Content-Security-Policy: script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: data: *.aros.se *.hotjar.com *.hotjar.io *.matomo.cloud *.lfeeder.com *.licdn.com *.linkedin.com *.cloudflare.com *.googleapis.com *.google-analytics.com *.googletagmanager.com *.cookietractor.com; default-src 'self' data: ws: wss: blob: 'unsafe-inline' *.gstatic.com *.hotjar.io *.hotjar.com *.matomo.cloud *.oribi.io *.linkedin.com *.cookietractor.com *.umbraco.com *.googleapis.com *.typekit.net *.google.com *.doubleclick.net *.ytimg.com *.youtube.com *.ggpht.com *.google-analytics.com *.googletagmanager.com *.vimeocdn.com *.vimeo.com unpkg.com *.cloudflare.com cdn.cookietractor.com; font-src 'self' blob: data: *.typekit.net fonts.googleapis.com fonts.gstatic.com; img-src 'self' blob: data: *.googletagmanager.com *.lfeeder.com *.google.se *.linkedin.com *.vimeocdn.com *.umbraco.com;