HTTPS Enabled
content-security-policyscript-src 'self' 'unsafe-eval' 'unsafe-inline' *.ebay.com *.ebay.co.uk *.ebaystatic.com *.ebaystatic.cn blob: data: *.googletagmanager.com *.googleadservices.com *.ebayrtm.com *.paypal.com *.ebay-us.com *.facebook.net *.pinterest.com *.doubleclick.net *.criteo.com www.googletagmanager.com *.pinimg.com sc-static.net *.snapchat.com *.google.com *.google-analytics.com fidoapi.com *.bytegoofy.com *.cloudflare.com *.akamaihd.net *.tiqcdn.com *.googleapis.com *.ebaystatic.cn *.hcaptcha.com www.redditstatic.com www.gstatic.com; upgrade-insecure-requests; frame-ancestors 'self' *.ebay.com *.ebay.co.uk; img-src 'self' https://* data: blob:; default-src 'self' 'unsafe-inline' blob: data: wss: mediastream: *.ebay.com *.ebay.co.uk *.ebaystatic.com *.ebaystatic.cn *.ebayimg.com *.google.com *.ebayrtm.com ebay-prd.rest-ar.com *.ebaycdn.net *.gstatic.com *.paypal.com *.googleapis.com *.fontawesome.com *.facebook.com *.ucweb.com *.pinterest.com *.adsrvr.org *.criteo.com *.criteo.net www.googletagmanager.com *.snapchat.com *.akamaihd.net *.cloudflare.com *.fidoapi.com www.google-analytics.com sc-static.net www.seebay.co.uk *.frooition.com www.ebayadservices.com *.bootstrapcdn.com *.auctiva.com www.shoppissimoweb.com *.inkfrog.com www.dpaebay.co.uk dezign2web.com *.hcaptcha.com *.tiqcdn.com *.yahoo.com *.suredone.com *.hilzweb.com *.dezign2web.com *.doubleclick.net *.glance.net track.uc.cn *.bing.com google.com *.graphitevault.com *.amplitude.com *.google-analytics.com www.googleadservices.com *.perfdrive.com wss://127.0.0.1:* *.reddit.com www.redditstatic.com *.googletagmanager.com cas.avalon.perfdrive.com *.facebook.net www.gstatic.com; report-uri https://monitor.ebay.com/csp-report/storenode/storesweb?id=5729198175300831429&rid=t6pqiufkicffiiw%3F%3Ctwjtbmjbb%60jhs.323%3B101g00*w%60ut4%3C%2Bwyuaw-19fd8ea4165-0x1205#pdControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000Forces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: x-frame-options
Recommendation: Controls framing. Use CSP frame-ancestors instead.
Missing: referrer-policy
Recommendation: Controls referrer info. Recommended: strict-origin-when-cross-origin
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Missing: cache-control
Recommendation: Caching policy. Use no-store/private for sensitive pages.
Missing recommended header: referrer-policy
Recommendation: Review and fix this security issue