HTTPS Enabled
content-security-policydefault-src 'self' https://static.zdassets.com https://ekr.zdassets.com https://digitaliceland.zendesk.com https://*.zopim.com wss://*.zendesk.com wss://*.zopim.com https://*.s3.eu-west-1.amazonaws.com; img-src 'self' blob: https://island.is data: https://images.ctfassets.net https://boost-files-general-eu-west-1-prod.s3-eu-west-1.amazonaws.com https://i.vimeocdn.com https://files.reglugerd.is https://island-is-dev-upload-api.s3.eu-west-1.amazonaws.com https://island-is-staging-upload-api.s3.eu-west-1.amazonaws.com https://island-is-prod-upload-api.s3.eu-west-1.amazonaws.com https://v2assets.zopim.io https://static.zdassets.com https://cdn.livechatinc.com https://cdn.livechat-static.com/api/file/lc/img/rich-greetings/handwave.gif https://xpex.orri.is/ords/oebs/logo/ https://adverts.official-journal.dev.dmr-dev.cloud https://*.mypurecloud.de https://*.euc1.pure.cloud https://adverts.stjornartidindi.is https://www.skra.is/library/Myndir/formio/ https://*.zendesk.com https://gravatar.com; media-src 'self' data: https://videos.ctfassets.net https://cdn.livechatinc.com https://webapi.hugverk.is https://*.mypurecloud.de https://*.euc1.pure.cloud; script-src 'self' 'unsafe-eval' 'nonce-BvI33L4qtwUI6J3PA+lC/A==' https://*.list-manage.com https://plausible.io https://*.readspeaker.com https://*.boost.ai https://cdnjs.cloudflare.com https://*.livechatinc.com https://*.zopim.com https://*.statuspage.io https://*.valitor.com https://*.mypurecloud.de https://*.nr-data.net https://*.newrelic.com https://*.euc1.pure.cloud http://static.zdassets.com https://*.zendesk.com https://applepay.cdn-apple.com https://matomo.island.is/matomo.js https://islandis.matomo.cloud/matomo.js; style-src 'self' 'unsafe-inline' https://*.boost.ai https://*.readspeaker.com https://cdnjs.cloudflare.com; child-src 'self' https://*.mypurecloud.de https://*.euc1.pure.cloud; manifest-src 'self' https://*.devland.is; object-src https://*.mypurecloud.de https://*.euc1.pure.cloud; frame-ancestors https://*.devland.is https://*.island.is https://island.is https://app.contentful.com https://compose.contentful.com; frame-src blob: https://*.devland.is https://*.island.is https://*.dropandsign.is https://fill.taktikal.is https://island.is https://www.youtube.com https://www.youtube-nocookie.com https://*.vimeo.com https://secure.livechatinc.com https://*.statuspage.io https://app.powerbi.com https://secure-fra.livechatinc.com https://featureupvote.com https://islandis.featureupvote.com https://e.infogram.com https://*.valitor.com https://apps.mypurecloud.de https://applepay.cdn-apple.com https://portal.land.is https://www.facebook.com/plugins/video.php https://beta.dev01.devland.is/* https://beta.staging01.devland.is/* https://island.is/* https://solmyrkvi2026.is/ https://eclipse2026.is/; connect-src 'self' https://*.sveitarfelog.net https://assets.ctfassets.net https://*.sentry.io https://*.island.is https://*.devland.is https://*.configcat.com https://plausible.io https://s3.eu-west-1.amazonaws.com https://*.boost.ai https://*.readspeaker.com https://browser-intake-datadoghq.eu https://rum-http-intake.logs.datadoghq.eu wss://*.zopim.com https://*.statuspage.io https://api.livechatinc.com https://status.sjukra.is https://api-fra.livechatinc.com https://id.zopim.com/authenticated/web/jwt https://rum.browser-intake-datadoghq.eu https://files.reglugerd.is https://*.s3.eu-west-1.amazonaws.com https://*.greynir.is https://*.mypurecloud.de https://*.nr-data.net https://shyrka-prod-euc1.s3.eu-central-1.amazonaws.com https://*.newrelic.com https://*.euc1.pure.cloud wss://*.mypurecloud.de wss://*.euc1.pure.cloud http://ekr.zdassets.com https://*.zendesk.com wss://*.zendesk.com https://paymentrelayservice.apple.com https://islandis.matomo.cloud/matomo.js https://islandis.matomo.cloud; worker-src 'self' blob:; font-src 'self' data: https://fonts.gstatic.com https://cdn.livechatinc.com https://applepay.cdn-apple.comControls resources the browser can load. Prevents XSS.
x-content-type-optionsnosniffPrevents MIME type sniffing. Should be 'nosniff'.
x-frame-optionsControls framing. Use CSP frame-ancestors instead.
strict-transport-securitymax-age=63072000; includeSubdomains; preloadForces HTTPS. Recommended: max-age=31536000; includeSubDomains
referrer-policysame-originControls referrer info. Recommended: strict-origin-when-cross-origin
permissions-policyinterest-cohort=()Controls browser features. Recommended: camera=(), microphone=(), geolocation=()
cross-origin-opener-policyControls cross-origin window access. Recommended: same-origin
cross-origin-resource-policyControls cross-origin resource access. Recommended: same-origin
cross-origin-embedder-policyControls cross-origin embedding. Recommended: require-corp
cache-controls-maxage=15, stale-while-revalidate=150, publicCaching policy. Use no-store/private for sensitive pages.
x-powered-byNext.jsShould be removed. Reveals server technology to attackers.
Missing: x-frame-options
Recommendation: Controls framing. Use CSP frame-ancestors instead.
Missing: cross-origin-opener-policy
Recommendation: Controls cross-origin window access. Recommended: same-origin
Missing: cross-origin-resource-policy
Recommendation: Controls cross-origin resource access. Recommended: same-origin
Missing: cross-origin-embedder-policy
Recommendation: Controls cross-origin embedding. Recommended: require-corp
Exposed: x-powered-by — Next.js
Recommendation: Should be removed. Reveals server technology to attackers.
Header 'x-powered-by' has potentially insecure value: Next.js
Recommendation: Review and fix this security issue