HTTPS Enabled
content-security-policychild-src 'self' blob: ; connect-src 'self' data: wss: *.bynder.cloud *.unwrap.ai *.salesforce.com *.jsdelivr.net *.yobi.ai *.paa-reporting-advertising.amazon *.cloudflare.com *.clarity.ms *.wwwincnews.com *.channeladvisor.com *.googleapis.com *.klarna.com *.sandbox.paypal.com *.doubleclick.net *.klarnacdn.net *.attentivemobile.com *.azurecontainerapps.io *.events.bouncex.net *.locally.com *.geolocation.onetrust.com *.surveystats.hotjar.io *.eu-1-id5-sync.com *.cloudflareinsights.com *.wolverine.com *.jtbcustom.com *.curalate.com *.rezync.com *.mediawallahscript *.pippio.com pippio.com *.dtstmio.com *.rtactivate.com *.rlcdn *.smartadserver.com *.taboola.com *.clmbtech.com *.3lift.com *.1rx.io *.hypemarks.com prf.hn *.demdex.net *.tpmn.co *.tremorhub.com *.tapad.com *.postrelease.com *.mediavine.com *.dmxleo.com *.afterpay.com *.usabilla.com *.cloudfront.net *.linksynergy.com *.scanalert.com *.google.co.uk *.yieldify.com *.hotjar.com *.googletagmanager.com *.igodigital.com sc-static.net *.redditstatic.com *.a3cloud.net *.facebook.net *.pinimg.com *.wknd.ai *.amazon-adsystem.com *.cookielaw.org *.contentsquare.net *.bing.com *.pinterest.com *.criteo.com *.pingdom.net *.yieldify-production.com *.cdnwidget.com *.cquotient.com *.adsrvr.org *.github.io *.googleadservices.com *.experticity.com *.userzoom.com *.youtube.com *.insiderdata360online.com insiderdata360online.com *.twitter.com *.rakuten.com *.rmp.rakuten.com *.snapchat.com *.bidswitch.net *.socdm.com *.casalemedia.com *.adingo.jp *.360yield.com *.rlcdn.com *.truefitcorp.com *.amazonaws.com *.bing.net *.fls.doubleclick.net *.bounceexchange.com hbiq.net unpkg.com *.yimg.com *.bazaarvoice.com *.bouncex.net *.safevisit.online *.agkn.com *.reddit.com *.demandware.net *.privacymanager.io *.paypalobjects.com *.salesforceliveagent.com *.isstarsbuilding.com *.online-metrix.net *.google.com *.google.co.in *.google.ro *.google-analytics.com *.googlesyndication.com *.onetrust.com *.paypal.com *.facebook.com *.tryzens-analytics.com *.drivecommerce.com *.omniconvert.com *.cdnbasket.net *.liadm.com *.tiktok.com *.wolverineworldwide.com *.postcodeanywhere.co.uk *.sentry.io *.hotjar.io *.salesforce-scrt.com *.klarnaevt.com *.klarnaservices.com *.saucony.com *.insiderdata360online *.ytimg.com *.turn.com *.gocertify.me *.tiktokw.us *.dashsocial.com *.unidays.io *.myunidays.com *.likeshop.me widget-api.stylitics.com datastream.stylitics.com widget-api-staging.stylitics.com datastream-staging.stylitics.com ; default-src 'self' ; font-src 'self' data: *.typekit.net *.gstatic.com *.klarna.com *.bazaarvoice.com *.hotjar.com *.fontawesome.com *.yieldify-production.com *.klarnacdn.net *.unidays.world *.saucony.com ; form-action 'self' client.cardinaltrusted.com webto.salesforce.com *.facebook.com *.pcipal.cloud *.cardinalcommerce.com *.pcipalstaging.cloud *.saucony.com wolverineworldwide--full.sandbox.my.salesforce.com ; frame-ancestors 'self' *.google.com ; frame-src 'self' client.cardinaltrusted.com gtm.saucony.com csxd.staging-na-wwwinc.demandware.net *.unwrap.ai *.cloudflare.com *.pcipal.cloud *.amazon-adsystem.com *.criteo.com *.saucony.com *.twitter.com *.force.com *.online-metrix.net *.google.com *.facebook.com *.klarna.com *.klarnacdn.net *.snapchat.com *.wolverine.com *.userzoom.com *.youtube.com *.rezync.com *.mediawallahscript *.pippio.com pippio.com *.dtstmio.com *.rlcdn *.smartadserver.com *.taboola.com *.clmbtech.com *.3lift.com *.1rx.io *.hypemarks.com prf.hn *.jsdelivr.net *.rtactivate.com *.demdex.net *.tpmn.co *.tremorhub.com *.tapad.com *.postrelease.com *.mediavine.com *.dmxleo.com *.afterpay.com *.usabilla.com *.cloudfront.net *.linksynergy.com *.scanalert.com *.google.co.uk *.cloudflareinsights.com *.yieldify.com *.hotjar.com *.googletagmanager.com *.igodigital.com sc-static.net *.redditstatic.com *.a3cloud.net *.facebook.net *.pinimg.com *.wknd.ai *.cookielaw.org *.contentsquare.net *.bing.com *.pinterest.com *.doubleclick.net *.pingdom.net *.yieldify-production.com *.cdnwidget.com *.cquotient.com *.adsrvr.org *.github.io *.googleadservices.com *.experticity.com *.clarity.ms *.rakuten.com *.rmp.rakuten.com *.paa-reporting-advertising.amazon *.bidswitch.net *.socdm.com *.casalemedia.com *.adingo.jp *.360yield.com *.rlcdn.com *.truefitcorp.com *.amazonaws.com *.bing.net *.sandbox.paypal.com *.fls.doubleclick.net *.bounceexchange.com hbiq.net *.paypalobjects.com *.paypal.com *.locally.com *.site.com *.cardinalcommerce.com *.pcipalstaging.cloud *.gocertify.me *.klarnaservices.com ; img-src 'self' data: sync.crwdcntrl.net *.amplience.net cdn.media.amplience.net *.adnxs.com *.tiktokw.us *.klarna.com *.fluctssp.smt.docomo.ne.jp *.locally.com *.userzoom.com *.youtube.com *.mediawallahscript.com *.googlesyndication.com *.rlcdn.com *.smartadserver.com *.taboola.com *.clmbtech.com *.3lift.com *.1rx.io *.bing.net *.clarity.ms *.dmxleo.com *.tpmn.co.kr thrtle.com *.lijit.com *.google.nl id5-sync.com *.twiago.com *.yieldlab.net *.googleadservices.com *.klarnacdn.net *.github.io *.twitter.com *.afterpay.com *.rezync.com *.rlcdn *.hypemarks.com prf.hn *.pippio.com pippio.com *.safevisit.online *.dtstmio.com *.rtactivate.com *.demdex.net *.tpmn.co *.tremorhub.com *.tapad.com *.postrelease.com *.mediavine.com *.usabilla.com *.cloudfront.net *.linksynergy.com *.scanalert.com *.google.co.uk *.cloudflareinsights.com *.yieldify.com *.hotjar.com *.googletagmanager.com *.igodigital.com sc-static.net *.redditstatic.com *.a3cloud.net *.facebook.net *.pinimg.com *.wknd.ai *.amazon-adsystem.com *.cookielaw.org *.contentsquare.net *.bing.com *.pinterest.com *.doubleclick.net *.criteo.com *.pingdom.net *.yieldify-production.com *.cdnwidget.com *.cquotient.com *.adsrvr.org *.experticity.com *.jsdelivr.net *.saucony.com *.rakuten.com *.rmp.rakuten.com *.insiderdata360online.com insiderdata360online.com *.snapchat.com *.paa-reporting-advertising.amazon *.bidswitch.net *.socdm.com *.casalemedia.com *.adingo.jp *.360yield.com *.truefitcorp.com *.amazonaws.com *.sandbox.paypal.com *.fls.doubleclick.net *.bounceexchange.com *.outbrain.com *.media.net *.yahoo.com *.turn.com arttrk.com *.scene7.com *.revcontent.com *.paypalobjects.com *.teads.tv *.go2cloud.org *.pixel-config.reddit.com *.idsync.rlcdn.com *.bouncex.net *.wolverineworldwide.com *.pubmatic.com *.rubiconproject.com *.isstarsbuilding.com *.yobi.ai *.demandware.net *.online-metrix.net *.google.com *.google.co.in *.google.ro *.googleapis.com *.gstatic.com *.paypal.com *.facebook.com *.bazaarvoice.com *.gocertify.me *.liadm.com *.agkn.com *.reddit.com *.maps.googleapis.com *.maps.gstatic.com *.insiderdata360online *.ytimg.com likeshop.me *.dashsocial.com *.unidays.world *.google.ie content.stylitics.com ; media-src 'self' blob: *.amazonaws.com *.wolverineworldwide.com ; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: app.contentsquare.com gtm.saucony.com *.unwrap.ai *.force.com *.cloudflare.com *.mountain.com *.locally.com *.safevisit.online *.redditstatic.com *.online-metrix.net *.datasteam.io *.privacymanager.io *.wwwincnews.com *.klarnacdn.net *.channeladvisor.com *.klarna.com *.googleapis.com *.sandbox.paypal.com *.doubleclick.net *.youtube.com *.attn.tv *.bounceexchange.com *.rezync.com *.mediawallahscript *.pippio.com *.dtstmio.com *.rtactivate.com *.demdex.net *.tpmn.co *.tremorhub.com *.tapad.com *.postrelease.com *.mediavine.com *.dmxleo.com *.afterpay.com *.usabilla.com *.cloudfront.net *.linksynergy.com *.scanalert.com *.google.co.uk *.cloudflareinsights.com *.yieldify.com *.hotjar.com *.googletagmanager.com *.igodigital.com sc-static.net *.a3cloud.net *.rlcdn *.taboola.com *.clmbtech.com *.3lift.com *.1rx.io *.hypemarks.com prf.hn *.jsdelivr.net *.facebook.net *.pinimg.com *.wknd.ai *.amazon-adsystem.com *.cookielaw.org *.contentsquare.net *.bing.com *.pinterest.com *.criteo.com *.pingdom.net *.yieldify-production.com *.cdnwidget.com *.cquotient.com *.github.io *.googleadservices.com *.experticity.com *.rmtag.com safevisit.online *.insiderdata360online.com insiderdata360online.com *.salesforce.com *.curalate.com *.twitter.com *.yimg.com *.userzoom.com *.clarity.ms *.rakuten.com *.rmp.rakuten.com *.snapchat.com *.paa-reporting-advertising.amazon *.bidswitch.net *.socdm.com *.casalemedia.com *.eu-1-id5-sync.com *.jtbcustom.com *.adingo.jp *.360yield.com *.rlcdn.com *.smartadserver.com *.truefitcorp.com *.amazonaws.com *.bing.net *.fls.doubleclick.net *.google.com *.salesforceliveagent.com *.google.co.in *.google.ro *.gstatic.com *.google-analytics.com *.googlesyndication.com *.isstarsbuilding.com *.yobi.ai *.paypal.com *.paypalobjects.com *.tiktok.com *.bazaarvoice.com *.tryzens-analytics.com *.facebook.com *.adsrvr.org *.omniconvert.com *.drivecommerce.com *.cdnbasket.net *.agkn.com *.liadm.com *.reddit.com *.sentry.io *.bouncex.net *.saucony.com *.pcapredict.com *.postcodeanywhere.co.uk *.gocertify.me *.wolverineworldwide.com *.site.com *.salesforce-scrt.com *.fontawesome.com *.googleoptimize.com *.demandware.net *.rkdms.com *.criteo.net *.klarnaservices.com *.insiderdata360online *.ytimg.com *.turn.com pippio.com unpkg.com hbiq.net *.myunidays.com *.dashsocial.com web-assets.stylitics.com ; style-src 'self' 'unsafe-inline' data: d6tizftlrpuof.cloudfront.net *.typekit.net *.force.com *.fontawesome.com *.typography.com *.snapchat.com *.truefitcorp.com *.rakuten.com *.klarna.com *.jsdelivr.net *.googleapis.com *.klarnacdn.net *.bounceexchange.com *.postcodeanywhere.co.uk *.gocertify.me *.site.com *.fonts.googleapis.com *.cloudflare.com unpkg.com *.cookielaw.org *.saucony.com web-assets.stylitics.com ;Controls resources the browser can load. Prevents XSS.
x-content-type-optionsPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsSAMEORIGINControls framing. Use CSP frame-ancestors instead.
strict-transport-securityForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policyControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyControls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controlno-cache, no-store, must-revalidateCaching policy. Use no-store/private for sensitive pages.
x-powered-byShould be removed. Reveals server technology to attackers.
Missing: x-content-type-options
Recommendation: Prevents MIME type sniffing. Should be 'nosniff'.
Missing: strict-transport-security
Recommendation: Forces HTTPS. Recommended: max-age=31536000; includeSubDomains
Missing: referrer-policy
Recommendation: Controls referrer info. Recommended: strict-origin-when-cross-origin
Missing: permissions-policy
Recommendation: Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Missing recommended header: x-content-type-options
Recommendation: Review and fix this security issue
Missing recommended header: strict-transport-security
Recommendation: Review and fix this security issue
Missing recommended header: referrer-policy
Recommendation: Review and fix this security issue