| Content-Type | text/html; charset=utf-8 |
| Transfer-Encoding | chunked |
| Connection | keep-alive |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| X-XSS-Protection | 1; mode=block |
| Referrer-Policy | same-origin, strict-origin-when-cross-origin |
| Content-Security-Policy | default-src 'none'; img-src 'self' https://www.google-analytics.com; script-src 'self' https://www.google-analytics.com; style-src 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; report-uri https://plz.report-uri.io/r/default/csp/enforce |
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
| Public-Key-Pins-Report-Only | pin-sha256="3bVocQCvVq54eZkK2+vZf6dCYvr9kj+vsU4z0mbn3gU="; pin-sha256="u6l/n/3zinL6L9SAayWa0tXu2dX+6J77WB/deOyKx1I="; pin-sha256="ET3FsZD2D9FewsIQe8t6986ajvmFXaBzNJDXYBnXLMw="; pin-sha256="5e1MASoMjR09CTL5WP1dFoR9yQBLrAkwdHVCB3aoBaA="; pin-sha256="N6hALJkpMWIA3mdMkpeJRwFFNwxWQmNsbcL70XBwxIo="; pin-sha256="YswPXsgfC9zcBFJRkWg9cA3e22TY08khzcragg8vxQo="; max-age=600; includeSubdomains; report-uri="https://plz.report-uri.io/r/default/hpkp/reportOnly" |
| Content-Encoding | gzip |
| Vary | X-Requested-With, Accept-Encoding |