URL: https://777matadorbet.com/
Submission: On June 26 via api from BE — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 213.202.222.157, located in Germany and belongs to MYLOC-AS IP Backbone of myLoc managed IT AG, DE. The main domain is 777matadorbet.com.
TLS certificate: Issued by R10 on June 23rd 2024. Valid for: 3 months.
This is the only time 777matadorbet.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 213.202.222.157 24961 (MYLOC-AS ...)
7 1
Apex Domain
Subdomains
Transfer
7 777matadorbet.com
777matadorbet.com
76 KB
7 1
Domain Requested by
7 777matadorbet.com 777matadorbet.com
7 1

This site contains links to these domains. Also see Links.

Domain
url.siteyegit.co
generatepress.com
Subject Issuer Validity Valid
777matadorbet.com
R10
2024-06-23 -
2024-09-21
3 months crt.sh

This page contains 1 frames:

Primary Page: https://777matadorbet.com/
Frame ID: 45B04D557D441864618B65D6CEE8EBC1
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Matadorbet Giriş - Matadorbet Güncel Giriş - Matadorbet 2024

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

76 kB
Transfer

195 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
777matadorbet.com/
69 KB
20 KB
Document
General
Full URL
https://777matadorbet.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
fea8a9264c0c30b49f5c489019f61ff9606adea7798f0324af903c355d7f7b18
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Content-Type, Authorization
access-control-allow-methods
GET,POST
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
public, max-age=0
content-encoding
br
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
cross-origin-opener-policy
unsafe-none
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
date
Wed, 26 Jun 2024 01:05:58 GMT
expires
Wed, 26 Jun 2024 01:05:58 GMT
last-modified
Tue, 25 Jun 2024 22:09:15 GMT
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
referrer-policy
strict-origin-when-cross-origin
server
LiteSpeed
strict-transport-security
max-age=63072000; preload
vary
Accept-Encoding,User-Agent,Accept-Encoding
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
matadorbet-giris.png
777matadorbet.com/wp-content/uploads/2024/05/
8 KB
8 KB
Image
General
Full URL
https://777matadorbet.com/wp-content/uploads/2024/05/matadorbet-giris.png
Requested by
Host: 777matadorbet.com
URL: https://777matadorbet.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
e97f192d69e6a8085443f1f6d5bb8a0379ead940b2d11deaa630a9b14ac0171c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://777matadorbet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Thu, 24 Oct 2024 01:05:58 GMT
date
Wed, 26 Jun 2024 01:05:58 GMT
content-security-policy
upgrade-insecure-requests;
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; preload
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
content-length
7800
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 05 May 2024 16:04:08 GMT
server
LiteSpeed
cross-origin-opener-policy
unsafe-none
vary
User-Agent,Accept-Encoding
access-control-allow-methods
GET,POST
content-type
image/png
x-frame-options
SAMEORIGIN
cache-control
public, max-age=10368000,public
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
jquery.min.js
777matadorbet.com/wp-includes/js/jquery/
86 KB
29 KB
Script
General
Full URL
https://777matadorbet.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by
Host: 777matadorbet.com
URL: https://777matadorbet.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://777matadorbet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Fri, 26 Jul 2024 01:05:58 GMT
date
Wed, 26 Jun 2024 01:05:58 GMT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests;
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; preload
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
content-length
29744
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 08 Nov 2023 04:25:19 GMT
server
LiteSpeed
cross-origin-opener-policy
unsafe-none
vary
Accept-Encoding,User-Agent,Accept-Encoding
access-control-allow-methods
GET,POST
content-type
text/javascript; charset=UTF-8
x-frame-options
SAMEORIGIN
cache-control
public, max-age=2592000,public
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
jquery-migrate.min.js
777matadorbet.com/wp-includes/js/jquery/
13 KB
6 KB
Script
General
Full URL
https://777matadorbet.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by
Host: 777matadorbet.com
URL: https://777matadorbet.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://777matadorbet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Fri, 26 Jul 2024 01:05:58 GMT
date
Wed, 26 Jun 2024 01:05:58 GMT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests;
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; preload
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
