HTTPS Enabled
content-security-policydefault-src 'self'; font-src * 'self' 'unsafe-eval' 'unsafe-inline' data: *.gstatic.com *.vercel.app *.here.com *.googleapis.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' *.webforms-here.com *.marketo.net *.marketo.com marketo.com vercel.live cdn.jsdelivr.net *.googletagmanager.com *.vimeo.com vimeo.com *.youtube.com *.vidyard.com vidyard.com youtu.be *.akamaized.net *.tiqcdn.com *.bizible.com *.contently.com *.d41.co *.tealiumiq.com *.doubleclick.net *.ytimg.com *.ipdata.co *.here.com *.vercel.app *.onrecruit.net *.ads.linkedin.com *.omniconvert.com *.newrelic.com *.cloudflare.com *.vercel-scripts.com *.bing.com https://bzrcdn.openai.com; style-src 'self' 'unsafe-inline' *.here.com *.marketo.com *.googleapis.com; connect-src 'self' *.d41.co *.google.com *.contently.com *.tealiumiq.com *.mktoresp.com *.ipdata.co *.hereapi.com blob: *.here.com *.demdex.net *.marketo.net ipapi.co *.vercel.app *.doubleclick.net *.linkedin.com *.omniconvert.com *.nr-data.net *.api.here.com *.hereapi.com *.algolia.net *.algolianet.com *.algolia.io *.mktoutil.com https://bzr.openai.com https://bzrcdn.openai.com; img-src * 'self' blob: data: https://bzr.openai.com; frame-ancestors 'self' website.webforms-here.com app.contentful.com; worker-src 'self' 'unsafe-eval' blob:; child-src 'none'; object-src 'none'; frame-src 'self' *.webforms-here.com *.marketo.com *.marketo.net vercel.live *.googletagmanager.com *.vimeo.com vimeo.com *.youtube.com youtube.com youtu.be *.akamaized.net *.vidyard.com *.tags.tiqcdn.com *.contently.com *.doubleclick.net *.fls.doubleclick.net *.here.com flo.uri.sh *.flourish.studio javascript-apis.vercel.app here-rest-apis.vercel.app hxp-here-fleet-calculator.vercel.app *.widen.net *.kaltura.com here-legal-data-subject-request-for.vercel.app here-legal-wifi-optout-form.vercel.app;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGINControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=63072000; includeSubDomains; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlpublic, max-age=0, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-byNext.jsShould be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — Next.js
Recommendation: Should be removed. Reveals server technology to attackers.
Header 'x-powered-by' has potentially insecure value: Next.js
Recommendation: Review and fix this security issue