www.analytics.bestatterverband-niedersachsen.de Open in urlscan Pro
2a0b:fb00:9:0:91:230:22:166  Public Scan

URL: https://www.analytics.bestatterverband-niedersachsen.de/
Submission: On August 28 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2a0b:fb00:9:0:91:230:22:166, located in Germany and belongs to WEBHOSTER, DE. The main domain is www.analytics.bestatterverband-niedersachsen.de.
TLS certificate: Issued by R11 on August 26th 2024. Valid for: 3 months.
This is the only time www.analytics.bestatterverband-niedersachsen.de was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 2a0b:fb00:9:0... 200548 (WEBHOSTER)
11 1
Domain Requested by
11 www.analytics.bestatterverband-niedersachsen.de www.analytics.bestatterverband-niedersachsen.de
11 1

This site contains links to these domains. Also see Links.

Domain
matomo.org
Subject Issuer Validity Valid
idlytix.xyz
R11
2024-08-26 -
2024-11-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.analytics.bestatterverband-niedersachsen.de/
Frame ID: 510B962F59AC0654138E6AE642EED045
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Anmelden - Matomo

Page Statistics

11
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

913 kB
Transfer

3779 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.analytics.bestatterverband-niedersachsen.de/
213 KB
61 KB
Document
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10 PleskLin
Resource Hash
d7077f4da01e7e0a9858bad5f6488ee490a1b7250f93bdf7dfc9532735cd4cab
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Frame-Options sameorigin

