//$headerCSP = "Content-Security-Policy-Report-Only:". $headerCSP = "Content-Security-Policy:". //"connect-src 'self' *.sovendus.com *.google-analytics.com;". // XMLHttpRequest (AJAX request), WebSocket or EventSource. "default-src 'self' 'unsafe-inline' 'unsafe-eval' cdnjs.cloudflare.com *.trustedshops.com bat.bing.com *.bing.com *.clarity.ms *.trustbadge.com *.doubleclick.net stats.g.doubleclick.net api.trustbadge.etrusted.com trustbadge.api.etrusted.com integrations.etrusted.com *.googlesyndication.com *.webmasterplan.com *.googleadservices.com *.google.com *.google.de *.gstatic.com code.jquery.com *.cookiefirst.com *.bootstrapcdn.com *.googletagmanager.com www.google.ru i.vimeocdn.com www.google.co.in www.googletagmanager.com *.google.at *.google.ie *.google-analytics.com *.google.ca *.googleapis.com *.vimeo.com *.youtube.com *.youtube.de *.youtu.be youtu.be *.youtube-nocookie.com *.google.ch *.salenti.de salenti.de *.google-analytics.com data:;". // Default policy for loading html elements //"frame-ancestors 'self' ;". //allow parent framing - this one blocks click jacking and ui redress //"frame-src 'self' *.sovendus.com;". // vaid sources for frames //"media-src 'self' *.trustedshops.com;". // vaid sources for media (audio and video html tags src) //"font-src 'self' *.sofort.com *.gstatic.com *.trustedshops.com;". // vaid sources for media (audio and video html tags src) //"img-src 'self' *.trustedshops.com *.google.com *.google-analytics.com *.webmasterplan.com data:;". // vaid sources for media (audio and video html tags src) //"object-src 'none'; ". // valid object embed and applet tags src "report-uri https://www.neugebauer.de/report_uri.php;"; //A URL that will get raw json data in post that lets you know what was violated and blocked //"script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.gstatic.com code.jquery.com *.trustedshops.com *.sovendus.com data:;" // allows js from self, jquery and google analytics. Inline allows inline js //"style-src 'self'";// allows css from self and inline allows inline css //Sends the Header in the HTTP response to instruct the Browser how it should handle content and what is whitelisted //Its up to the browser to follow the policy which each browser has varying support header($headerCSP); ?>