Submitted URL: http://analytics3.dacadoo.com/
Effective URL: https://analytics3.dacadoo.com/
Submission: On November 14 via api from DE — Scanned from US

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 11 HTTP transactions. The main IP is 2606:4700:4400::ac40:9b30, located in United States and belongs to . The main domain is analytics3.dacadoo.com.
TLS certificate: Issued by WE1 on September 18th 2024. Valid for: 3 months.
This is the only time analytics3.dacadoo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:440... ()
9 172.64.155.48 13335 (CLOUDFLAR...)
11 2
Apex Domain
Subdomains
Transfer
11 dacadoo.com
analytics3.dacadoo.com
841 KB
11 1
Domain Requested by
11 analytics3.dacadoo.com analytics3.dacadoo.com
11 1

This site contains links to these domains. Also see Links.

Domain
matomo.org
Subject Issuer Validity Valid
analytics3.dacadoo.com
WE1
2024-09-18 -
2024-12-17
3 months crt.sh

This page contains 1 frames:

Primary Page: https://analytics3.dacadoo.com/
Frame ID: FD4778D22CCB23796E219E48D740BC26
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Sign in - Matomo

Page URL History Show full URLs

  1. http://analytics3.dacadoo.com/ HTTP 307
    https://analytics3.dacadoo.com/ Page URL

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

841 kB
Transfer

3445 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://analytics3.dacadoo.com/ HTTP 307
    https://analytics3.dacadoo.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
analytics3.dacadoo.com/
Redirect Chain
  • http://analytics3.dacadoo.com/
  • https://analytics3.dacadoo.com/
147 KB
43 KB
Document
General
Full URL
https://analytics3.dacadoo.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9b30 , United States, ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
97a47b4a35b25f3c6c34ecbcfe7755492f204fbb1bd7e47b0bfa3235999dfd8d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8e2892763c4ecb86-LAX
content-encoding
br
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
content-type
text/html; charset=utf-8
date
Thu, 14 Nov 2024 17:02:57 GMT
referrer-policy
same-origin origin
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
sameorigin
x-matomo-request-id
7fc6f
x-xss-protection
1; mode=block

Redirect headers

Location
https://analytics3.dacadoo.com/
Non-Authoritative-Reason
HttpsUpgrades
index.php
analytics3.dacadoo.com/
469 KB
81 KB
Stylesheet
General
Full URL
https://analytics3.dacadoo.com/index.php?module=Proxy&action=getCss&cb=a2ba6acacc7c4f71e59aadddb16de5ab
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9b30 , United States, ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
b6428d2647bf04ad20ace8628e43bd29b0a2bd1318e7b03589e456bcb6393104
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
expires
Sat, 22 Feb 2025 17:02:57 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
text/css;charset=UTF-8
content-disposition
inline; filename=asset_manager_global_css.css
vary
Accept-Encoding
last-modified
Thu, 26 Sep 2024 06:05:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, must-revalidate
referrer-policy
origin
x-matomo-request-id
72a58
cf-ray
8e289279fb63cb86-LAX
content-length
82411
x-xss-protection
1; mode=block
server
cloudflare
index.php
analytics3.dacadoo.com/
2 MB
445 KB
Script
General
Full URL
https://analytics3.dacadoo.com/index.php?module=Proxy&action=getCoreJs&cb=c8e2c223362db048b1c71acf9987466d
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92dbf1f64008303aeec9bff44351904b62d5b62b305f078a162fc901c9322654
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
expires
Sat, 22 Feb 2025 17:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
application/javascript; charset=UTF-8
content-disposition
inline; filename=asset_manager_core_js.js
vary
Accept-Encoding
last-modified
Thu, 03 Oct 2024 02:45:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, must-revalidate
referrer-policy
origin
x-matomo-request-id
fdd49
cf-ray
8e28927aceb37d8c-LAX
content-length
454818
x-xss-protection
1; mode=block
server
cloudflare
index.php
analytics3.dacadoo.com/
61 B
413 B
Script
General
Full URL
https://analytics3.dacadoo.com/index.php?module=Proxy&action=getNonCoreJs&cb=c8e2c223362db048b1c71acf9987466d
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f4d2ec74e77bb61f1357a3699a9b41583c38d8020f37607f09521eaf2ef2363
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
expires
Sat, 22 Feb 2025 17:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
application/javascript; charset=UTF-8
content-disposition
inline; filename=asset_manager_non_core_js.js
vary
Accept-Encoding
last-modified
Thu, 03 Oct 2024 02:45:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, must-revalidate
referrer-policy
origin
x-matomo-request-id
33988
cf-ray
8e28927e8c9e7d8c-LAX
content-length
81
x-xss-protection
1; mode=block
server
cloudflare
index.php
analytics3.dacadoo.com/
229 KB
51 KB
Script
General
Full URL
https://analytics3.dacadoo.com/index.php?module=Proxy&action=getUmdJs&chunk=0&cb=c8e2c223362db048b1c71acf9987466d
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4259640e09c2baec3bca822473c04940309d58148a57c82f6d98766ec204d64e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
expires
Sat, 22 Feb 2025 17:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
application/javascript; charset=UTF-8
content-disposition
inline; filename=asset_manager_chunk.0.js
vary
Accept-Encoding
last-modified
Thu, 03 Oct 2024 02:45:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, must-revalidate
referrer-policy
origin
x-matomo-request-id
c6c46
cf-ray
8e28927eacf07d8c-LAX
content-length
51869
x-xss-protection
1; mode=block
server
cloudflare
index.php
analytics3.dacadoo.com/
393 KB
82 KB
Script
General
Full URL
https://analytics3.dacadoo.com/index.php?module=Proxy&action=getUmdJs&chunk=1&cb=c8e2c223362db048b1c71acf9987466d
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b43a9f780454caa799a066cefa3ddd626bcde8869af0c80b6bb3ab688396a8e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
expires
Sat, 22 Feb 2025 17:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
application/javascript; charset=UTF-8
content-disposition
inline; filename=asset_manager_chunk.1.js
vary
Accept-Encoding
last-modified
Thu, 03 Oct 2024 02:45:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, must-revalidate
referrer-policy
origin
x-matomo-request-id
52dbd
cf-ray
8e28927eacfa7d8c-LAX
content-length
83746
x-xss-protection
1; mode=block
server
cloudflare
index.php
analytics3.dacadoo.com/
620 KB
112 KB
Script
General
Full URL
https://analytics3.dacadoo.com/index.php?module=Proxy&action=getUmdJs&chunk=2&cb=c8e2c223362db048b1c71acf9987466d
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
abdd4570e375dcadd7c939ef1bf2f58074d98b01994d0975d1b49e823c3b0ed6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
expires
Sat, 22 Feb 2025 17:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
application/javascript; charset=UTF-8
content-disposition
inline; filename=asset_manager_chunk.2.js
vary
Accept-Encoding
last-modified
Thu, 03 Oct 2024 02:45:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, must-revalidate
referrer-policy
origin
x-matomo-request-id
f6420
cf-ray
8e28927eacfe7d8c-LAX
content-length
114594
x-xss-protection
1; mode=block
server
cloudflare
logo.svg
analytics3.dacadoo.com/plugins/Morpheus/images/
13 KB
7 KB
Image
General
Full URL
https://analytics3.dacadoo.com/plugins/Morpheus/images/logo.svg?matomo
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
adf71f06caff6bbf9e745fffbc0ea0a0a2764e2b2e7e384960fdc7548f805fac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"66f4f956-32ad"
pragma
public
x-content-type-options
nosniff
cf-ray
8e28927adeb67d8c-LAX
expires
Thu, 14 Nov 2024 21:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
image/svg+xml
last-modified
Thu, 26 Sep 2024 06:04:06 GMT
vary
Accept-Encoding
server
cloudflare
loading-blue.gif
analytics3.dacadoo.com/plugins/Morpheus/images/
723 B
1011 B
Image
General
Full URL
https://analytics3.dacadoo.com/plugins/Morpheus/images/loading-blue.gif
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c266039bad40412ed4f64d9d8cf1393b08214d22d91b9b4f034ffb6ab280ce20
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

cf-cache-status
MISS
etag
"66f4f956-2d3"
x-content-type-options
nosniff
expires
Thu, 14 Nov 2024 21:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
image/gif
last-modified
Thu, 26 Sep 2024 06:04:06 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
pragma
public
cf-ray
8e28927adebb7d8c-LAX
accept-ranges
bytes
content-length
723
server
cloudflare
matomo.woff2
analytics3.dacadoo.com/plugins/Morpheus/fonts/
16 KB
16 KB
Font
General
Full URL
https://analytics3.dacadoo.com/plugins/Morpheus/fonts/matomo.woff2?m6crfo
Requested by
Host: analytics3.dacadoo.com
URL: https://analytics3.dacadoo.com/index.php?module=Proxy&action=getCss&cb=a2ba6acacc7c4f71e59aadddb16de5ab
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eade9621626e0fef3d8e2ffb465a7d7f90fe75c9433dc05d0d5aca2ae14422d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin
https://analytics3.dacadoo.com
Referer
https://analytics3.dacadoo.com/

Response headers

cf-cache-status
MISS
etag
"66f4f956-4044"
x-content-type-options
nosniff
expires
Thu, 14 Nov 2024 21:02:58 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:58 GMT
content-type
application/octet-stream
last-modified
Thu, 26 Sep 2024 06:04:06 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
pragma
public
cf-ray
8e28927ecd187d8c-LAX
accept-ranges
bytes
content-length
16452
server
cloudflare
favicon.png
analytics3.dacadoo.com/plugins/CoreHome/images/
2 KB
2 KB
Other
General
Full URL
https://analytics3.dacadoo.com/plugins/CoreHome/images/favicon.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17c1c6408974566688a893e2b89b49cb917a2249da82b97e1a507065e257e32f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://analytics3.dacadoo.com/

Response headers

cf-cache-status
MISS
etag
"66f4f955-8b9"
x-content-type-options
nosniff
expires
Thu, 14 Nov 2024 21:02:59 GMT
alt-svc
h3=":443"; ma=86400
date
Thu, 14 Nov 2024 17:02:59 GMT
content-type
image/png
last-modified
Thu, 26 Sep 2024 06:04:05 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
pragma
public
cf-ray
8e2892841d737d8c-LAX
accept-ranges
bytes
content-length
2233
server
cloudflare

Verdicts & Comments Add Verdict or Comment

126 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| piwik object| translations object| piwik_translations function| _get function| _createClass function| _possibleConstructorReturn function| _inherits function| _classCallCheck function| Component function| docHandleKeydown function| docHandleKeyup function| docHandleFocus function| docHandleBlur function| getTime object| passiveIfSupported object| $jscomp object| $jscomp$this object| Vue function| QRCode function| _pk_translate function| _pk_externalRawLink function| isEnterKey function| isEscapeKey object| broadcast object| Piwik_Popover object| DataTable_RowActions_Registry function| DataTable_RowAction function| DataTable_RowActions_RowEvolution function| initTopControls function| toggleCalendar function| selectPeriodRadioButton function| blockPropegation object| NumberFormatter object| ListingFormatter function| rowEvolutionGetMetricNameFromRow function| JQPlotExternalSeriesToggle function| RowEvolutionSeriesToggle function| widgetsHelper function| DataTable_RowActions_Transitions function| Piwik_Transitions function| Piwik_Transitions_Canvas function| Piwik_Transitions_Model function| Piwik_Transitions_Ajax function| createDashboard function| makeSelectorLastId function| resetDashboard function| renameDashboard function| removeDashboard function| showChangeDashboardLayoutDialog function| showEmptyDashboardNotification function| setAsDefaultWidgets function| copyDashboardToUser function| onClickPause function| onClickPlay object| SegmentedVisitorLog function| initializeVisitorActions function| DataTable_RowActions_Overlay object| Overlay_Helper object| tourEngagement object| PagePerformance function| $ function| jQuery function| cash object| Waves object| M function| sprintf function| vsprintf function| Mousetrap function| iFrameResize object| Visibility function| chroma object| tslib function| vueSanitize function| require object| piwikHelper function| initializeSparklines object| Piwik_Transitions_Util object| SEOWidget object| bruteForceLog function| eve function| Raphael function| kartograph object| $K function| drawStackedBars object| UserCountryMap function| Segmentation object| Materialize object| globalAjaxQueue function| ajaxHelper object| CoreHome object| CorePluginsAdmin object| CoreAdminHome object| Diagnostics object| CoreVisualizations object| API object| Widgetize object| Transitions object| LanguagesManager object| Dashboard object| MultiSites object| Referrers object| DevicesDetection object| Goals object| Ecommerce object| UserCountry object| GeoIp2 object| Feedback object| Login object| TwoFactorAuth object| UsersManager object| SitesManager object| Installation object| resetReportParametersFunctions object| updateReportParametersFunctions object| getReportParametersFunctions object| ScheduledReports object| Live object| SegmentEditor object| PrivacyManager object| MobileMessaging object| Morpheus object| Marketplace object| ProfessionalServices object| CustomDimensions object| JsTrackerInstallCheck object| DBStats

1 Cookies

Domain/Path Name / Value
analytics3.dacadoo.com/ Name: MATOMO_SESSID
Value: c3a4f969f70uis5e0cr2lci4vt

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' 'unsafe-inline' 'unsafe-eval' data:;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block