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-store, must-revalidate
content-encoding
br
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
content-type
text/html; charset=utf-8
date
Wed, 28 Aug 2024 12:01:53 GMT
referrer-policy
same-origin
server
LiteSpeed
strict-transport-security
max-age=15768000; includeSubDomains
vary
Accept-Encoding,User-Agent
x-frame-options
sameorigin
x-matomo-request-id
43bac
x-powered-by
PHP/8.3.10 PleskLin
index.php
www.analytics.bestatterverband-niedersachsen.de/
471 KB
81 KB
Stylesheet
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getCss&cb=793800e65deee3b84c5c2cf775d3180f
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10, PleskLin
Resource Hash
6d239900c49af3fe52160e1dc0e8ef88e6b923542143f477bfcd6c3d0921f8d8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
content-encoding
gzip
referrer-policy
same-origin
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Tue, 27 Aug 2024 17:56:07 GMT
server
LiteSpeed
x-powered-by
PHP/8.3.10, PleskLin
vary
Accept-Encoding,User-Agent
x-matomo-request-id
03543
content-type
text/css;charset=UTF-8
cache-control
public, must-revalidate
content-disposition
inline; filename=asset_manager_global_css.css
content-length
82546
expires
Fri, 06 Dec 2024 12:01:53 GMT
index.php
www.analytics.bestatterverband-niedersachsen.de/
2 MB
451 KB
Script
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getCoreJs&cb=3344ee617f914fdb5c064ee93013354d
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10, PleskLin
Resource Hash
ef5109a3be38e66a3fb37b2c831ac73fe771c8464636825aad27bfd0c05e71c9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
content-encoding
gzip
referrer-policy
same-origin
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Tue, 27 Aug 2024 17:56:07 GMT
server
LiteSpeed
x-powered-by
PHP/8.3.10, PleskLin
vary
Accept-Encoding,User-Agent
x-matomo-request-id
8cb6b
content-type
application/javascript; charset=UTF-8
cache-control
public, must-revalidate
content-disposition
inline; filename=asset_manager_core_js.js
content-length
461351
expires
Fri, 06 Dec 2024 12:01:53 GMT
index.php
www.analytics.bestatterverband-niedersachsen.de/
61 B
524 B
Script
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getNonCoreJs&cb=3344ee617f914fdb5c064ee93013354d
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10, PleskLin
Resource Hash
4f841e840d2639dc99a144797be45227c84ecda01371cfb5436af5eedbbc5c82
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
content-encoding
gzip
referrer-policy
same-origin
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Tue, 27 Aug 2024 17:56:07 GMT
server
LiteSpeed
x-powered-by
PHP/8.3.10, PleskLin
vary
Accept-Encoding,User-Agent
x-matomo-request-id
04f9a
content-type
application/javascript; charset=UTF-8
cache-control
public, must-revalidate
content-disposition
inline; filename=asset_manager_non_core_js.js
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
81
expires
Fri, 06 Dec 2024 12:01:53 GMT
index.php
www.analytics.bestatterverband-niedersachsen.de/
444 KB
99 KB
Script
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getUmdJs&chunk=0&cb=3344ee617f914fdb5c064ee93013354d
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10, PleskLin
Resource Hash
5cd45d5771dbdc2235455c4bfa85a06e5dda925d4d72b7aa8ee34ef031dbda9b
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
content-encoding
gzip
referrer-policy
same-origin
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Tue, 27 Aug 2024 17:56:07 GMT
server
LiteSpeed
x-powered-by
PHP/8.3.10, PleskLin
vary
Accept-Encoding,User-Agent
x-matomo-request-id
1666a
content-type
application/javascript; charset=UTF-8
cache-control
public, must-revalidate
content-disposition
inline; filename=asset_manager_chunk.0.js
content-length
101375
expires
Fri, 06 Dec 2024 12:01:53 GMT
index.php
www.analytics.bestatterverband-niedersachsen.de/
465 KB
85 KB
Script
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getUmdJs&chunk=1&cb=3344ee617f914fdb5c064ee93013354d
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10, PleskLin
Resource Hash
624ff4e754c2b0f7d83c240bd3db93d20a7da9d6a610db1ac7a64da2a80b702f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
content-encoding
gzip
referrer-policy
same-origin
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Tue, 27 Aug 2024 17:56:07 GMT
server
LiteSpeed
x-powered-by
PHP/8.3.10, PleskLin
vary
Accept-Encoding,User-Agent
x-matomo-request-id
40cac
content-type
application/javascript; charset=UTF-8
cache-control
public, must-revalidate
content-disposition
inline; filename=asset_manager_chunk.1.js
content-length
86683
expires
Fri, 06 Dec 2024 12:01:53 GMT
index.php
www.analytics.bestatterverband-niedersachsen.de/
573 KB
101 KB
Script
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getUmdJs&chunk=2&cb=3344ee617f914fdb5c064ee93013354d
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PHP/8.3.10, PleskLin
Resource Hash
ae67f079f21c5b0460a621332c793506231dfcbd1e63205e43780f6e80102eac
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
content-encoding
gzip
referrer-policy
same-origin
strict-transport-security
max-age=15768000; includeSubDomains
last-modified
Tue, 27 Aug 2024 17:56:07 GMT
server
LiteSpeed
x-powered-by
PHP/8.3.10, PleskLin
vary
Accept-Encoding,User-Agent
x-matomo-request-id
9a2af
content-type
application/javascript; charset=UTF-8
cache-control
public, must-revalidate
content-disposition
inline; filename=asset_manager_chunk.2.js
content-length
103022
expires
Fri, 06 Dec 2024 12:01:53 GMT
logo-header.png
www.analytics.bestatterverband-niedersachsen.de/misc/user/
17 KB
17 KB
Image
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/misc/user/logo-header.png?matomo
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PleskLin
Resource Hash
05f9ac3c3a8eca5abafbc4f89e9815657747d1885807f3c5173435869467416c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
strict-transport-security
max-age=15768000; includeSubDomains
referrer-policy
same-origin
last-modified
Wed, 26 May 2021 09:13:49 GMT
server
LiteSpeed
etag
"426a-60ae114d-30b6b3b028022b65;;;"
x-powered-by
PleskLin
vary
User-Agent
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
17002
expires
Wed, 04 Sep 2024 12:01:53 GMT
loading-blue.gif
www.analytics.bestatterverband-niedersachsen.de/plugins/Morpheus/images/
723 B
850 B
Image
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/plugins/Morpheus/images/loading-blue.gif
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PleskLin
Resource Hash
c266039bad40412ed4f64d9d8cf1393b08214d22d91b9b4f034ffb6ab280ce20
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
strict-transport-security
max-age=15768000; includeSubDomains
referrer-policy
same-origin
last-modified
Tue, 27 Aug 2024 17:55:53 GMT
server
LiteSpeed
etag
"2d3-66ce1329-5f0fcbfb29118581;;;"
x-powered-by
PleskLin
vary
User-Agent
content-type
image/gif
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
723
expires
Wed, 04 Sep 2024 12:01:53 GMT
matomo.woff2
www.analytics.bestatterverband-niedersachsen.de/plugins/Morpheus/fonts/
16 KB
16 KB
Font
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/plugins/Morpheus/fonts/matomo.woff2?m6crfo
Requested by
Host: www.analytics.bestatterverband-niedersachsen.de
URL: https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getCss&cb=793800e65deee3b84c5c2cf775d3180f
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PleskLin
Resource Hash
eade9621626e0fef3d8e2ffb465a7d7f90fe75c9433dc05d0d5aca2ae14422d9
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/index.php?module=Proxy&action=getCss&cb=793800e65deee3b84c5c2cf775d3180f
Origin
https://www.analytics.bestatterverband-niedersachsen.de
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:53 GMT
strict-transport-security
max-age=15768000; includeSubDomains
referrer-policy
same-origin
last-modified
Tue, 27 Aug 2024 17:55:52 GMT
server
LiteSpeed
etag
"4044-66ce1328-5c3ff3533737bce;;;"
x-powered-by
PleskLin
vary
User-Agent
content-type
font/woff2
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
16452
expires
Wed, 04 Sep 2024 12:01:53 GMT
favicon.png
www.analytics.bestatterverband-niedersachsen.de/misc/user/
1 KB
1 KB
Other
General
Full URL
https://www.analytics.bestatterverband-niedersachsen.de/misc/user/favicon.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a0b:fb00:9:0:91:230:22:166 , Germany, ASN200548 (WEBHOSTER, DE),
Reverse DNS
Software
LiteSpeed / PleskLin
Resource Hash
a3fc328e897b662df49b890f6701868f0ba3cb13645015b4d6f95206496cecaa
Security Headers
Name Value
Strict-Transport-Security max-age=15768000; includeSubDomains

