HTTPS Enabled
content-security-policyscript-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.payments-amazon.com *.ccm19.de *.sitesearch360.com *.doubleclick.net *.etracker.com *.etracker.de *.facebook.net *.flockler.com *.instagram.com *.google.com *.googletagmanager.com *.googleapis.com *.gstatic.com *.google-analytics.com *.googleapis.com *.bing.com *.hotjar.com *.clarity.ms *.trustedshops.com *.etrusted.com *.hatraco.net *.hatraco-shop.de *.criteo.com js.klarna.com cdn.jsdelivr.net; frame-ancestors 'self' *.etracker.com euroweinkontor.de; worker-src blob: 'self';Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomainsForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policygeolocation=(self),sync-xhr=(self),microphone=(),camera=(),fullscreen=(self),payment=(self)Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policysame-origin-allow-popupsControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlno-storeCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: x-frame-options
Recommendation: Controls framing. Use CSP frame-ancestors instead.
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp