URL: https://support.lct.ai/
Submission: On February 28 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 51.81.83.35, located in United States and belongs to OVH, FR. The main domain is support.lct.ai.
TLS certificate: Issued by R3 on February 28th 2023. Valid for: 3 months.
This is the only time support.lct.ai was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
12 51.81.83.35 16276 (OVH)
12 1
Apex Domain
Subdomains
Transfer
12 lct.ai
support.lct.ai
4 MB
12 1
Domain Requested by
12 support.lct.ai support.lct.ai
12 1

This site contains links to these domains. Also see Links.

Domain
zammad.org
Subject Issuer Validity Valid
support.lct.ai
R3
2023-02-28 -
2023-05-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://support.lct.ai/
Frame ID: E1A74DBB658CDEEA75641BF29AE4BFC6
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

LCT - Sign in

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

3682 kB
Transfer

3834 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
support.lct.ai/
3 KB
3 KB
Document
General
Full URL
https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
fb2a9c38644845447b8700e6abcc243b1600ac38df8e187aaa0e9183181edcfb
Security Headers
Name Value
Content-Security-Policy base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-V/n/r+qPo2yAlnYubsxL9Q=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-V/n/r+qPo2yAlnYubsxL9Q=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
content-type
text/html; charset=utf-8
csrf-token
fiA_EeKT5-ZYEx2dEALbpyrS27qvY0X4ybsSk5J5AaFmxqvYrL7dinqDXfvPovnskAaCYUSO7EaD_Kpac4ZzfQ
date
Tue, 28 Feb 2023 17:06:33 GMT
etag
W/"fb2a9c38644845447b8700e6abcc243b"
expires
-1
link
</assets/application-40e987ce50a44a8123aa1eca1c1378503305a9887294255465daa29d1c6f5522.css>; rel=preload; as=style; nopush,</assets/application-print-03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0.css>; rel=preload; as=style; nopush
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
openresty
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-download-options
noopen
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-request-id
c4b327af-021d-47d1-a205-75415ab7ad16
x-runtime
0.024959
x-served-by
support.lct.ai
x-xss-protection
1; mode=block
application-40e987ce50a44a8123aa1eca1c1378503305a9887294255465daa29d1c6f5522.css
support.lct.ai/assets/
335 KB
336 KB
Stylesheet
General
Full URL
https://support.lct.ai/assets/application-40e987ce50a44a8123aa1eca1c1378503305a9887294255465daa29d1c6f5522.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
9b739365de1834d994ba85df323cc52c6f87a9f9beea996efe8dbff0ae005b48
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.lct.ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Wed, 01 Mar 2023 00:30:00 GMT
date
Tue, 28 Feb 2023 17:06:33 GMT
strict-transport-security
max-age=31536000
server
openresty
etag
"63c029d3-53c8c"
content-type
text/css
cache-control
max-age=26607
accept-ranges
bytes
content-length
343180
x-served-by
support.lct.ai
application-print-03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0.css
support.lct.ai/assets/
3 KB
3 KB
Stylesheet
General
Full URL
https://support.lct.ai/assets/application-print-03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
03b49985a4830cb5379c75dde562b82d9cb2d7eee523c566dc793e7be07a85e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.lct.ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Wed, 01 Mar 2023 00:30:00 GMT
date
Tue, 28 Feb 2023 17:06:33 GMT
strict-transport-security
max-age=31536000
server
openresty
etag
"637cb70d-af3"
content-type
text/css
cache-control
max-age=26607
accept-ranges
bytes
content-length
2803
x-served-by
support.lct.ai
application-c302c22c921f78c357182c043e6cc35d3ea2c67112305b05c11ff7ec511624db.js
support.lct.ai/assets/
3 MB
3 MB
Script
General
Full URL
https://support.lct.ai/assets/application-c302c22c921f78c357182c043e6cc35d3ea2c67112305b05c11ff7ec511624db.js
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
c302c22c921f78c357182c043e6cc35d3ea2c67112305b05c11ff7ec511624db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.lct.ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Wed, 01 Mar 2023 00:30:00 GMT
date
Tue, 28 Feb 2023 17:06:33 GMT
strict-transport-security
max-age=31536000
server
openresty
etag
"63eb8403-2dc641"
content-type
application/javascript
cache-control
max-age=26607
accept-ranges
bytes
content-length
2999873
x-served-by
support.lct.ai
form.js
support.lct.ai/assets/form/
18 KB
19 KB
Script
General
Full URL
https://support.lct.ai/assets/form/form.js
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
370a6e65ba124f503f797a042a3a56fb8d9f33f6acdbe1c0d6878fbd9b90b23b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.lct.ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Wed, 01 Mar 2023 00:30:00 GMT
date
Tue, 28 Feb 2023 17:06:33 GMT
strict-transport-security
max-age=31536000
server
openresty
etag
"63f740bb-49fb"
content-type
application/javascript
cache-control
max-age=26607
accept-ranges
bytes
content-length
18939
x-served-by
support.lct.ai
icons.svg
support.lct.ai/assets/images/
98 KB
99 KB
Other
General
Full URL
https://support.lct.ai/assets/images/icons.svg
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
98416edd53e8f71ac6c281279db9e5bb8610dc3bc1e5a0b62b37e2f1d7d16b4f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.lct.ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Wed, 01 Mar 2023 00:30:00 GMT
date
Tue, 28 Feb 2023 17:06:33 GMT
strict-transport-security
max-age=31536000
server
openresty
etag
"63f740bb-18985"
content-type
image/svg+xml
cache-control
max-age=26607
accept-ranges
bytes
content-length
100741
x-served-by
support.lct.ai
FiraSans-Regular.woff2
support.lct.ai/assets/fonts/
125 KB
125 KB
Font
General
Full URL
https://support.lct.ai/assets/fonts/FiraSans-Regular.woff2
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/assets/application-40e987ce50a44a8123aa1eca1c1378503305a9887294255465daa29d1c6f5522.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
8d739118905988fffe702241d03ac1463ae5e56aef49c66bc4995669dc43d4dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://support.lct.ai/assets/application-40e987ce50a44a8123aa1eca1c1378503305a9887294255465daa29d1c6f5522.css
Origin
https://support.lct.ai
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Tue, 28 Feb 2023 17:06:34 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Feb 2023 10:32:27 GMT
server
openresty
etag
"63f740bb-1f26c"
content-type
application/octet-stream
cache-control
max-age=315360000
accept-ranges
bytes
content-length
127596
x-served-by
support.lct.ai
signshow
support.lct.ai/api/v1/
18 KB
5 KB
XHR
General
Full URL
https://support.lct.ai/api/v1/signshow
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/assets/application-c302c22c921f78c357182c043e6cc35d3ea2c67112305b05c11ff7ec511624db.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
6e0ccfb20b31983e3c14674b43f5bb143b45f7dc897068ca188831d30dfcea8d
Security Headers
Name Value
Content-Security-Policy base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-lc6lScscHbytY9HQw1OzDg=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://support.lct.ai/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 28 Feb 2023 17:06:34 GMT
content-security-policy
base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-lc6lScscHbytY9HQw1OzDg=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
content-encoding
gzip
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
27b18a59-56e5-4605-b6d6-c6638afe4be0
x-served-by
support.lct.ai
pragma
no-cache
x-runtime
0.090885
referrer-policy
strict-origin-when-cross-origin
server
openresty
etag
W/"6e0ccfb20b31983e3c14674b43f5bb14"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept
content-type
application/json; charset=utf-8
csrf-token
Si0serlF1PIXgP8j_q2e8kD-1iUbIxsTTdUpTRA-JTdSy7iz92junjUQv0UhDby5-iqP_vDOsq0HkpGE8cFX6w
cache-control
no-cache, no-store, max-age=0, must-revalidate
expires
-1
en-us
support.lct.ai/api/v1/translations/lang/
200 KB
56 KB
XHR
General
Full URL
https://support.lct.ai/api/v1/translations/lang/en-us?_=1677603994213
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/assets/application-c302c22c921f78c357182c043e6cc35d3ea2c67112305b05c11ff7ec511624db.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
f45fc584a7260c605b38acf9b83556f310eb978de6aa794bb773278c99a4bbf5
Security Headers
Name Value
Content-Security-Policy base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-+MMZkTltVJMUUhmf9i9awg=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://support.lct.ai/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 28 Feb 2023 17:06:35 GMT
content-security-policy
base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-+MMZkTltVJMUUhmf9i9awg=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
content-encoding
gzip
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
d67e672d-b974-4f32-a8e0-93a51519cc92
x-served-by
support.lct.ai
pragma
no-cache
x-runtime
0.145144
referrer-policy
strict-origin-when-cross-origin
server
openresty
etag
W/"f45fc584a7260c605b38acf9b83556f3"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept
content-type
application/json; charset=utf-8
csrf-token
N8NMl6iA1kZI_4o5xlhsN4wFk3k-7Uf1KlVYVPmAwlsvJdhe5q3sKmpvyl8Z-E58NtHKotUA7ktgEuCdGH-whw
cache-control
no-cache, no-store, max-age=0, must-revalidate
expires
-1
chat_new.mp3
support.lct.ai/assets/sounds/
44 KB
44 KB
Media
General
Full URL
https://support.lct.ai/assets/sounds/chat_new.mp3
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
a7ede5b71656854a2708101bab4fea49a632e7a90b82187c01b5e1e0e7653940
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://support.lct.ai/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Range
bytes=0-

Response headers

expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Tue, 28 Feb 2023 17:06:35 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Feb 2023 10:32:27 GMT
server
openresty
etag
"63f740bb-af8f"
content-type
audio/mpeg
Content-Range
bytes 0-44942/44943
cache-control
max-age=315360000
Content-Length
44943
x-served-by
support.lct.ai
chat_message.mp3
support.lct.ai/assets/sounds/
42 KB
42 KB
Media
General
Full URL
https://support.lct.ai/assets/sounds/chat_message.mp3
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
c03005fa00123eeed2dbe67611d3f8ce5811e019bd146226dbdb6693c273ed31
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://support.lct.ai/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Range
bytes=0-

Response headers

expires
Thu, 31 Dec 2037 23:55:55 GMT
date
Tue, 28 Feb 2023 17:06:35 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Feb 2023 10:32:27 GMT
server
openresty
etag
"63f740bb-a81c"
content-type
audio/mpeg
Content-Range
bytes 0-43035/43036
cache-control
max-age=315360000
Content-Length
43036
x-served-by
support.lct.ai
da066a569b1bd547c06679dc03b7b325.png
support.lct.ai/assets/images/
18 KB
18 KB
Image
General
Full URL
https://support.lct.ai/assets/images/da066a569b1bd547c06679dc03b7b325.png
Requested by
Host: support.lct.ai
URL: https://support.lct.ai/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.81.83.35 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d38b5f92.vps.ovh.us
Software
openresty /
Resource Hash
90e98b53fcfdba47dc120cc0d018308150d0ef9bfa1cc5b28881bef7036c5138
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://support.lct.ai/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires
Wed, 01 Mar 2023 00:30:00 GMT
date
Tue, 28 Feb 2023 17:06:35 GMT
strict-transport-security
max-age=31536000
server
openresty
etag
"63fc0d0c-480a"
content-type
image/png
cache-control
max-age=26605
accept-ranges
bytes
content-length
18442
x-served-by
support.lct.ai

Verdicts & Comments Add Verdict or Comment

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless undefined| polyfillScriptTag boolean| svgPolyfill function| UploadManager function| FileUpload function| __ function| escapeRegExp function| difference function| byteLength function| clone function| underscored function| toCamelCase function| isRetina function| originalLeave function| originalShow object| module function| noop undefined| supportsFileApi function| qq object| linkify function| linkifyStr function| $ function| jQuery function| _ object| Spine object| rangy object| clipboard object| notify function| emailAddresses function| EXIF object| hljs object| html5Upload object| jquery-scrollto function| noty function| marked object| Modernizr function| tinycolor function| UAParser function| word_filter function| App object| JST

1 Cookies

Domain/Path Name / Value
support.lct.ai/ Name: _zammad_session_a138cfd0f37
Value: da0d3366b2027207f521a1beda2eaadc

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy base-uri 'self' https://172.16.10.6; default-src 'self' ws: wss: https://images.zammad.com; font-src 'self' data:; img-src * data:; object-src 'none'; script-src 'self' 'unsafe-eval' 'nonce-V/n/r+qPo2yAlnYubsxL9Q=='; style-src 'self' 'unsafe-inline'; frame-src www.youtube.com player.vimeo.com
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block