Submitted URL: http://paymentsapply.home.barclaycard/
Effective URL: https://paymentsapply.home.barclaycard/
Submission: On October 28 via manual from GB — Scanned from GB

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 35.158.127.53, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is paymentsapply.home.barclaycard.
TLS certificate: Issued by DigiCert EV RSA CA G2 on May 9th 2024. Valid for: a year.
This is the only time paymentsapply.home.barclaycard was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 35.158.127.53 16509 (AMAZON-02)
3 2a02:26f0:710... 20940 (AKAMAI-ASN1)
11 2
Apex Domain
Subdomains
Transfer
8 home.barclaycard
paymentsapply.home.barclaycard
101 KB
3 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 430
267 KB
11 2
Domain Requested by
8 paymentsapply.home.barclaycard paymentsapply.home.barclaycard
3 assets.adobedtm.com paymentsapply.home.barclaycard
assets.adobedtm.com
11 2

This site contains no links.

Subject Issuer Validity Valid
paymentsapply.home.barclaycard
DigiCert EV RSA CA G2
2024-05-09 -
2025-05-08
a year crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-09 -
2025-08-09
a year crt.sh

This page contains 1 frames:

Primary Page: https://paymentsapply.home.barclaycard/
Frame ID: 7093BABC7EF911602152E61029D4C39A
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Start Accepting Card Payments

Page URL History Show full URLs

  1. http://paymentsapply.home.barclaycard/ HTTP 307
    https://paymentsapply.home.barclaycard/ Page URL

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

368 kB
Transfer

1203 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://paymentsapply.home.barclaycard/ HTTP 307
    https://paymentsapply.home.barclaycard/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
paymentsapply.home.barclaycard/
Redirect Chain
  • http://paymentsapply.home.barclaycard/
  • https://paymentsapply.home.barclaycard/
8 KB
9 KB
Document
General
Full URL
https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
4b522905ede3a3709adfd33f22e55028fed39bbb6803a0bef2a3376fe65b916f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests frame-ancestors 'self' https://payments-apply-barclaycard.my.salesforce.com https://payments-apply-barclaycard.lightning.force.com
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control
no-cache,must-revalidate,max-age=0,no-store,private
content-security-policy
upgrade-insecure-requests frame-ancestors 'self' https://payments-apply-barclaycard.my.salesforce.com https://payments-apply-barclaycard.lightning.force.com
content-type
text/html;charset=UTF-8
date
Mon, 28 Oct 2024 10:26:31 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
last-modified
Mon, 28 Oct 2024 10:26:31 GMT
p3p
CP="CUR OTR STA"
referrer-policy
origin-when-cross-origin
server
sfdcedge
strict-transport-security
max-age=63072000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
ALLOW-FROM 'self'
x-request-id
34bb4af615288fa3b28b9fa4e1aa2fb0
x-sfdc-request-id
34bb4af615288fa3b28b9fa4e1aa2fb0

Redirect headers

Location
https://paymentsapply.home.barclaycard/
Non-Authoritative-Reason
HttpsUpgrades
stub.js
paymentsapply.home.barclaycard/static/111213/js/perf/
1 KB
1005 B
Script
General
Full URL
https://paymentsapply.home.barclaycard/static/111213/js/perf/stub.js
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
5830f6b53e1ea91abd5de97ef219269702f413575cfe0dd6149712d68d7d61eb
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
x-request-id
643fc2430251fe827b8f16ad9bc784ce
cache-control
public,max-age=10368000
x-sfdc-request-id
643fc2430251fe827b8f16ad9bc784ce
content-encoding
gzip
referrer-policy
origin-when-cross-origin
x-content-type-options
nosniff
expires
Tue, 25 Feb 2025 10:26:31 GMT
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
application/x-javascript
vary
Accept-Encoding
server
sfdcedge
last-modified
Thu, 18 Dec 2014 19:28:43 GMT
lightning.out.js
paymentsapply.home.barclaycard/lightning/
0
0
Script
General
Full URL
https://paymentsapply.home.barclaycard/lightning/lightning.out.js?v=2
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests, frame-ancestors 'self' https://payments-apply-barclaycard.my.salesforce.com https://payments-apply-barclaycard.lightning.force.com
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM 'self'

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
x-request-id
86b3cab8d526a396989a3683e1513227
content-security-policy
upgrade-insecure-requests, frame-ancestors 'self' https://payments-apply-barclaycard.my.salesforce.com https://payments-apply-barclaycard.lightning.force.com
cache-control
no-cache,must-revalidate,max-age=0,no-store,private
x-sfdc-request-id
86b3cab8d526a396989a3683e1513227
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
CP="CUR OTR STA"
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
text/html;charset=UTF-8
last-modified
Mon, 28 Oct 2024 10:26:31 GMT
server
sfdcedge
x-frame-options
ALLOW-FROM 'self'
salesforce-lightning-design-system.min.css
paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/styles/
0
0
Stylesheet
General
Full URL
https://paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/styles/salesforce-lightning-design-system.min.css
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
x-request-id
b66dee9e0fff1fb3fd6ba5b3f7265425
cache-control
no-cache,must-revalidate,max-age=0,no-store,private
x-sfdc-request-id
b66dee9e0fff1fb3fd6ba5b3f7265425
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
p3p
CP="CUR OTR STA"
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
text/css
server
sfdcedge
x-frame-options
SAMEORIGIN
styles.css
paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/
0
0
Stylesheet
General
Full URL
https://paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/styles.css
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
x-request-id
ba5eb241603858348444f9bcac6056b1
cache-control
no-cache,must-revalidate,max-age=0,no-store,private
x-sfdc-request-id
ba5eb241603858348444f9bcac6056b1
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
expires
Thu, 01 Jan 1970 00:00:00 GMT
content-length
0
p3p
CP="CUR OTR STA"
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
text/css
server
sfdcedge
x-frame-options
SAMEORIGIN
Shape.svg
paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/images/
1 KB
1 KB
Image
General
Full URL
https://paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/images/Shape.svg
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
e9c596b5a62fe01c68f26da4353dfef19d99edd94db3afef6d2bcb4f0bebf9ce
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

x-request-id
3f3f0ba71d7f2e3311db93807312112e
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 10:26:31 GMT
p3p
CP="CUR OTR STA"
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
image/svg+xml
last-modified
Thu, 26 Sep 2024 02:20:00 GMT
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains
cache-control
public,max-age=3888000,immutable
x-sfdc-request-id
3f3f0ba71d7f2e3311db93807312112e
referrer-policy
origin-when-cross-origin
content-length
744
server
sfdcedge
BARCLAYCARD.svg
paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/images/
3 KB
2 KB
Image
General
Full URL
https://paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/images/BARCLAYCARD.svg
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
04860cde0dfec8b461558039014ba914e0985cda1a0ddb73bf5382c2601766b1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

x-request-id
a5c411b5717b98dc6e04aa33a5f54f9a
content-encoding
gzip
x-content-type-options
nosniff
expires
Thu, 12 Dec 2024 10:26:31 GMT
p3p
CP="CUR OTR STA"
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
image/svg+xml
vary
Accept-Encoding
last-modified
Thu, 26 Sep 2024 02:20:00 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains
cache-control
public,max-age=3888000,immutable
x-sfdc-request-id
a5c411b5717b98dc6e04aa33a5f54f9a
referrer-policy
origin-when-cross-origin
content-length
1437
server
sfdcedge
launch-3d72e51944b6.min.js
assets.adobedtm.com/230591edb41d/982b679d6e48/
1017 KB
237 KB
Script
General
Full URL
https://assets.adobedtm.com/230591edb41d/982b679d6e48/launch-3d72e51944b6.min.js
Requested by
Host: paymentsapply.home.barclaycard
URL: https://paymentsapply.home.barclaycard/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:7ac::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
a658b9cc03789ddb3a6ca68c58fb9a371d40b8c02ee86113f4c3e9de6d7f4d68

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"4b959636efd230ee53189dc0861c8266:1721999233.249594"
expires
Mon, 28 Oct 2024 11:26:31 GMT
accept-ranges
bytes
access-control-allow-origin
https://paymentsapply.home.barclaycard
date
Mon, 28 Oct 2024 10:26:31 GMT
content-type
application/x-javascript
last-modified
Fri, 26 Jul 2024 13:07:13 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
EXbed3137d17c5403883a0f39bd3970f29-libraryCode_source.min.js
assets.adobedtm.com/230591edb41d/982b679d6e48/b28417cab75a/
59 KB
21 KB
Script
General
Full URL
https://assets.adobedtm.com/230591edb41d/982b679d6e48/b28417cab75a/EXbed3137d17c5403883a0f39bd3970f29-libraryCode_source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/230591edb41d/982b679d6e48/launch-3d72e51944b6.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:7ac::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
3053f72539775d4ee0a5dd1b2bc954f0bcd6f75b0bbd2d951d550c2a02fcc4d8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"c895d93da855779686c9246db95dc112:1721999234.862458"
expires
Mon, 28 Oct 2024 11:26:32 GMT
accept-ranges
bytes
access-control-allow-origin
https://paymentsapply.home.barclaycard
content-length
21004
date
Mon, 28 Oct 2024 10:26:32 GMT
content-type
application/x-javascript
last-modified
Fri, 26 Jul 2024 13:07:14 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
AppMeasurement_Module_AudienceManagement.min.js
assets.adobedtm.com/extensions/EPb56e12d7054b4acea984e91c910051cc/
25 KB
9 KB
Script
General
Full URL
https://assets.adobedtm.com/extensions/EPb56e12d7054b4acea984e91c910051cc/AppMeasurement_Module_AudienceManagement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/230591edb41d/982b679d6e48/launch-3d72e51944b6.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:7ac::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
44495f451ea005302e82089cb8c166acd5e909b5862efc2fcba7f8249ff4469f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
etag
"66be6e24d6b0c77126d28b9abcd4eb38:1634593036.81505"
expires
Mon, 28 Oct 2024 11:26:32 GMT
accept-ranges
bytes
access-control-allow-origin
https://paymentsapply.home.barclaycard
content-length
8761
date
Mon, 28 Oct 2024 10:26:32 GMT
content-type
application/x-javascript
last-modified
Mon, 18 Oct 2021 21:37:16 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
favicon.ico
paymentsapply.home.barclaycard/
88 KB
88 KB
Other
General
Full URL
https://paymentsapply.home.barclaycard/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.158.127.53 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-127-53.eu-central-1.compute.amazonaws.com
Software
sfdcedge /
Resource Hash
f3ad63af1c2907f3b9410a4215582cfcf93a574e59a7f3e5b3afeef641e637c0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://paymentsapply.home.barclaycard/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains
x-request-id
811c514c2b4543726937af7064ae60b4
cache-control
public,max-age=86400
x-sfdc-request-id
811c514c2b4543726937af7064ae60b4
x-content-type-options
nosniff
referrer-policy
origin-when-cross-origin
expires
Tue, 29 Oct 2024 10:26:32 GMT
date
Mon, 28 Oct 2024 10:26:32 GMT
content-type
image/x-icon
server
sfdcedge

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| PerfConstants object| PerfLogLevel object| Perf object| UITheme object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in function| setImmediate function| clearImmediate object| WebComponents function| __CE_installPolyfill object| ShadyCSS object| regeneratorRuntime object| fastdom object| WCL object| digitalData object| payload function| onStartAgain function| AppMeasurement_Module_AudienceManagement function| DIL function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq string| s_account string| siteUrl object| s object| domain number| len function| getTimeParting

4 Cookies

Domain/Path Name / Value
paymentsapply.home.barclaycard/ Name: CookieConsentPolicy
Value: 0:1
paymentsapply.home.barclaycard/ Name: LSKey-c$CookieConsentPolicy
Value: 0:1
.home.barclaycard/ Name: s_plt
Value: 1.17
.home.barclaycard/ Name: s_pltp
Value: undefined

5 Console Messages

Source Level URL
Text
network error URL: https://paymentsapply.home.barclaycard/
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/styles/salesforce-lightning-design-system.min.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://paymentsapply.home.barclaycard/resource/1727317200000/CustomStyles/custom/styles.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://paymentsapply.home.barclaycard/lightning/lightning.out.js?v=2
Message:
Failed to load resource: the server responded with a status of 503 ()
security error URL: https://paymentsapply.home.barclaycard/
Message:
Refused to execute script from 'https://paymentsapply.home.barclaycard/lightning/lightning.out.js?v=2' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests frame-ancestors 'self' https://payments-apply-barclaycard.my.salesforce.com https://payments-apply-barclaycard.lightning.force.com
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM 'self'