4678
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 09 Aug 2023 04:26:31 GMT
server
LiteSpeed
cross-origin-opener-policy
unsafe-none
vary
Accept-Encoding,User-Agent,Accept-Encoding
access-control-allow-methods
GET,POST
content-type
text/javascript; charset=UTF-8
x-frame-options
SAMEORIGIN
cache-control
public, max-age=2592000,public
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
matadorbet.png.webp
777matadorbet.com/wp-content/uploads/2022/12/
9 KB
9 KB
Image
General
Full URL
https://777matadorbet.com/wp-content/uploads/2022/12/matadorbet.png.webp
Requested by
Host: 777matadorbet.com
URL: https://777matadorbet.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
4090813d74a42d92ff76ed1c0f09d93d2e750cf5d24305941c5840d095de37bb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://777matadorbet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Thu, 24 Oct 2024 01:05:58 GMT
date
Wed, 26 Jun 2024 01:05:58 GMT
content-security-policy
upgrade-insecure-requests;
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; preload
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
content-length
9164
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 23 Jun 2024 22:03:25 GMT
server
LiteSpeed
cross-origin-opener-policy
unsafe-none
vary
User-Agent,Accept-Encoding
access-control-allow-methods
GET,POST
content-type
image/webp
x-frame-options
SAMEORIGIN
cache-control
public, max-age=10368000
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
lazyload.min.js
777matadorbet.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/
9 KB
3 KB
Script
General
Full URL
https://777matadorbet.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js
Requested by
Host: 777matadorbet.com
URL: https://777matadorbet.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
f40767552e5e94b2d5f9a65d7f640cfa7d225298023dbd682095e040809a3d1a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://777matadorbet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Fri, 26 Jul 2024 01:05:58 GMT
date
Wed, 26 Jun 2024 01:05:58 GMT
content-encoding
br
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests;
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=63072000; preload
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
content-length
2902
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
last-modified
Sun, 23 Jun 2024 21:35:46 GMT
server
LiteSpeed
cross-origin-opener-policy
unsafe-none
vary
Accept-Encoding,User-Agent,Accept-Encoding
access-control-allow-methods
GET,POST
content-type
text/javascript; charset=UTF-8
x-frame-options
SAMEORIGIN
cache-control
public, max-age=2592000,public
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;
matadorbet-giris-sitesi.png
777matadorbet.com/wp-content/uploads/2022/09/
2 KB
2 KB
Other
General
Full URL
https://777matadorbet.com/wp-content/uploads/2022/09/matadorbet-giris-sitesi.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
213.202.222.157 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv10408.dus3e.dedi.server-hosting.expert
Software
LiteSpeed /
Resource Hash
846979ccfd41621af64c482ea2060d056fb79ec990785d63efe3069fd81d2258
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://777matadorbet.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Thu, 24 Oct 2024 01:05:58 GMT
date
Wed, 26 Jun 2024 01:05:58 GMT
content-security-policy
upgrade-insecure-requests;
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; preload
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none; report-to='default'
cross-origin-resource-policy
cross-origin
content-length
1590
cross-origin-embedder-policy-report-only
unsafe-none; report-to='default'
referrer-policy
strict-origin-when-cross-origin
last-modified
Fri, 18 Aug 2023 16:35:30 GMT
server
LiteSpeed
cross-origin-opener-policy
unsafe-none
vary
User-Agent,Accept-Encoding
access-control-allow-methods
GET,POST
content-type
image/png
x-frame-options
SAMEORIGIN
cache-control
public, max-age=10368000,public
permissions-policy
accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()
accept-ranges
bytes
access-control-allow-headers
Content-Type, Authorization
cross-origin-opener-policy-report-only
unsafe-none; report-to='default'
x-content-security-policy
default-src 'self'; img-src *; media-src * data:;

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage undefined| href object| tocplus object| RocketPreloadLinksConfig object| rocket_lazyload_css_data object| generatepressMenu object| lazyLoadOptions undefined| $ function| jQuery function| LazyLoad function| addEventListenerWPRocketBase

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=63072000; preload
X-Content-Security-Policy default-src 'self'; img-src *; media-src * data:;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN