HTTPS Enabled
content-security-policydefault-src 'self';script-src 'self' 'unsafe-eval' 'nonce-6fe9968fc8ad7e68ab73105cdf9de70e' 'nonce-8cf34430e476b937d0e252ec5d194e4b' 'nonce-16d2ff6fce6717c639bf521b7ea54984' 'nonce-84ffa2d310877df095582757c90348f3' 'nonce-215a7a34fde11a34264b5489b06d8753' 'nonce-9ab7e8aee21da6758de9a87dade5db18' 'nonce-9664e2c0e00c311a953e154c2f9ea91c' 'nonce-ccbd746a2669cc1807831c3964c84706' 'nonce-d11c06e2b53d76f169aa9d7b160550ac' 'nonce-13b43cece3d1b192d1ff2d16fd2a9b5a' 'nonce-7d99e3e5e1d21c75aebcd7bca1d366b7' 'nonce-71a3d05a4d8ac0045a04556ecfd765e0' 'nonce-537a91ee9b154dff725bf05edd29689d' 'nonce-dd9e2f2f428520852aadb7cd6f6baaaf' 'nonce-1cf273d2c5ec37dc7a8d4fa646122495' 'nonce-2948e637c1a26fde13d4d73f57e5794b' 'nonce-e31215249a2fa04815738b17479507ca' 'nonce-d16204555ab3622b0fab61f91c5753c0' 'nonce-2ed48668ba5a5c4aeee2061e330872fc' 'nonce-d1e3336402d3e3091132469b52eeb45a' 'nonce-f5103d819cdf4e7a4a1adfc4bab5658e' 'nonce-54917a541616b07c0df3bd40c52e6e3a' 'nonce-25b669ace224d43282806d6c2a7579a3' 'nonce-93b2f2fdd8422db9b3d493893dda8db8' 'nonce-91a34539bc37462dcdfb8a8d10ffde31' 'nonce-4a301d7ed470a4c13d8bfd6659702620' 'nonce-d861eb116afb3f72e4883b0546316fc0' 'nonce-b1ce787dd591d173cfc9ffd5c1fd8766' 'nonce-8d9d2f3466caa078e8037bca26e9521b' 'nonce-01e7eb413dea1e4c594f6a5b345f4370' 'nonce-563050b64ed45cfa3b37456c755ff48e' 'nonce-e4f0bc557b0ad2cc42831473eef68cdc' 'nonce-f203042c921f98438b34e4470cc41adf' 'nonce-79c5d6d76c297c1c8edc5b51a7bcf0c6' 'nonce-af30ffa4d40baed76a0440cbca66fb82' 'nonce-2d086e85fab5dceecb6074ee0e070931' 'nonce-3161464f8aefdb784acb7d56c889818c' 'nonce-ad22fb6dc0f070cca6bc820d51ffaee9' 'nonce-3afd397014f7019dbc1499cbd780b64f' 'nonce-b0c25c3c936ccc8904c9422a3879cd76' 'nonce-562de0cbce619e4d462c58d389da62af' 'nonce-c153becc07a3d20870ef778d495eb6d4' 'nonce-90bb04cd3ace4693e7dda03c630329f2' 'nonce-bebe62955ef88b7b8cb77fb79256c9db' 'nonce-8872edd2493c990e0d48f48a47da013f' 'nonce-3026b4ea6a0f586d09bf3d8d8f0eb154' widget.join.com cdn-widgetv2.join.com gem-stats.de join.com cdn.join.com app.cituro.com google.com maps.googleapis.com developers.google.com ajax.googleapis.com widgets.trustedshops.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com cdn.logwork.com global.frcapi.com cdn.mouseflow.com api.leadinfo.com cdn.ldnfrpl.com sibforms.com sibautomation.com cdn.by.wonderpush.com www.googletagmanager.com *.googlesyndication.com 'sha256-jKKO0Sb2ZRrN6u86cOSFU0N8fNjHoKczd3BvaFAWm9U=';img-src 'self' 'unsafe-inline' data: join.com cdn.join.com app.cituro.com maps.gstatic.com maps.googleapis.com ajax.googleapis.com media.geiger-edelmetalle.de widgets.trustedshops.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com *.zakeke.com *.googlesyndication.com fonts.gstatic.com www.googletagmanager.com blob:;style-src 'self' 'unsafe-inline' fonts.googleapis.com join.com cdn.join.com app.cituro.com use.fontawesome.com ajax.googleapis.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com sibforms.com www.googletagmanager.com;font-src 'self' fonts.gstatic.com cdn.cituro.com app.cituro.com play.google.com use.fontawesome.com ajax.googleapis.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com assets.brevo.com ;frame-src 'self' www.youtube-nocookie.com app.cituro.com google.com youtube.com ajax.googleapis.com www.google.com connect.facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com logwork.com global.frcapi.com *.zakeke.com;connect-src 'self' cdn.join.com join.com gem-stats.de app.cituro.com google.com maps.googleapis.com *.trustedshops.com *.etrusted.com *.trustbadge.com ajax.googleapis.com facebook.net graph.facebook.com www.facebook.com analytics.tiktok.com api.friendlycaptcha.com widget.join.com logwork.com *.mouseflow.com api.leadinfo.com zakeke-shopware.azurewebsites.net *.zakeke.com *.sibforms.com *.brevo.com *.wonderpush.com *.googlesyndication.com *.googletagmanager.com;frame-ancestors 'none';worker-src blob:;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsdenyControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=600; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyno-referrer-when-downgradeControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlno-cache, privateCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
HSTS max-age is too low: 600 seconds (recommended: >= 31536000)
Recommendation: Review and fix this security issue