Request headers

Referer
https://www.analytics.bestatterverband-niedersachsen.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Wed, 28 Aug 2024 12:01:55 GMT
strict-transport-security
max-age=15768000; includeSubDomains
referrer-policy
same-origin
last-modified
Tue, 04 Aug 2020 10:48:21 GMT
server
LiteSpeed
etag
"4b1-5f293cf5-76875da7f1321df3;;;"
x-powered-by
PleskLin
vary
User-Agent
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1201
expires
Wed, 04 Sep 2024 12:01:55 GMT

Verdicts & Comments Add Verdict or Comment

127 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| piwik object| translations object| piwik_translations function| _get function| _createClass function| _possibleConstructorReturn function| _inherits function| _classCallCheck function| Component function| docHandleKeydown function| docHandleKeyup function| docHandleFocus function| docHandleBlur function| getTime object| passiveIfSupported object| $jscomp object| $jscomp$this object| Vue function| QRCode function| _pk_translate function| _pk_externalRawLink function| isEnterKey function| isEscapeKey object| broadcast object| Piwik_Popover object| DataTable_RowActions_Registry function| DataTable_RowAction function| DataTable_RowActions_RowEvolution function| initTopControls function| toggleCalendar function| selectPeriodRadioButton function| blockPropegation object| NumberFormatter object| ListingFormatter function| rowEvolutionGetMetricNameFromRow function| JQPlotExternalSeriesToggle function| RowEvolutionSeriesToggle function| widgetsHelper function| DataTable_RowActions_Transitions function| Piwik_Transitions function| Piwik_Transitions_Canvas function| Piwik_Transitions_Model function| Piwik_Transitions_Ajax function| createDashboard function| makeSelectorLastId function| resetDashboard function| renameDashboard function| removeDashboard function| showChangeDashboardLayoutDialog function| showEmptyDashboardNotification function| setAsDefaultWidgets function| copyDashboardToUser function| onClickPause function| onClickPlay object| SegmentedVisitorLog function| initializeVisitorActions function| DataTable_RowActions_Overlay object| Overlay_Helper object| tourEngagement object| PagePerformance function| $ function| jQuery function| cash object| Waves object| M function| sprintf function| vsprintf function| Mousetrap function| iFrameResize object| Visibility function| chroma object| tslib function| vueSanitize function| require object| piwikHelper function| initializeSparklines object| Piwik_Transitions_Util object| SEOWidget object| bruteForceLog function| eve function| Raphael function| kartograph object| $K function| drawStackedBars object| UserCountryMap function| Segmentation object| tagManagerHelper object| Materialize object| globalAjaxQueue function| ajaxHelper object| CoreHome object| CorePluginsAdmin object| CoreAdminHome object| Diagnostics object| CoreVisualizations object| API object| Widgetize object| Transitions object| LanguagesManager object| Dashboard object| MultiSites object| Referrers object| DevicesDetection object| Goals object| Ecommerce object| UserCountry object| GeoIp2 object| Login object| TwoFactorAuth object| UsersManager object| SitesManager object| Installation object| resetReportParametersFunctions object| updateReportParametersFunctions object| getReportParametersFunctions object| ScheduledReports object| Live object| SegmentEditor object| PrivacyManager object| MobileMessaging object| Morpheus object| Marketplace object| CustomDimensions object| JsTrackerInstallCheck object| DBStats object| mtmDbgData object| TagManager

1 Cookies

Domain/Path Name / Value
www.analytics.bestatterverband-niedersachsen.de/ Name: MATOMO_SESSID
Value: 5t1ovv9oouepqoc90kcgl7200n

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
Strict-Transport-Security max-age=15768000; includeSubDomains
X-Frame-Options sameorigin