HTTPS Enabled
content-security-policyform-action 'self' *.tamgrt.com *.visa.com *.verifiedbyvisa.com *.mastercard.com *.americanexpress.com *.amexsecure.com *.amex.com *.dinersclub.com *.sparkasse.de *.s-id-check.de *.netcetera.com *.six-group.com *.viseca.ch *.cardinalcommerce.com *.modirum.com *.arcot.com *.ca.com *.datatrans.com *.datatrans.ch *.payone.com *.payone.de *.stripe.com *.gpe.cz *.infinitium.com *.thalesgroup.com *.bs-card-service.com *.paymenttools.net *.contentful.com; frame-ancestors 'self' dertouristik.experiencecloud.adobe.com experience.adobe.com *.contentstack.com; frame-src 'self' *.ypsilon.net *.usercentrics.eu *.adfarm1.adition.com *.doubleclick.net track.adform.net *.adup-tech.com *.recaptcha.net *.googletagservices.com *.googletagmanager.com *.dwcdn.net *.google.com *.gstatic.com *.googlesyndication.com *.adtrafficquality.google *.zdassets.com *.pinterest.com *.tamgrt.com *.holidaycheck.com *.trivago.com *.demdex.net *.criteo.com static.criteo.net *.azureedge.net *.cloudfront.net *.lovable.app my.matterport.com *.yumpu.com *.spotify.com *.youtube-nocookie.com *.thinglink.com dertour-termin.de its-termin.de meiers-weltreisen-termin.de *.youtube.com *.adobedtm.com *.googleadservices.com *.dertour.de *.meiers-weltreisen.de *.its.de *.helvetictours.ch *.trusted-travel-id.com *.dertour-group.com *.adition.com *.bing.com *.smartseer.com aswpapieu.com beacon.sojern.com browser-intake-datadoghq.eu cdn.adsdefender.com *.behamics.com *.teads.tv *.facebook.net *.hello-charles.com *.omtrdc.net eu-assets.contentstack.com *.googleapis.com *.awin1.com *.google-analytics.com pinimg.com static.tacdn.com the.sciencebehindecommerce.com *.awinblackfriday.com *.wepowerconnections.com *.dto.rocks *.dertour.rocks *.dwcdn.net *.opinionstage.com *.contentful.com forms.office.com *.zendesk.com *.visa.com *.verifiedbyvisa.com *.mastercard.com *.americanexpress.com *.amexsecure.com *.discover.com *.dinersclub.com *.jcb.co.jp *.unionpaysecure.com *.gpe.cz *.infinitium.com *.netcetera.com *.thalesgroup.com *.datatrans.com *.pci-proxy.com *.bs-card-service.com *.payone.com *.paymenttools.net; connect-src 'self' *.usercentrics.eu *.adition.com track.adform.net *.adup-tech.com *.doubleclick.net *.googlesyndication.com *.googleadservices.com *.googletagservices.com *.googletagmanager.com *.google.com *.googleapis.com *.gstatic.com *.adtrafficquality.google *.zdassets.com *.aswpapieu.com *.omtrdc.net *.behamics.com *.smartseer.com *.pinterest.com *.demdex.net *.adobedtm.com *.cloudfront.net *.azureedge.net gum.criteo.com static.criteo.net beacon.sojern.com browser-intake-datadoghq.eu cdn.adsdefender.com *.teads.tv *.facebook.net *.hello-charles.com *.contentstack.com *.google-analytics.com *.pinimg.com static.tacdn.com *.holidaycheck.com *.trivago.com my.matterport.com *.yumpu.com *.dto.rocks *.dertour.rocks *.bing.com *.bing.net forms.office.com *.zendesk.com *.dertour.de *.meiers-weltreisen.de *.its.de *.helvetictours.ch *.trusted-travel-id.com *.dertour-group.com dertour-termin.de its-termin.de meiers-weltreisen-termin.de helvetictours-termin.ch *.instagram.com *.spotify.com *.twitter.com *.opinionstage.com wss://*.behamics.com *.datatrans.com *.pci-proxy.com *.bs-card-service.com *.payone.com *.paymenttools.net *.data.microsoft.com *.hotjar.io dtch-contenthub.azurewebsites.net dtch-tailormade-offer-prod.azurewebsites.net *.contentful.com *.getback.ch *.creativecdn.com *.segmentstream.com aswpapieu.com *.lovable.app *.dwcdn.net *.amazonaws.com *.holibob.tech *.awswaf.com; report-to csp-endpointControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGINControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=31536000; includeSubDomains; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policystrict-origin-when-cross-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlprivate, no-cache, no-store, max-age=0, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-by""Should be removed. Reveals server technology to attackers.
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — ""
Recommendation: Should be removed. Reveals server technology to attackers.
Header 'x-powered-by' has potentially insecure value: ""
Recommendation: Review and fix this security issue