps.googleapis.com cdn-cookieyes.com static.ethosapp.com firebasestorage.googleapis.com d2fn9jhnxq0bpv.cloudfront.net storage.googleapis.com data: blob: googletagmanager.com https://*.zohopublic.com https://www.googletagmanager.com https://www.google.co.uk https://static.zohocdn.com https://www.google.it ; media-src 'self' static.zohocdn.com d2fn9jhnxq0bpv.cloudfront.net static.ethosapp.com firebasestorage.googleapis.com storage.googleapis.com blob: data:; frame-src 'self' css.zohocdn.com https://bid.g.doubleclick.net firebaseio.com *.firebaseio.com *.firebaseapp.com https://www.youtube.com https://salesiq.zohopublic.com https://shortcut.wochit.com https://www.googletagmanager.com https://td.doubleclick.net; font-src 'self' css.zohocdn.com static.ethosapp.com https://fonts.gstatic.com https://css.zohostatic.com https://static.zohocdn.com; connect-src 'self' https: ws: wss: *.firebaseio.com *.googleapis.com google-analytics.com googletagmanager.com googleadservices.com googleads.g.doubleclick.net https://*.gstatic.com blob:; object-src 'none'; style-src 'self' 'unsafe-inline' css.zohocdn.com css.zohostatic.com https://fonts.googleapis.com static.ethosapp.com https://static.zohocdn.com;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsDENYControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=63072000; includeSubdomains; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlmax-age=3600Caching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp