feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io Open in urlscan Pro
35.228.185.106  Public Scan

URL: https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Submission: On October 04 via automatic, source certstream-suspicious — Scanned from FI

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 35.228.185.106, located in Lappeenranta, Finland and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io.
TLS certificate: Issued by R10 on October 4th 2024. Valid for: 3 months.
This is the only time feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
6 35.228.185.106 396982 (GOOGLE-CL...)
6 1
Domain Requested by
6 feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io
6 1

This site contains no links.

Subject Issuer Validity Valid
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io
R10
2024-10-04 -
2025-01-02
3 months crt.sh

This page contains 1 frames:

Primary Page: https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Frame ID: 2CF2D9ABD4A4333277FC550932674664
Requests: 6 HTTP requests in this frame

Screenshot

Page Title

| Fortum

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

71 kB
Transfer

285 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
6 KB
3 KB
Document
General
Full URL
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.228.185.106 Lappeenranta, Finland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
106.185.228.35.bc.googleusercontent.com
Software
/
Resource Hash
f34b9a325394bc3329ea5b4c6c7205c7d9ae1df6907f12de59d7c966c1ec0ab4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
cache-control
must-revalidate, no-cache, private
content-encoding
gzip
content-language
en
content-security-policy
upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
content-type
text/html; charset=UTF-8
date
Fri, 04 Oct 2024 13:10:20 GMT
expires
Sun, 19 Nov 1978 05:00:00 GMT
fastly-drupal-html
YES
referrer-policy
no-referrer, strict-origin-when-cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
surrogate-control
must-revalidate, no-cache, private
surrogate-key
N1vy 8zpJ 9uKQ xCyF CLkw Cip7 E6mz tWIw nyyS tAA/ nFlf hM/6 I+ay EW7z g/LO I9R+ kAH3 FDNE GyLM
vary
Accept-Encoding
x-content-type-options
nosniff
x-drupal-cache
HIT
x-drupal-dynamic-cache
MISS
x-frame-options
SAMEORIGIN
x-robots-tag
noindex, nofollow, nosnippet, noarchive
x-xss-protection
1; mode=block
css_SsBhI-AyDKkVq5kgLRSTMCLU8Bg0S6DmK-NGG4BFRP4.css
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/css/
4 KB
2 KB
Stylesheet
General
Full URL
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/css/css_SsBhI-AyDKkVq5kgLRSTMCLU8Bg0S6DmK-NGG4BFRP4.css?delta=0&language=en&theme=fortum_admin&include=eJxLzi9K1c_LL8pNzMmsStVJzkksytdPz8lPSszRLS6pzMnMS9dJyy8qKc2NT0zJzcyDygEAWnIVjw
Requested by
Host: feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io
URL: https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.228.185.106 Lappeenranta, Finland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
106.185.228.35.bc.googleusercontent.com
Software
/
Resource Hash
12b4cd6d8a5c97ddb7524f6cf53f32ae592f4e8e73faba7d0d0461caff3c3d0f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-robots-tag
noindex, nofollow, nosnippet, noarchive
content-security-policy
upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
cache-control
max-age=31536000
content-encoding
gzip
etag
W/"66ffe843-f1e"
referrer-policy
no-referrer, strict-origin-when-cross-origin
expires
Sat, 04 Oct 2025 13:10:22 GMT
date
Fri, 04 Oct 2024 13:10:22 GMT
x-xss-protection
1; mode=block
content-type
text/css
last-modified
Fri, 04 Oct 2024 13:06:11 GMT
vary
Accept-Encoding
css_wVM4X-ylhuGl2zjmkA4BVzDWW92uyZTpWq45VTOxr1M.css
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/css/
165 KB
26 KB
Stylesheet
General
Full URL
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/css/css_wVM4X-ylhuGl2zjmkA4BVzDWW92uyZTpWq45VTOxr1M.css?delta=1&language=en&theme=fortum_admin&include=eJxLzi9K1c_LL8pNzMmsStVJzkksytdPz8lPSszRLS6pzMnMS9dJyy8qKc2NT0zJzcyDygEAWnIVjw
Requested by
Host: feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io
URL: https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.228.185.106 Lappeenranta, Finland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
106.185.228.35.bc.googleusercontent.com
Software
/
Resource Hash
775500de9e156220f66b2bfde512a00a9e23830c03c05be52beed915bdb39497
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-robots-tag
noindex, nofollow, nosnippet, noarchive
content-security-policy
upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
cache-control
max-age=31536000
content-encoding
gzip
etag
W/"66ffe843-29441"
referrer-policy
no-referrer, strict-origin-when-cross-origin
expires
Sat, 04 Oct 2025 13:10:22 GMT
date
Fri, 04 Oct 2024 13:10:22 GMT
x-xss-protection
1; mode=block
content-type
text/css
last-modified
Fri, 04 Oct 2024 13:06:11 GMT
vary
Accept-Encoding
js_7ZJNZZLtEfT5LWiNJHn7sdFrchq8Ok2h8o2gjdJci6k.js
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/js/
233 B
1 KB
Script
General
Full URL
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/js/js_7ZJNZZLtEfT5LWiNJHn7sdFrchq8Ok2h8o2gjdJci6k.js?scope=header&delta=0&language=en&theme=fortum_admin&include=eJwtyW0OQDAQRdENlS5JRvsUaTvMh8TuRfh3c25iQcziB9WxQZUKQnptPx1yf_1_Y08rLnTTwaAWFhbzNlFuW4-l8kz1AerUH0g
Requested by
Host: feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io
URL: https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.228.185.106 Lappeenranta, Finland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
106.185.228.35.bc.googleusercontent.com
Software
/
Resource Hash
a4e077de6b59277df5317c9f742aa34eed430a97d6124bf30c6a93eb52a74544
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-robots-tag
noindex, nofollow, nosnippet, noarchive
content-security-policy
upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
cache-control
max-age=31536000
content-encoding
gzip
etag
W/"66ffe843-e9"
referrer-policy
no-referrer, strict-origin-when-cross-origin
expires
Sat, 04 Oct 2025 13:10:22 GMT
date
Fri, 04 Oct 2024 13:10:22 GMT
x-xss-protection
1; mode=block
content-type
application/javascript
last-modified
Fri, 04 Oct 2024 13:06:11 GMT
vary
Accept-Encoding
js_f5nz9ivhWoDh_8n69ily3FFEGCIAo3KA0CYM7eUYAW4.js
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/js/
96 KB
34 KB
Script
General
Full URL
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/sites/default/files/js/js_f5nz9ivhWoDh_8n69ily3FFEGCIAo3KA0CYM7eUYAW4.js?scope=footer&delta=0&language=en&theme=fortum_admin&include=eJwtyW0OQDAQRdENlS5JRvsUaTvMh8TuRfh3c25iQcziB9WxQZUKQnptPx1yf_1_Y08rLnTTwaAWFhbzNlFuW4-l8kz1AerUH0g
Requested by
Host: feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io
URL: https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.228.185.106 Lappeenranta, Finland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
106.185.228.35.bc.googleusercontent.com
Software
/
Resource Hash
74cf9c4a115aaee84eeecf337a328912d4c97e571c310a27777d7edb78723671
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-robots-tag
noindex, nofollow, nosnippet, noarchive
content-security-policy
upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
cache-control
max-age=31536000
content-encoding
gzip
etag
W/"66ffe843-17ebf"
referrer-policy
no-referrer, strict-origin-when-cross-origin
expires
Sat, 04 Oct 2025 13:10:22 GMT
date
Fri, 04 Oct 2024 13:10:22 GMT
x-xss-protection
1; mode=block
content-type
application/javascript
last-modified
Fri, 04 Oct 2024 13:06:11 GMT
vary
Accept-Encoding
favicon.ico
feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/themes/fortum_admin/
15 KB
5 KB
Other
General
Full URL
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/themes/fortum_admin/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.228.185.106 Lappeenranta, Finland, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
106.185.228.35.bc.googleusercontent.com
Software
/
Resource Hash
5feb97d3b8554341715df7a87eef683062f774e2bde617cefd1b33e0d60aabba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://feature-la004311-3715-updad2d.client-fi-fortum-castle.dev.wdr.io/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-robots-tag
noindex, nofollow, nosnippet, noarchive
cache-control
max-age=31536000, public
content-encoding
gzip
etag
W/"66fbcd60-3aee"
expires
Sat, 04 Oct 2025 13:10:22 GMT
date
Fri, 04 Oct 2024 13:10:22 GMT
content-type
image/x-icon
last-modified
Tue, 01 Oct 2024 10:22:24 GMT
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| jQuery object| drupalSettings object| Drupal

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' youtube.com www.youtube.com https://maps.googleapis.com https://maps.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maps.googleapis.com https://maps.gstatic.com; img-src 'self' data: https://maps.googleapis.com https://maps.gstatic.com https://maps.google.com i.vimeocdn.com; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'self'; frame-src *.wdr.io pages.upsales.com https://maps.google.com www.youtube.com youtube.com youtube-nocookie.com www.youtube-nocookie.com https://www.youtube.com https://www.youtube-nocookie.com player.vimeo.com; base-uri 'self'; object-src 'self'; connect-src wss: https: https://maps.googleapis.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block